This is genuinely useful. I have so many loyalty cards that exist only as physical barcodes that stores refuse to look up by phone number.
The privacy concern about sending pass data to the server is valid though. Since .pkpass files need to be cryptographically signed with Apple's certificate, there's no way to generate them purely client-side.
Potential solution: open source the signing code and let users run it locally with their own Apple Developer account ($99/year). Power users would do this, casual users can use your hosted version.
Also works with Google Wallet apparently, which is great for Android users.
For loyaltycards there was Stocard, but it got acquired by the toxic company Klarna.
SuperCards is very very similar, and in my opinion more useful than putting everything in Apple Wallet. You get to store a pictures, and everything is in one place. Apple Wallet is already cluttered with tons of creditcards, tickets, etc
Weird thing from the pretty ho-hum super cards privacy policy:
> The Service Provider will retain User Provided data for as long as you use the Application and for a reasonable time thereafter. If you'd like them to delete User Provided Data that you have provided via the Application, please contact them at blub@blob.com and they will respond in a reasonable time.
That looks like a placeholder address to me? Not exactly confidence inspiring if so…
> It won't scan cards with AI - you manually enter the barcode, which I think makes it less prone to error.
This is a very interesting sentence.
I interpret this sentence as saying that manually entering a barcode is less error prone than letting AI do it, that AI would have an unacceptable margin of error (and this is probably an accurate assessment).
But you don't need AI to find or read barcodes. Finding and reading barcodes is a reasonably mature technology that has existed long before AI.
Barcodes exist as a fast, machine readable data transfer format meant to avoid data entry errors by avoiding manual data entry, and yet you've implemented manual entry in order to avoid errors?
Now, if one of the constraints you've put on your implementation is that it work only in the browser and you don't want to have to download a large barcode scanning library to the browser, then it makes sense to implement manual entry. But that has nothing to do with AI.
That being said, there are some barcode reading apps that can be used to prompt for a scan from a web page, and you get the barcode payload back. I've used an app called "bineye" on Android (source on GitHub) that works like this. This helps avoid error prone manual entry and gets the full barcode payload (many barcodes store/encode more information than the human readable text printed next to them).
i should've been clearer: while browsing i found multiple apps that do this. most use AI to extract data from images and are much more feature-rich - you can photo your boarding pass and it goes straight to wallet. however, i noticed that AI sometimes gets details wrong. for example, when i uploaded just a barcode image, it couldn't create the pass because the model also wanted a "name" field.
When I’ve done similar things in the past I found there was always a library for barcode/QR use cases before such things ended up being built into the OS/Framework I’m in.
I don’t see it that way. I would rather have a browser based, one-off tool that can generate a .pkpass served up for local “installation”, not installing an app that is necessary to separately manage the passes separately and very well could be tracking its users.
One obvious concern here is data privacy, since the pass details are sent to the server. Any chance it would be possible to run everything in the browser, without sending data back to the server?
I'm not exactly sure how passes are signed, but in most digital signature schemes, you only sign the hash of the message, not the actual contents. Therefore you could conceivably do this in a privacy preserving way by only passing in the hash to be signed, which would allow the server to generate a valid signature without knowing the contents.
Apple Wallet passes use CMS signatures. you're right that only hashes are signed. but Apple requires an official Developer certificate ($99/year) with a private key that can't be exposed to browsers. for true privacy, each user would need their own cert. and defeats the "free" goal. and if you have a dev certificate it's trivial to generate one on your own machine.
>Apple Wallet passes use CMS signatures. you're right that only hashes are signed. but Apple requires an official Developer certificate ($99/year) with a private key that can't be exposed to browsers.
Why can't the browser send the hash to the server for signing?
Any chance of allowing me to upload my own keys and doing the signing in the browser? I am sure this is a niche use case but I know how to generate the certificate for this but have been too lazy to make a thing like this for (checks to-do list) something like six years and I'd much rather just use your thing lol
The site is pretty clear: "Free and works in browser", "Processed locally", "Private". But apparently the site (sorry for the harsh word, but I can't interpret it any other way) lies.
"is incorrect" is slightly less harsh, but in this case, I'd call it a lie. It's a rather subtle but important implementation detail. I don't think the author (who is here in this thread) is necessarily malicious because of this, but, well, it's a lie.
I wish there were a way to “archive” cards and passes in the Wallet app. I’d be much more likely to pass-ify my life if that were the case.
The Wallet app is just too important and used frequently in time sensitive actions to clutter with cards/passes that I use once every few months. That is, when I’m about to tap to pay, I don’t want to infrequently used cards to clutter my payment experience. Likewise, when I’m about to board a flight, I don’t want random loyalty cards to clutter the interface.
At the same time, I would really like to keep these occasional cards and passes in Wallet, just not on the main screen. It definitely beats hanging onto these physically, especially because they are in fact infrequently used so I would never carry them around.
It should be a similar distinction to Apple’s Home Screen vs App Library for long-term archival.
I use my password manager for those. The only card I have in my Apple wallet is my grocery card. Otherwise, I go to my password manager and pull up the entry and the attached images. Some, I have just a barcode png. Others I have screenshots of the card from an app/website. This has been a really good balance for me.
As an aside, I tried to use base64 for the images so everything was in text, but decoding with a shortcut was annoying enough I went with the image attachment.
It’s possible to make a pass with location info so that it pops up on your Home Screen when you’re nearby a relevant location (e.g. a store, library, train station, etc). Doesn’t seem to be supported by this tool, though.
OK, stupid question, what is the thing this utility does that can't be achieved with scanning a physical pass with barcode or entering the details manually into a Google Wallet?
Because I don't see the.... utility if it?
Unless this achieves something specific I don't know.
I don’t know about Google Wallet, but for iOS Wallet, it is not possible to create a new entry there yourself as a normal user.
It has to be signed with a $99/yr certificate, so this thing does the signing for you. The utility is that whatever you created now lives with the rest of the passes in one place.
This is such a quick and neat way to get a pass for all the random codes in your wallet.
I've had a long shelved project (>8 years now?) where I was working on a solution to doing this from a mobile device but with loads more customization (including image options for different slots), but the cost effectiveness thanks to the PKPass signing as you noticed, put me off to provide it as a public utility as I was a student then. This gives me motivation to revisit it.
A curious example of a compatibility feature ending up having a much better experience than the thing that they clearly want you to do. Hopefully some Google PM doesn't see this comment and ruin things…
A personal use case: my local gym that issues only physical barcode cards -- I used a different app (similar in this style) that allowed me keep it on my apple watch / iPhone instead
my use case is a loyalty barcode for a major retailer here. they provided a digital version but you had to download their app or take a picture. apple wallet is convenient, u just double tap and the Wallet loads on screen with full brightness to make it easy to scan. i dont have to keep anymore.
but on apple wallet u can't create your own a pass from a simple scan. creatign the ".pkpass" need a signature from a apple developer account.
That will vary. It can technically include any text up to a limit, but most likely it will be a URI, but it could be as simple as and account number. You would want to decode the QR (you can likely do that using your phone camera) and that would be the data to enter.
Ideally this tool would simply use the camera to capture the visual code (bar, QR, etc.) and enter it/replicate it.
We’ve been using Apple Wallet (and Google Pay) with bar code scanners with some success, but the bar codes sometimes do not scan correctly and we get garbled or completely wrong data maybe 1 in 20-30 scans. Tried various scanner settings/speeds, etc, no dice so far, and the scanner/pos combo was the one recommended by our processing vendor. Both were among the highest dollar models.
This looks like a very cool project!
This is genuinely useful. I have so many loyalty cards that exist only as physical barcodes that stores refuse to look up by phone number.
The privacy concern about sending pass data to the server is valid though. Since .pkpass files need to be cryptographically signed with Apple's certificate, there's no way to generate them purely client-side.
Potential solution: open source the signing code and let users run it locally with their own Apple Developer account ($99/year). Power users would do this, casual users can use your hosted version.
Also works with Google Wallet apparently, which is great for Android users.
For loyaltycards there was Stocard, but it got acquired by the toxic company Klarna.
SuperCards is very very similar, and in my opinion more useful than putting everything in Apple Wallet. You get to store a pictures, and everything is in one place. Apple Wallet is already cluttered with tons of creditcards, tickets, etc
Weird thing from the pretty ho-hum super cards privacy policy:
> The Service Provider will retain User Provided data for as long as you use the Application and for a reasonable time thereafter. If you'd like them to delete User Provided Data that you have provided via the Application, please contact them at blub@blob.com and they will respond in a reasonable time.
That looks like a placeholder address to me? Not exactly confidence inspiring if so…
> It won't scan cards with AI - you manually enter the barcode, which I think makes it less prone to error.
This is a very interesting sentence.
I interpret this sentence as saying that manually entering a barcode is less error prone than letting AI do it, that AI would have an unacceptable margin of error (and this is probably an accurate assessment).
But you don't need AI to find or read barcodes. Finding and reading barcodes is a reasonably mature technology that has existed long before AI.
Barcodes exist as a fast, machine readable data transfer format meant to avoid data entry errors by avoiding manual data entry, and yet you've implemented manual entry in order to avoid errors?
Now, if one of the constraints you've put on your implementation is that it work only in the browser and you don't want to have to download a large barcode scanning library to the browser, then it makes sense to implement manual entry. But that has nothing to do with AI.
That being said, there are some barcode reading apps that can be used to prompt for a scan from a web page, and you get the barcode payload back. I've used an app called "bineye" on Android (source on GitHub) that works like this. This helps avoid error prone manual entry and gets the full barcode payload (many barcodes store/encode more information than the human readable text printed next to them).
i should've been clearer: while browsing i found multiple apps that do this. most use AI to extract data from images and are much more feature-rich - you can photo your boarding pass and it goes straight to wallet. however, i noticed that AI sometimes gets details wrong. for example, when i uploaded just a barcode image, it couldn't create the pass because the model also wanted a "name" field.
When I’ve done similar things in the past I found there was always a library for barcode/QR use cases before such things ended up being built into the OS/Framework I’m in.
https://serratus.github.io/quaggaJS/ seems browser friendly?
Generally I agree with your point on AI fuzziness here not being useful.
Could you add Codabar?
edit: oh, I guess you can't, because Apple Wallet doesn't support it.
i think there's a way but it's hacky. instead of using the barcode property it would add an image based on your inputted codabar.
That would be pretty great. I have half a dozen codabar-based cards.
I solved this issue with Wallet Creator: https://apps.apple.com/app/id1486573384
Didn't know it was this simple to just provide a download for prepared file. Is it open source?
I don’t see it that way. I would rather have a browser based, one-off tool that can generate a .pkpass served up for local “installation”, not installing an app that is necessary to separately manage the passes separately and very well could be tracking its users.
MakePass is an app that creates independent/proper Wallet *.pkpass files. You can completely customise the pass appearance according to Apple’s specs.
(Not sure whether the current licensing offerings are worth it, though. I’ve got grandfathered in from before it had AI support.)
https://pvieito.com
What happens when they website goes away? The app I can save and use locally after the website is defunct.
It claims material "processed locally" but it seems like it uploads the barcode data at least to the server to generate the pass.
Does the "process locally" banner only meant apply to uploaded images, not the underlying barcode numbers?
https://i.moveything.com/5187fc2f7abd
Love the idea, thanks for sharing!
One obvious concern here is data privacy, since the pass details are sent to the server. Any chance it would be possible to run everything in the browser, without sending data back to the server?
not really. the .pkpass needs to be signed. you can build the file locally but you won't be able to load it in apple wallet.
I'm not exactly sure how passes are signed, but in most digital signature schemes, you only sign the hash of the message, not the actual contents. Therefore you could conceivably do this in a privacy preserving way by only passing in the hash to be signed, which would allow the server to generate a valid signature without knowing the contents.
Apple Wallet passes use CMS signatures. you're right that only hashes are signed. but Apple requires an official Developer certificate ($99/year) with a private key that can't be exposed to browsers. for true privacy, each user would need their own cert. and defeats the "free" goal. and if you have a dev certificate it's trivial to generate one on your own machine.
>Apple Wallet passes use CMS signatures. you're right that only hashes are signed. but Apple requires an official Developer certificate ($99/year) with a private key that can't be exposed to browsers.
Why can't the browser send the hash to the server for signing?
let me look into it.
Any chance of allowing me to upload my own keys and doing the signing in the browser? I am sure this is a niche use case but I know how to generate the certificate for this but have been too lazy to make a thing like this for (checks to-do list) something like six years and I'd much rather just use your thing lol
that's a good idea. i'll release a BYOK version but don't plan to host it myself. will include a quick run script to run it locally.
Haha, I just made a comment above that I've been sitting on a half done project to do this for around 8 years now.
Please be clearer about this on the site!
The site is pretty clear: "Free and works in browser", "Processed locally", "Private". But apparently the site (sorry for the harsh word, but I can't interpret it any other way) lies.
"is incorrect" is slightly less harsh, but in this case, I'd call it a lie. It's a rather subtle but important implementation detail. I don't think the author (who is here in this thread) is necessarily malicious because of this, but, well, it's a lie.
yeah was expecting that, thanks! do not use my gym pass pls
I wish there were a way to “archive” cards and passes in the Wallet app. I’d be much more likely to pass-ify my life if that were the case.
The Wallet app is just too important and used frequently in time sensitive actions to clutter with cards/passes that I use once every few months. That is, when I’m about to tap to pay, I don’t want to infrequently used cards to clutter my payment experience. Likewise, when I’m about to board a flight, I don’t want random loyalty cards to clutter the interface.
At the same time, I would really like to keep these occasional cards and passes in Wallet, just not on the main screen. It definitely beats hanging onto these physically, especially because they are in fact infrequently used so I would never carry them around.
It should be a similar distinction to Apple’s Home Screen vs App Library for long-term archival.
I use my password manager for those. The only card I have in my Apple wallet is my grocery card. Otherwise, I go to my password manager and pull up the entry and the attached images. Some, I have just a barcode png. Others I have screenshots of the card from an app/website. This has been a really good balance for me.
As an aside, I tried to use base64 for the images so everything was in text, but decoding with a shortcut was annoying enough I went with the image attachment.
It’s possible to make a pass with location info so that it pops up on your Home Screen when you’re nearby a relevant location (e.g. a store, library, train station, etc). Doesn’t seem to be supported by this tool, though.
This also works for Google Wallet, you could change the messaging around it to indicate that.
OK, stupid question, what is the thing this utility does that can't be achieved with scanning a physical pass with barcode or entering the details manually into a Google Wallet?
Because I don't see the.... utility if it?
Unless this achieves something specific I don't know.
I don’t know about Google Wallet, but for iOS Wallet, it is not possible to create a new entry there yourself as a normal user. It has to be signed with a $99/yr certificate, so this thing does the signing for you. The utility is that whatever you created now lives with the rest of the passes in one place.
nice! don't have an android device to test - did u download it and it worked?
This is great! Are you sure you are not violating any ToS for that? I’d hate to see it go
It probably is violating the ToS. But would like to know more.
Unlikely, I've used apps similar to this such as passbook [0] for a while now and they're still up.
[0] https://apps.apple.com/us/app/passbook-wallet-pass-creator/i...
Nothing wrong with signing a pass
This is such a quick and neat way to get a pass for all the random codes in your wallet.
I've had a long shelved project (>8 years now?) where I was working on a solution to doing this from a mobile device but with loads more customization (including image options for different slots), but the cost effectiveness thanks to the PKPass signing as you noticed, put me off to provide it as a public utility as I was a student then. This gives me motivation to revisit it.
Have a look at MakePass[0] - which sounds exactly like you describe. It allows you to design a pass as per spec.
[0] https://pvieito.com
This is great am I weird for wanting an app?
As an aside, I find it really sad that, having a de-Googled Anroid phone, it's actually easier for me to download the Apple Wallet .pkpass files
Anything to do with Google Wallet passes just forwards me to a Google login page.
A curious example of a compatibility feature ending up having a much better experience than the thing that they clearly want you to do. Hopefully some Google PM doesn't see this comment and ruin things…
Condor airlines has an "open with Google wallet" link, that doesn't work because I don't have that app. .pkpass files just work with my foss wallet
I have been looking for something like this for so long! All I wanna do is stop carrying this rec center card around. Perfect.
That's very useful, thanks!
One small-ish feature request: could you please add support for EAN-8?
Code39 would be really useful ;-)
Yeah, Code39 would be really festive.
Yeah, Code39 would be really festive.
noted
This is excellent! Wish the Wallet had this ability built in.
I don’t think I fully understand the use case for this. What would you use the card for?
A personal use case: my local gym that issues only physical barcode cards -- I used a different app (similar in this style) that allowed me keep it on my apple watch / iPhone instead
I see, so this is specifically you have a physical, eg, loyalty card that has a barcode, and you want to use the Apple Wallet?
my use case is a loyalty barcode for a major retailer here. they provided a digital version but you had to download their app or take a picture. apple wallet is convenient, u just double tap and the Wallet loads on screen with full brightness to make it easy to scan. i dont have to keep anymore.
but on apple wallet u can't create your own a pass from a simple scan. creatign the ".pkpass" need a signature from a apple developer account.
Maybe a dumb question: if I'm entering a QR code, which info do i put in?
That will vary. It can technically include any text up to a limit, but most likely it will be a URI, but it could be as simple as and account number. You would want to decode the QR (you can likely do that using your phone camera) and that would be the data to enter.
Ideally this tool would simply use the camera to capture the visual code (bar, QR, etc.) and enter it/replicate it.
agree. implemented QR code scanning using the great html5-qrdecode package so scanning happens locally.
Source? Can we get a repo please?
scanning for barcodes is an easy enough pre-AI computer vision algorithm with OpenCV. AI could "write" that for you!
We’ve been using Apple Wallet (and Google Pay) with bar code scanners with some success, but the bar codes sometimes do not scan correctly and we get garbled or completely wrong data maybe 1 in 20-30 scans. Tried various scanner settings/speeds, etc, no dice so far, and the scanner/pos combo was the one recommended by our processing vendor. Both were among the highest dollar models. This looks like a very cool project!