NADRA has replaced the CNIC's microchip with a QR code, verified via the PakID app. Here's how it works, whether it's secure, and what to do next.
For fourteen years, the small gold chip embedded in every Pakistani's Smart National Identity Card sat there mostly doing nothing. It was supposed to enable secure digital verification at banks, telecom counters, and hospitals but the card readers needed to actually use it were never widely deployed, so the chip became an expensive, imported piece of decoration on a document every adult in the country is required to carry. On August 14, 2026, NADRA quietly retired it. The card issued to you from that date carries no chip at all. In its place is a QR code.
What actually happened, and why now
The National Database and Registration Authority's new identity card is built by the National Security Printing Company in Karachi entirely domestically, which is the detail NADRA has emphasized most. The old chip had to be imported from foreign suppliers; the QR code doesn't. That single change removes a foreign supply-chain dependency from a document the state issues to over 100 million adults, which is a bigger deal for national resilience than it sounds a chip shortage, a sanctions issue, or a supplier dispute could previously have slowed down ID issuance for an entire country. A QR code has no import dependency at all.
The federal government approved the switch on February 23, 2026, through amendments to the National Identity Card Rules, 2002. The rollout itself started August 14, 2026, replacing the standard chip-based CNIC first. From January 2027, the same QR-based format extends to NICOP cards for overseas Pakistanis and Juvenile Cards, and in the final phase, the Pakistan Origin Card follows. If your existing chip-based card is still valid, NADRA has confirmed you don't need to rush out and replace it it stays usable until its printed expiry date.
What's actually inside the code, and who can read it
The QR code carries the cardholder's core identity details and photograph, verified through NADRA's own Pak Identity (PakID) mobile app rather than a specialized chip reader. That's the practical improvement worth sitting with: a chip needed dedicated hardware that banks and hospitals mostly never installed. A QR code needs an ordinary smartphone camera, which every verifying institution already has in someone's pocket. NADRA has said it will distribute verification software to telecom operators, banks, hospitals, Pakistan Railways, and police, letting them scan and cross-check a card against the central database in real time rather than trusting whatever the card claims about itself offline.
The new card also carries something the old one didn't: visible symbols and markers identifying persons with disabilities, senior citizens, organ donors, and notably residents of specific categories the government wanted easier to identify at a glance, alongside a unique family number field.
The obvious question: isn't a QR code easier to fake than a chip?
This is worth answering honestly rather than just repeating the official announcement. A microchip authenticates cryptographically against the reader it's plugged into it's genuinely difficult to clone without specialized equipment. A QR code, by contrast, is just a printed pattern; in theory, anyone with a decent camera and printer can photograph and reproduce one.
What actually determines whether that matters is where the verification happens. If a QR code just displayed your name and photo for a human to glance at, copying it would be trivial and dangerous. But every description of NADRA's rollout points to live verification the scanning institution's software checks the code against NADRA's central database at the moment of the scan, not against data baked permanently into the card. That shifts the security model from "does this card prove itself" to "does this record match what the government has on file right now," which is a meaningfully different and in some ways stronger kind of check, since a stolen or reproduced card can be flagged or invalidated centrally the moment it's reported, the same way a bank can freeze a card number without needing to physically recover the card. The tradeoff is that verification now depends on the checking institution actually having a live connection and using NADRA's real software, rather than any barcode scanner working out of the box which is exactly the gap the widely available smartphone app is meant to close.
Why this fits a pattern Pakistan's institutions have all converged on in 2026
Line this up against what else has happened this year and a clear shape emerges. The State Bank mandated a unified, interoperable Raast QR standard for merchant payments. DRAP is putting scannable 2D codes on every medicine pack to fight counterfeit drugs. And now NADRA has rebuilt the national identity card itself around the same basic technology. Three different institutions, solving three unrelated problems payments, drug safety, identity have all landed on the same answer this year: a QR code checked live against a central system beats a static credential that has to prove itself alone.
What to actually do about it
- Don't panic-replace your current card. NADRA has explicitly said existing chip-based cards remain valid until they expire.
- When you do renew, expect the polycarbonate QR card, not the old Teslin chip design this is now the default from August 2026 onward.
- If you're an overseas Pakistani or applying for a Juvenile Card, the QR format won't reach you until January 2027 at the earliest the chip-based version is still what's currently issued for those categories.
- Treat a QR-based CNIC the way you'd treat a bank card, not a static laminated document — its real security lives in the live database it's checked against, so protecting your NADRA-linked accounts and reporting a lost card promptly matters more now than it used to.
The same underlying caution we've written about for QR code scams applies here too, in principle if not in the exact mechanism: a QR code is only as trustworthy as the system verifying it, whether that's a payment gateway, a pharmacy app, or now, the document that legally proves who you are.