It's standard 2 factor authentication stuff in the world of IT. The short version is that a combination of date, your user ID and a token from the NHS severs is encrypted. Anyone can send that encrypted data to the NHS servers which can decrypt it and let the local official know if it is valid or not.How do foreign countries validate this 'code'?
the person sending the details off doesn't get to see anything excessive, the person being validated can't forge it easily and everyone is slightly dissatisfied.
