The security question comes up a lot with eSIM, usually from people who are rightfully cautious about how their phone handles sensitive carrier data. The short answer: eSIM is secure. The longer answer explains why.
How eSIM security works
The eSIM chip stores carrier profiles in a secure element - a tamper-resistant hardware component designed specifically to resist extraction and modification. The credentials can't be read off the chip the way data can be read from regular storage. This is the same type of secure element used for Apple Pay and Google Pay.
Profile downloads use encrypted connections. When you scan a QR code and download a carrier profile, that download happens over HTTPS using cryptographic certificates - the profile can't be intercepted in transit in any meaningful way.
Is it safer or less safe than a physical SIM?
In some ways, eSIM is more secure. Physical SIM cards can be physically stolen and used in another device. An eSIM profile is tied to your device's hardware - it can't be removed and inserted into someone else's phone. SIM swapping attacks (where a criminal tricks your carrier into transferring your number to a new SIM) still exist, but they target the carrier's customer service process, not the SIM technology itself.
The main theoretical concern with eSIM is that carrier profiles are downloaded remotely, which creates a software attack surface that doesn't exist with physical SIMs. In practice, the GSMA's provisioning standard uses strong cryptography that makes intercepting a profile download extremely difficult.
Remote deletion and device theft
If your phone is stolen, the eSIM profile can't be transferred to another device without going through the carrier's eSIM management process, which requires authentication. The thief has your phone but they can't use your eSIM number on a different device without your carrier credentials.
You can remotely wipe your phone (via Find My on iPhone, Find My Device on Android), which also renders the eSIM profiles inaccessible.
Privacy considerations
Your eSIM provider knows which network you're connecting to and your data usage. This is the same as any carrier - physical SIM or eSIM. If privacy from your carrier is a concern, that's a separate question from eSIM security, and it applies equally to both technologies.
Buying an eSIM requires an email address but typically no more personal information than buying a physical SIM from an airport kiosk (which usually requires nothing at all). Some countries require passport registration for any SIM, physical or eSIM.
The practical security verdict
eSIM is not meaningfully less secure than a physical SIM for typical use. For most travellers, the security considerations are a non-issue. The main protections are the same ones that apply to your phone generally: use a strong passcode, enable Find My/Find My Device, and keep iOS/Android updated.