Understanding eUICC 2026 and How eSIM Works for Travelers

The eUICC (embedded Universal Integrated Circuit Card) is the programmable chip that lets your phone, tablet, or smartwatch switch carriers without a physical SIM card. When you hear about eSIM, you're talking about the connectivity profile; when we talk about eUICC, we mean the hardware that stores and manages those profiles. In this guide, we explain how it works internally, how many profiles it can store, how they download remotely, and what technical limits you need to know before traveling or buying a data plan.

What Is eUICC and How It Differs from a Traditional SIM

A traditional SIM card is a removable chip with a unique ICCID that identifies your line to the carrier's network. It comes preprogrammed from the factory with credentials for a single carrier; switching carriers means physically swapping the card.

The eUICC is a chip soldered to the device's motherboard that can be reprogrammed remotely. Instead of one fixed ICCID, the eUICC stores multiple profiles (each with its own ICCID, authentication keys Ki, and encryption algorithms). Switching carriers is just activating the right profile—no need to open the SIM tray.

The technical spec is maintained by the GSMA (GSM Association), the mobile operator consortium that defines global standards. The current version is GSMA SGP.22 for consumer devices (smartphones, tablets, wearables) and SGP.02 for IoT (Internet of Things).

At eSIM Ahora, we use SGP.22 architecture to deliver data profiles to travelers in more than 180 countries. When you buy a plan, you get a QR code pointing to an SM-DP+ server (Subscription Manager Data Preparation)—the server that cryptographically signs your profile and pushes it to your device's eUICC. The process takes 30 seconds to 2 minutes, depending on your WiFi or mobile speed.

How an eSIM Profile Downloads and Activates

eSIM profile download follows this technical flow:

1. You scan the QR code (or manually enter the SM-DP+ address and activation code).
2. Your device contacts the provider's SM-DP+ over the internet (WiFi or mobile data).
3. The SM-DP+ authenticates the request using your chip's EID (eUICC Identifier)—a unique 32-digit number that identifies your eUICC globally.
4. The server creates an encrypted profile package containing: ICCID, IMSI, Ki keys, authentication algorithms (COMP128, Milenage), data APN, roaming settings.
5. The package downloads to your eUICC; the chip decrypts it using its private key (stored in secure hardware, not extractable by software).
6. The profile installs but stays inactive until you enable it in Settings.

Once enabled, the profile behaves exactly like a physical SIM: it registers on the carrier's network, negotiates AKA (Authentication and Key Agreement), establishes a PDP context for data, and starts transmitting.

For more details on the SM-DP+'s role in this process, see our post SM-DP+ Explained — What It Is and Why Your eSIM Needs It.

How Many Profiles Can One eUICC Store

eUICC storage capacity varies by chip maker and device model. Most smartphones from 2024–2026 have 128 KB to 512 KB of non-volatile memory. A typical eSIM profile uses 10 KB to 25 KB, depending on security certificates, preconfigured APNs, and roaming parameters.

Practical limits by manufacturer:

• Apple (iPhone XS onward, iPad Pro 2018+, Apple Watch Series 3+): stores 8 to 10 profiles depending on model. iPhone 15 and 16 can hold up to 10 profiles; only 2 can be active simultaneously (one for voice/SMS, one for data, or both for data with dual eSIM active on 2023+ models).
• Samsung (Galaxy S20 onward, Dual SIM + eSIM models): 5 to 7 profiles stored, 1 or 2 active depending on model.
• Google Pixel (Pixel 3 onward): 5 to 8 profiles stored, 2 active simultaneously from Pixel 7 onward.
• Xiaomi, Oppo, Realme (international eSIM models): 4 to 6 profiles stored, 1 active.

These are storage limits, not download limits. You can install, delete, and reinstall profiles as many times as you want—the eUICC doesn't wear out. Each downloaded profile consumes an activation token issued by the provider's SM-DP+; at eSIM Ahora, we allow unlimited reinstalls of the same profile while it's within its validity window (usually 30 days from purchase, then 7–30 days of usage depending on the plan).

To verify if your device supports eSIM and how many profiles it handles, check our complete list at Phones Compatible with eSIM 2026.

Technical Architecture: LPA, SM-DP+, SM-DS

Remote eSIM profile management relies on three components:

LPA (Local Profile Assistant)

The LPA is the client software on your device that manages profile download, installation, activation, deactivation, and deletion. On iOS it lives in the Settings app; on Android it's in Settings > Network & Internet > SIM. The LPA talks to the eUICC via APDU (Application Protocol Data Unit) commands over the ISO/IEC 7816 interface.

The LPA also discovers which SM-DP+ server to contact. If the QR code contains only a short activation code (no URL), the LPA queries an SM-DS (Subscription Manager Discovery Server)—a global directory maintained by the GSMA—to resolve the code to the correct SM-DP+ address.

SM-DP+ (Subscription Manager Data Preparation)

The SM-DP+ is the eSIM provider's server that:

• Generates and cryptographically signs profiles.
• Encrypts profile packages using the eUICC's public keys.
• Authenticates download requests by verifying the EID and activation token.
• Manages profile lifecycle (issuance, suspension, reactivation, remote deletion).

Each eSIM provider (including us) runs its own SM-DP+ or contracts one from an aggregation hub like Tata Communications, Idemia, or Giesecke+Devrient. We use our own infrastructure for profiles in Mexico, Spain, and Argentina; for other countries we use hubs with certified roaming agreements.

SM-DS (Subscription Manager Discovery Server)

The SM-DS is an optional directory service. When you scan a QR code with only LPA:1$activation-code (no URL), the LPA queries the SM-DS to get the SM-DP+ address tied to that code. Full QR codes include the URL directly: LPA:1$sm-dp.example.com$activation-code.

In practice, most providers (including us) generate QR codes with the full URL to avoid the extra latency of an SM-DS lookup.

eUICC Security and Privacy Limits

The eUICC stores sensitive cryptographic material—Ki authentication keys, carrier root certificates, OTA (Over-The-Air) encryption keys. To protect this data, the chip implements:

• Secure Element (SE): isolated memory zone separate from the main processor, accessible only via authenticated APDU commands. The phone's OS cannot directly read Ki keys.
• Mutual authentication: every time the LPA requests an eUICC operation, both sides verify X.509 certificates signed by the GSMA. This prevents malicious apps from installing fake profiles.
• Profile encryption: profile packages use ECIES (Elliptic Curve Integrated Encryption Scheme) with P-256 or P-384 curves. Only the intended eUICC can decrypt them.

One critical limitation: the eUICC cannot extract profiles once installed. If you factory reset your phone without deleting profiles first, those profiles are permanently lost. Providers like us can reissue the profile (generate a new ICCID tied to the same plan), but the original profile becomes unusable. That's why we recommend deleting profiles manually before selling or resetting your device.

Differences Between Consumer eUICC (SGP.22) and IoT eUICC (SGP.02)

Two eUICC specs exist:

SGP.22 (Consumer): designed for smartphones, tablets, wearables. Requires user authorization for each profile download (QR scan, on-screen confirmation). The LPA has a graphical interface. Profiles download on demand.

SGP.02 (M2M/IoT): designed for headless devices (industrial modems, sensors, connected vehicles). Profiles provision remotely with no user interaction. The operator can switch profiles remotely via OTA commands. No graphical LPA; everything happens via encrypted SMS or direct data connections to the SM-DP+.

Smartphones use exclusively SGP.22. If you see a device mentioning "integrated eSIM" without QR-scan ability, it's probably SGP.02 with a factory-preinstalled profile (common in budget wearables that only work with one operator).

Multi-Profile Active Support (DSDS, DSDA)

Modern eUICC smartphones typically use one of these architectures:

DSDS (Dual SIM Dual Standby): two active profiles simultaneously, but only one can transmit data or voice at once. If you're on a call on profile A, profile B is on hold. Examples: iPhone 13/14/15 with physical SIM + eSIM, Samsung Galaxy S21 with two eSIMs.

DSDA (Dual SIM Dual Active): two active profiles with independent modems; both can transmit simultaneously. Rare in consumer smartphones; more common in industrial devices. iPhone 16 in some regions supports limited DSDA (call on one profile, data on the other).

eSIM-only (no physical SIM tray): iPhone 14/15/16 sold in the US has no SIM tray; everything is eSIM. You can have up to 2 active eSIM profiles simultaneously in DSDS mode.

At eSIM Ahora, we offer data-only profiles (no voice/SMS), optimized to use as a second profile while keeping your main SIM active for calls. This avoids conflicts in DSDS setups where a voice profile would compete with another for antenna access.

Reinstall Limits and Device Portability

An eSIM profile is bound to the EID of the eUICC that downloaded it. You can't "move" a profile between phones like you would a physical SIM. If you switch devices, you must:

1. Delete the profile from the old device.
2. Request the provider to reissue the profile (new QR with new ICCID).
3. Download the profile on the new device.

Some providers charge for reissue; at eSIM Ahora, we allow one free transfer per plan—contact support via Telegram or email with your new device's EID, and we reissue the QR in under 4 hours.

Reinstall limit on the same device: technically unlimited while the profile is within its validity window. Each reinstall uses an SM-DP+ token (invisible to you); tokens regenerate automatically. We've seen users reinstall the same profile 15 times in a month (trips across multiple countries, toggling profiles on and off) without issues.

Cross-brand portability: a profile downloaded on an iPhone can reinstall on another iPhone endlessly. But you can't install it on a Samsung—the EID is different. Profiles are provider-portable, not chip-portable.

eSIM Provider Comparison: eUICC Focus

Most travel eSIM providers (Airalo, Holafly, Saily) use the same SGP.22 eUICC architecture. Differences lie in:

• Reinstall policy: Holafly caps reinstalls at 3 per plan; we allow unlimited.
• Multi-device support: Airalo charges $3 to transfer a plan to another device; we don't charge for the first transfer.
• ICCID visibility: some providers hide the ICCID in their dashboard; we show it openly because it's needed for issuing complete invoices with tax breakdown.
• Activation token lifetime: our tokens last 30 days from issuance; others expire in 7–14 days.

In all cases, your device's eUICC and GSMA standards are identical. The difference is in each provider's business policy, not underlying tech.

Future of eUICC: iSIM and Decentralized Profiles

The next evolution is iSIM (integrated SIM): instead of a separate eUICC chip, the function integrates directly into the device's main SoC (System-on-Chip). Qualcomm already offers iSIM on some Snapdragon 8 Gen 2/3; Apple is evaluating it for future iPhones.

iSIM advantages:

• Cuts BOM (Bill of Materials) cost by eliminating a chip.
• Frees physical space on the motherboard (useful for larger batteries).
• Lower power draw (profile management happens on the same SoC as the modem).

iSIM disadvantages:

• Weaker security isolation (the Secure Element is no longer a physically separate chip).
• Higher GSMA certification complexity (the entire SoC must certify, not just a module).

Another trend: decentralized profiles using blockchain for identity management. Projects like WISeSIM (GSMA + European operators) explore letting users "own" eSIM profiles as NFTs, transferable between devices without operator intervention. Still experimental; current GSMA specs require each profile signed by an authorized SM-DP+.

FAQ

What's the difference between eUICC and eSIM?

eUICC is the hardware chip soldered to the device; eSIM is the software profile (ICCID, keys, APN) that downloads to the eUICC. One eUICC can hold multiple eSIMs, but only 1–2 can be active simultaneously depending on your phone model.

Can I use the same eSIM profile on two phones at once?

No. Each profile ties to the EID (unique identifier) of one device's eUICC. To use the same plan on two phones, you need two separate profiles from the provider, each with its own ICCID.

What happens if I factory reset my phone without deleting eSIM profiles first?

Profiles are permanently lost—the eUICC resets to factory state and erases all installed profiles. Some providers (including us) can reissue the plan free; others charge for reactivation. Always delete profiles manually before resetting.

Can eSIM profiles be hacked or cloned?

Not practically. Ki keys are stored in a Secure Element inaccessible by software, and profiles encrypt with ECIES using 256-bit elliptic curves. Cloning would require physically extracting the chip and breaking hardware encryption—not feasible with off-the-shelf equipment.

How many profiles can I install on an iPhone?

Up to 10 profiles on models from iPhone XS onward. Only 2 can be active simultaneously (one for voice/SMS, one for data, or both for data in dual-eSIM mode). Storage limit doesn't affect daily use; you can install profiles for multiple countries and activate whichever you need.