An introduction to Qualified Website Authentication Certificates (QWACs)
Who is behind a website? A plain-English introduction to QWACs, what they prove, and how people and AI agents can use verified website identity.
Imagine finding a new online store with the shoes you want at an unusually good price. The website looks professional. The checkout works. Your browser reports an encrypted connection. But before handing over your credit card, you might want to know something rather basic: who is selling you the shoes?
The web is surprisingly bad at answering that question. A business can put a name in its footer and a reassuring badge next to its checkout. The badge may have undergone the rigorous approval process of someone choosing it from an icon library.
Qualified Website Authentication Certificates, or QWACs, give websites a way to present independently verified identity. The name suggests a committee was involved. The idea is familiar: a business should be able to prove who it is.
What an encrypted connection tells you
Most websites use HTTPS, the technology that protects information as it travels between your device and a website. The certificates behind it are often called SSL certificates, although the modern technology is called TLS.
A basic certificate confirms control of a website’s domain name, leaving the business behind it largely unexamined. A scammer can register a domain and obtain an encrypted connection, too. You can send your credit card details privately to precisely the wrong person.
Some certificates already include verified business information. QWACs put website identity within a particular legal framework: the European Union’s digital identity rules, known as eIDAS.
A business ID for a website
Think of a QWAC as a digital business ID. It connects a website with checked identity information, such as a company’s legal name and location. A digital signature lets software check who issued that information and whether it has been altered.
To issue a qualified certificate, a provider must meet the EU’s requirements for qualified trust services. This involves supervision and audits; a certificate seller cannot simply award itself the label. The European Commission explains the qualification process.
For our shoe shopper, this could make the legal business behind the storefront available to inspect. You would still want to check reviews and read the refund policy. A fully identified company remains perfectly capable of selling shoes that fall apart in the rain.
When an AI agent does the shopping
Now imagine asking an AI assistant to find and buy the shoes. The assistant can compare prices and read product descriptions, but a convincing page is no better proof of identity for a machine than it is for a person.
A QWAC gives an agent’s browsing software something independent to check. If the software verifies the certificate and passes the result along, the agent can compare the identified business with the merchant you intended to use.
This is where I see a particularly useful role for website identity. As we delegate more of our browsing to software, we need ways for that software to examine who is making a claim. Teaching a model to admire a professional-looking storefront will only get us so far.
What getting one involves
A business applies through a qualified provider, supplies the required identity evidence, and proves control of its domain. Its website team then installs the certificate and arranges ongoing renewal.
There are two deployment approaches. One uses the QWAC as the website’s connection certificate. The other adds a separate identity certificate, securely linked to the existing connection certificate. That second approach can preserve the site’s current HTTPS setup. The ETSI standard describes both; our hosting guides explain the practical options.
Before buying, ask who will handle installation and renewal, and how the browsers or services your customers use will verify and display the identity. Issuing a certificate and making its information useful to a visitor are separate jobs.
The web has made it easy to publish a claim and increasingly cheap to make that claim look convincing. QWACs offer a practical way to attach an accountable identity to it. For people and software deciding whom to deal with, that is a worthwhile improvement.