Getting and Using DigiD in the Netherlands: A Practical Guide

DigiD is a personal electronic identity for logging in to participating Dutch public, healthcare, education and pension services. It is not a residence permit, physical identity document, email address or general commercial account. One person should use only their own DigiD. A helper must never log in as that person; use DigiD Authorisation where the service supports it.

For the normal Netherlands application, first confirm four prerequisites: a citizen service number (BSN), registration in the Personal Records Database (BRP) at a Dutch residential address or an accepted correspondence address, access to that registered post, and a phone that can receive the required messages. The application letter goes only to the address held by the municipality. Correct a wrong BRP address with the municipality before applying; DigiD cannot redirect the letter to a convenient address. Application and ordinary DigiD use are free.

Choose the correct route before starting:

For a child aged 13 or under, a parent or guardian may apply and help use the child's own DigiD by entering the child's details. The letter is addressed to the child at the child's official address. From age 14, the child must apply personally and the credentials are strictly personal. A child's DigiD does not automatically let a parent view every medical record: healthcare providers apply confidentiality and proxy rules, particularly as the child gets older. Ask the provider for its parental-access or formal proxy route rather than sharing the child's login.

Before applying, make a small access record: current BRP address, BSN stored securely, phone number, email, application date and expected letter deadline. Do not store the password or app PIN in that record. Visit DigiD by typing the address or following the public body's trusted login button, not an unsolicited message. If the requirements do not match your situation, resolve registration or choose the abroad route before creating an application that cannot be activated.

Apply through the official DigiD application page. Enter your own BSN, date of birth, postal code and house number as registered in the BRP, plus the requested phone and email details. Create a case-sensitive username of 6–32 characters with no spaces and a password of 8–32 characters containing lowercase, uppercase, a number and a special character. DigiD recommends a longer, hard-to-guess password. Save the username securely: it cannot be changed, and the helpdesk cannot tell it to you.

After submission, note the date and which username/application is current. DigiD sends an activation letter to the BRP address within a maximum of five working days; some pages state three working days, but five is the safe official outer limit. The envelope contains an activation code beginning with A. It is not the password and must be entered only in the activation flow. A move made around the application date can send the letter to the old registered address, so check the BRP record rather than assuming postal forwarding will solve it.

Activate within 21 days. In the DigiD app, enter the username and password, any SMS code, then the A code from the letter and complete app activation. Alternatively, use the website's “Enter activation code” flow; an account can be activated without a telephone, but many organisations require a phone-based second step, so configure the app or SMS where possible. Never send a photograph of the letter or read the code to someone who contacted you.

If no letter arrives after five working days, confirm the official address and delivery situation. From the app choose “Apply for a new letter”, or on the website enter the username/password and select “I have not received a letter”. A replacement can be requested once, arrives within five working days and has its own 21-day validity. Use the newest letter. If the replacement is also lost or missing, if the activation code expired, or if the unactivated account's password was forgotten, submit a completely new DigiD application.

Three wrong activation-code entries stop that application even though a letter may still arrive; that code can no longer activate it, so reapply. Distinguish a temporary login block, where the displayed waiting period should be observed, from a stopped or expired application. Once activation succeeds, test logging in to My DigiD, add and verify an email address, review the phone number and record only the completion date. Destroy spare code copies securely while keeping ordinary proof that activation completed.

Configure the strongest method your required services accept, while keeping a recovery route. Login methods are not interchangeable assurance levels:

For app activation, follow the options the app actually offers: an existing active app, an ID check, SMS, or a postal letter depending on the account and device. A compatible NFC phone is iPhone 7 or later or suitable Android hardware; the current app operating-system rule still applies. The ID check accepts Dutch documents only. A foreign passport, foreign national identity card or Dutch residence document cannot perform it. A Dutch document without the BSN in its chip also fails. If the target service does not require ID check, use an accepted lower method; otherwise ask that service for an alternative or use a trusted person's NFC phone solely to perform the official ID-check process without giving them the PIN.

Activate the app only from an official app store. Choose a unique PIN, keep device lock and operating system current, and review active installations in My DigiD. Deactivate old devices before exceeding the five-device limit. Biometrics can replace entering the app PIN on a device, but anyone enrolled in that device's biometrics may gain that convenience, so check shared-device settings.

Finally, verify the exact service before a deadline. A successful My DigiD login proves the account works but not that a municipality, insurer or healthcare portal accepts the same level. Try the real portal early, record which method it demands, and arrange its non-digital or assisted alternative if your document/device cannot satisfy that level. Never “solve” an assurance mismatch by lending credentials or approving a prompt you did not initiate.

Start at the organisation whose service you need - such as MijnOverheid, Belastingdienst, UWV, municipality, pension fund or healthcare provider - and choose its DigiD button. Check that the subsequent DigiD address is digid.nl; DigiD advises checking the full browser address before entering anything. DigiD does not ask by unsolicited email, text, phone call or QR code for credentials or an app approval. If a prompt appears that you did not initiate, reject it and close the page.

With the app on the same device, the app should open from the browser; on another device, enter the four-character pairing code shown in the app, scan or confirm the displayed QR flow, verify that the organisation named in the app is the one you intended, then enter the app PIN. Pairing codes are temporary and are not activation, recovery or authorisation codes. With SMS, enter the username/password and the one-time code sent to the registered number. Never give any of these codes to a caller.

After entry, verify the portal, represented person and task before submitting. DigiD authenticates identity; the organisation controls the form, data, eligibility, deadline and final confirmation. Download or save the organisation's receipt, reference number, submitted PDF and timestamp. A DigiD usage record alone does not prove which fields, attachment or transaction the organisation received.

Review security and contact data in My DigiD periodically:

• confirm the email and telephone number, completing their verification;
• review active DigiD-app devices and deactivate ones no longer controlled;
• inspect usage history for organisation, date and login that you recognise;
• check enabled SMS, app, ID check and “always two steps” settings;
• never change data through a link in an alarming message - open DigiD directly.

If My DigiD works but one public body's portal does not, capture the exact error, time, browser/device and required method, then contact that organisation's helpdesk. The portal may be unavailable, may not support an authorisation, or may require a higher login level; applying for another DigiD is usually the wrong fix. If My DigiD itself also fails, use DigiD recovery/help.

Log out from both the service and DigiD, especially on a shared computer, then close the browser. Do not allow a browser to save the password on a public device. Maintain a deadline fallback: ask the organisation in advance whether it accepts a telephone, paper, desk appointment or documented outage procedure. If a filing deadline is near, report the technical problem to the responsible organisation immediately and preserve evidence; a login attempt does not automatically extend a legal deadline.

Help must preserve the account holder's control. Never give a relative, adviser, employer or support worker the DigiD username, password, app PIN, SMS code or device. If another person needs to complete an supported task, use DigiD Authorisation; if the task is not supported, ask the responsible organisation for its own proxy or non-digital route.

An authorisation covers a named participating service - such as a particular tax return or allowance - and a fixed period. It is not blanket access to all government or medical records. The represented person can request a code and give the helper the code plus their BSN. The helper opens DigiD Authorisation, logs in with the helper's own DigiD and activates that code. Alternatively, a helper can request a code using the represented person's BSN; the letter goes to the represented person's BRP home address, and that person must personally pass it on. A person without DigiD can request authorisation by telephone through the DigiD helpdesk and receive the letter at the BRP address. That postal option is not available abroad or in the Caribbean Netherlands.

Companies such as tax advisers can be authorised, but they use the business/authorisation method shown for the service; do not give an employee personal credentials. Not every organisation or task participates. Before relying on authorisation, search the live service list, confirm the period and test the helper's represented-person login. View authorisations in “My authorisations”; the person granting access can extend an eligible expiry, and active permission can be stopped with “Revoke authorisation”. A helper whose permission is expiring may need to revoke and request a new one under the current flow.

Choose the right help channel:

• DigiD helpdesk for application, activation, account, app or suspected-login problems; use the number/contact details on the official site (currently telephone 088 123 65 55) rather than a search advertisement.
• the organisation's own helpdesk when My DigiD works but its portal, form, data or authorisation does not;
• an Information Point Digital Government in many libraries for in-person questions, or a Digisterker course - usually four two-hour Dutch-language sessions and available without library membership;
• the organisation's telephone, paper or appointment alternative when digital use is inaccessible or impossible.

A helper may sit beside the person, explain screens and look away while credentials/PIN are entered. Confirm the organisation name and final submission together, then save its receipt. For a child, guardian or person lacking capacity, ask the specific healthcare/public body about legal representation; DigiD Authorisation is not a substitute for every guardianship or medical-consent rule.

If fraud is suspected, stop ordinary assistance: reject prompts, secure the account, review usage and contact affected bodies. Preserve evidence and report actual identity fraud through police/CMI as appropriate. The safe outcome is access through an explicit, revocable permission or official alternative - not shared secrets that cannot show who acted.

Prepare DigiD before leaving the Netherlands if possible: verify email and mobile number, activate the app on a device you control, test the required services and keep the BRP/RNI address accurate. An already active DigiD continues to work after moving abroad; do not cancel it merely because you deregister. Confirm that the phone can receive Dutch SMS abroad and add a recovery method before the Dutch address is gone.

If applying while living abroad or in Bonaire, Sint Eustatius or Saba, you need a BSN, registration in the Non-Residents Records Database (RNI), a valid passport or identity card, an email address and a phone able to receive SMS from the Netherlands. DigiD says no RNI extract is needed for the application. Complete the official abroad form; a service-desk code arrives by SMS and email. This is not yet the activation code.

Use the service-desk code within 30 days. There are two collection routes:

1. Book a DigiD service-desk appointment, preferably before applying because availability can exceed the code's validity. Current desks include participating Dutch embassies and consulates-general, Netherlands representations and Caribbean Netherlands tax offices, plus participating municipalities and Schiphol in the Netherlands. Check the live Netherlands Worldwide desk list because locations and appointment rules change. Bring the service-desk code, valid passport or identity card, BSN and the phone/number used in the application.
2. Book an eligible Netherlands Worldwide video appointment to receive the activation code online. The video service cannot be used while physically in the European Netherlands; there, collect from a Dutch service desk. Check identity-document, camera and appointment requirements before the call.

After receiving the activation code, activate within the deadline stated in the flow and test My DigiD. Do not describe the 30 days as a postal estimate: it is the service-desk code validity. If it expires before collection, make a new application/code and appointment as instructed. Someone else cannot collect it for you.

People who already receive AOW, or have an SVB letter saying they will soon receive it, can check the separate Social Insurance Bank application route; qualifying applicants need not visit a desk. This exception should not be assumed for another pension or benefit.

Abroad app recovery differs from a new DigiD application. An existing active app can activate another device. Without one, the app may offer SMS or a Dutch-document NFC ID check, but foreign passports and residence documents do not satisfy that check. Keep the old device active until the new one succeeds. For authorisation letters, note that the no-DigiD/helper-request postal route is not available to addresses abroad or in the Caribbean Netherlands; ask the service about a supported digital, company or non-digital alternative. Always verify time zones, maintenance windows and the responsible organisation's deadline before relying on a last-day login.

Match recovery to what is still under your control instead of immediately creating another account.

For app errors, update the app and operating system, set date/time automatically, close stale browser tabs, try supported current Chrome, Edge, Firefox or Safari, and test another connection. Do not uninstall the only active app until another method works. Having up to five installations is allowed, so a controlled second device can be a useful fallback.

Treat suspected compromise as an incident. First stop approving prompts and use a known-clean device. If you can log in, change the password, review the usage history and deactivate unknown or stolen-device app installations. If you cannot, call the DigiD helpdesk at the number shown on the official site. Contact every organisation shown in suspicious usage because it - not DigiD - can determine whether a bank account, benefit, medical data or filing changed. Usage history shows logins, not the exact transaction.

If banking data was entered on a fake page, contact the bank immediately. Preserve the message, sender, URL, screenshots and times; report phishing to the appropriate channel and contact Fraud Helpdesk. Report actual fraud to police, and identity fraud to the Central Identity Theft and Error Reporting Centre (CMI) where applicable. Do not install remote-access software or pay a “recovery” caller.

Close recovery by testing My DigiD and the time-critical service, verifying email/phone, reviewing devices and history, and obtaining confirmation from affected organisations that unauthorized changes were reversed. Deactivating one app does not cancel the DigiD account; cancelling/reapplying is a separate action and can create needless access delay if the existing account can be secured.