Inside the eSIM chip
Every mobile phone needs a way to identify itself to a carrier network. Traditionally, this was done with a removable SIM card — a small plastic chip containing a tiny integrated circuit that stored your carrier credentials (IMSI, authentication keys, and network preferences).
An eSIM (embedded SIM, also called eUICC — embedded Universal Integrated Circuit Card) is functionally identical to a physical SIM but is soldered permanently onto the device's motherboard during manufacturing. The chip itself is about the size of a grain of rice and is physically impossible to remove by the user.
The key innovation is that the eSIM chip is reprogrammable. Rather than being locked to a single carrier profile from the factory, it can securely download, store, and switch between multiple carrier profiles over the internet.
How remote provisioning works
The technology that makes eSIM possible is called Remote SIM Provisioning (RSP), defined by the GSMA (the global mobile industry body). Here's what happens when you download a carrier profile:
You purchase a plan
You buy an eSIM data plan from a provider like VAYO. The provider's backend creates a unique carrier profile for your device.
A QR code is generated
The profile is uploaded to a secure server called an SM-DP+ (Subscription Manager Data Preparation Plus). A QR code is generated that acts as a key to download this specific profile.
Your device requests the profile
When you scan the QR code, your device reads the SM-DP+ server address and an activation code embedded in the QR. It connects to that server over a mutually authenticated HTTPS connection.
Mutual authentication
The server and your eSIM chip verify each other's cryptographic certificates (based on the GSMA's CI — Certificate Issuer root). This prevents fake profiles being installed and prevents profile theft.
Profile downloaded & installed
Once authenticated, the carrier profile is downloaded and stored inside the eSIM chip's secure element. The profile contains all the credentials needed to authenticate with the carrier network.
You're connected
Enable the profile, and your device registers on the carrier's network just like a physical SIM would. From the network's perspective, there is no difference.
QR code activation — what's actually in it?
The QR code you receive from VAYO contains two pieces of information encoded in a standard GSMA format:
- SM-DP+ address — the domain of the secure provisioning server that holds your profile.
- Activation code — a unique token that authorises your specific device to download that profile.
You can also enter these values manually if you cannot scan the QR code. The full format looks like: LPA:1$server.domain.com$ACTIVATION-CODE. Your phone's eSIM app (Local Profile Assistant, or LPA) parses this and starts the download.
Each QR code is single-use and tied to one device. Once downloaded, the activation code is invalidated on the server — nobody else can download the same profile.
Dual SIM and multiple profiles
One of the biggest practical advantages of eSIM is that a device can store multiple profiles simultaneously — though only a limited number can be active at once (usually 1–2 depending on hardware).
On a dual-SIM device (like iPhone 14 and later, or most modern Android flagships), you can have:
- Your home carrier on the physical SIM nano slot (or as an eSIM profile) — handling your regular phone number, calls, and SMS;
- A VAYO travel eSIM profile active simultaneously — providing local data in your destination country.
Both work at the same time. You set which profile handles data (VAYO) and which handles calls/SMS (your home SIM) in your phone's Settings. You keep your number, your contacts can still reach you, and you get affordable local data rates abroad.
eSIM vs physical SIM — under the hood
From a network perspective, a device using an eSIM profile is indistinguishable from one using a physical SIM. The same GSM/LTE/5G authentication protocols apply. The same International Mobile Subscriber Identity (IMSI) and authentication keys are used. The carrier network does not know or care whether the credentials are stored on a plastic chip or an embedded circuit.
The practical differences are entirely on the user side: no physical card to handle, instant over-the-air provisioning, and the ability to switch profiles without visiting a store or waiting for a delivery.
Security and global standards
eSIM technology is governed by GSMA specifications (SGP.02 for M2M and SGP.22 for consumer devices). Key security properties include:
- Mutual TLS authentication between the device and the SM-DP+ provisioning server;
- Cryptographic profile binding — a profile can only be installed on the device for which it was created, based on the device's EID (unique hardware identifier);
- Secure element storage — profiles are stored inside a tamper-resistant chip, inaccessible to the operating system or third-party apps;
- Profile deletion — when you delete an eSIM profile, the profile is cryptographically erased from the secure element and cannot be recovered or reused.
In practice, eSIM is considered more secure than a physical SIM because it is resistant to SIM-swapping attacks — a fraudster cannot walk into a store and convince a carrier to move your eSIM to their device.