Here’s How You Can Show Proof of Vaccination in New York City

Mayor Bill de Blasio’s announcement on Tuesday that people participating in indoor activities at restaurants, gyms, movie theaters and performances in New York City must soon show proof of vaccination for the coronavirus brought a slew of questions from New Yorkers: How can I show vaccination status? Which vaccine app is best? What if I lost my card? What if I got vaccinated in another country?

There are a few main ways to prove you are vaccinated, Mr. de Blasio said: a new app released by the city, called NYC Covid Safe; the state’s Excelsior Pass; or by simply showing your paper vaccination card or a copy of your official vaccination record.

The city is likely to announce additional methods in the coming weeks.

“The bottom line will be someone will have to have proof,” Mr. de Blasio said. “As long as that proof is accurate and real, wherever it comes from, that’s what they’ll need to show.”

Here’s what we know:

Where do I need to show proof of vaccination?

Beginning Aug. 16, indoor dining, indoor fitness and indoor entertainment venues, such as movie theaters, concert halls and night clubs, must check for vaccination status, the city announced. The requirement will apply to both customers and workers. Enforcement will not begin until Sept. 13, so businesses will have a grace period to figure out how to follow the new mandate.

What about children and others who can’t get vaccinated?

Children under 12 are still not yet eligible to receive any of the vaccines. On Wednesday morning, Mr. de Blasio said that they would be allowed to enter restaurants with vaccinated adults if they are masked.

Some adults have received or are eligible for medical or religious exemptions that would allow them to not get vaccinated. The city has not yet announced whether people in this category will be allowed to participate in indoor activities at places that will require proof of vaccination.

What’s the difference between the Excelsior Pass and NYC Covid Safe?

The city’s new app, NYC Covid Safe, is very simple. It is basically a camera app that enables users to take a picture of their vaccine card and store it in the app. It does not verify whether the picture represents a real card.

The Excelsior Pass is New York State’s vaccine passport app. It debuted in March as the first government-issued vaccine passport app in the country. It verifies applications against the city and state vaccination records.

More than 2.5 million New Yorkers have downloaded or printed out an Excelsior Pass since its debut, according to the state department of health.

How do I get my pass?

Both can be downloaded from both the Apple and Android app stores.

This is how Excelsior works: The app finds the official record of people who were vaccinated in New York State, and issues a pass containing a unique QR code certifying that they were vaccinated. The code is generated 15 days after the person is fully vaccinated. It can be stored on a person’s phone or printed out.

But Excelsior Pass can be finicky. In order to find a person’s vaccination record, it checks his or her name, date of birth, ZIP code and county of vaccination against the vaccine registry. If nearly all information does not match what the vaccination agency entered, even because of a typo, it will not generate the pass. Some 4 percent of users who tried to get passes in the app’s opening months were unable to, the state said.

If Excelsior can’t find your vaccination record, then you may want to use the city app if you don’t want to carry around your card.

The NYC Covid Safe app can easily be used after being downloaded. It allows people to show a photo of their vaccination card after the first dose of a two-dose vaccine, or other proof of vaccination they may have. (One dose of a two-dose vaccine is sufficient to meet the new mandate, though that only offers a fraction of the protection gained by getting both doses.)

Are the apps secure?

To demonstrate the problems with the NYC Covid Safe app, Huge Ma, a New Yorker who developed TurboVax, a widely used website that streamlined the city’s vaccine appointment system, showed on Twitter that he had uploaded a picture of a green-eyed cat to the app, instead of his vaccine card.

Albert Fox Cahn, who runs the Surveillance Technology Oversight Project, a privacy nonprofit group, uploaded a picture of Mickey Mouse to the app, instead of his card.

Both images were accepted by the app as vaccine cards, earning a green check mark.

“The New York City app is a camera app dressed up like a health tracking tool,” Mr. Fox Cahn said. “It is not fundamentally a meaningful safeguard.”

The app can help people organize photos of their vaccine card, identification and test results in one place. It also does not pose major privacy issues, as it doesn’t communicate with government registries.

But, said Mr. Fox Cahn, the problem is that it gives an aura of security to what is basically a self-certified screen shot of a vaccine card, which can be quite easily faked.

“When you see a paper card, you see it for what it is, because we know how easy it is to fabricate,” he said. “But because it has that green check mark, people may think this is somehow more secure, and it’s not.”

One issue with the Excelsior Pass is that a user can easily download someone else’s, if they know basic information about the person’s identity and place and date of vaccination. Venues should also check an I.D. in order to verify that the person’s identity matches the vaccination card in the app, but in practice that does not always happen.

And some people have raised other privacy concerns, despite pledges by both the state and I.B.M., which developed the Excelsior Pass that it uses blockchain technology to protect its data and does not track a user’s location.

What are the other ways to prove vaccination?

City officials stress that the paper card issued by the Centers for Disease Control and Prevention and used across the country works as proof. City residents who lost their card can look it up online or write to the city’s vaccination registry to ask for a paper record of their vaccination.

Several private companies are getting into the business of vaccine passports, including CLEAR, which gained fame by developing a card that allowed people to speed through security control in airports. It is unclear which of these private efforts will be accepted by city venues.

The Biden administration has said repeatedly that the federal government will not be creating a national vaccine passport because of privacy concerns. But as more places begin asking for proof, there may be a broader call for national standards.

What if I was vaccinated outside of N.Y. or the United States?

People vaccinated in the United States can still use the city’s app, the paper card, and most likely, a photo on their smartphone of their paper card.

New Yorkers vaccinated out of state can also get an Excelsior Pass, if they ask their health care provider to upload that information to the New York vaccine registries, the state said.

Whether vaccines not used in this country, like AstraZeneca, will be accepted is among the many issues that remain to be worked out in the weeks before enforcement begins on Sept. 13, said Dr. Celine Gounder, an epidemiologist at N.Y.U. Grossman School of Medicine.

“They are phasing it in, understanding that there are going to be some hiccups,” said Dr. Gounder, who appeared at the mayor’s news conference announcing the new mandates.

“Each state has their own vaccination registry, and they are highly variable in terms of their quality,” she said. “What do you do about that? What do you do about people who got Novavax in clinical trials? Those are some of the gaps that will be troubleshooted.”