What's in Your Boarding Pass Barcode

There is a rectangle of fine vertical stripes on every boarding pass, usually near the bottom. Most travellers assume it is an encrypted token, or a meaningless reference number that only the airline's computers can resolve.

It is neither. It is plain text, written in a published international format, and any scanner app can read it in under a second. It contains your full name, your booking reference, and — on most full-service airlines — your frequent flyer number and ticket number too. None of it is encrypted.

This guide breaks down exactly what is in there, field by field, using a real worked example you can verify yourself. It also covers the part that matters practically: what someone else can actually do with those fields.

What the Barcode Actually Is

Airline boarding passes worldwide use a single shared format called the Bar Coded Boarding Pass, or BCBP, defined by IATA in Resolution 792. It is the reason a boarding pass issued by an airline in Singapore scans correctly at a gate reader in Frankfurt. Version 8 of the resolution took effect on 1 June 2020.

It is worth separating two things that often get confused:

• The symbology — the physical pattern of stripes or squares. Printed passes almost always use PDF417, a stacked two-dimensional format that holds far more than a supermarket barcode. Mobile passes commonly use Aztec, and some airlines use a QR Code or Data Matrix.
• The payload — the text encoded inside. This is BCBP, and it is the same regardless of which symbology carries it.

So the format of the picture varies, but the string inside does not. If you want the wider tour of where PDF417 and Aztec sit among the codes you meet day to day, see our guide to the different types of barcodes.

Why it is not encrypted

This surprises people, but there is a practical reason. A gate reader has to work when the airport network is down, when the pass was issued by a different airline, and when the passenger is connecting between carriers that share no systems. Encryption would require key distribution between every airline and every airport on earth. Instead the standard puts the data in the clear and, optionally, adds a digital signature so a reader can detect a forged pass — a mechanism that proves the pass is genuine without hiding what it says.

What Is Actually Inside One

BCBP is a fixed-width format. Every field sits at a known character position and has a known length, which means you can decode a pass simply by counting characters. Here is the shortest legal boarding pass — the bare mandatory minimum, exactly 60 characters:

M1DOE/JOHN EXYZ999 LHRJFKBA 0117 001Y012C0001 300

Broken into its fields, that reads:

That is the floor. Everything past character 60 is optional, and this is where the airlines differ enormously. A low-cost carrier may stop at or near the minimum. A full-service airline will typically add the date the pass was issued, how you checked in, your baggage tag number, your ticket number, your frequent flyer airline and membership number, your free baggage allowance, whether you have fast-track, and a screening indicator.

The last two characters of the mandatory block are a hexadecimal length telling the reader how much optional data follows — which is why a pass can grow past 400 characters without any reader getting confused about where the fields end.

Try it on your own pass

You do not have to count characters by hand. Paste your own barcode text into our boarding pass barcode decoder and it will break out every field, translate the coded values into plain English, and flag which ones identify you. It runs entirely in your browser — the string never leaves your device, which matters rather a lot for this particular kind of data.

What a Stranger Can Do With It

This is the part worth being precise about, because both the alarmist and the dismissive versions of this story are wrong.

The single most useful thing in the barcode is the combination of booking reference and surname. That pair is what a great many airline websites ask for on their "manage my booking" page. Both are sitting in the barcode in clear text.

What that unlocks depends entirely on the airline, and it varies:

• Commonly: viewing the full itinerary — every flight on the booking, not just the one you are holding, plus dates and times. That reveals when a home is empty.
• Often: the passenger details attached to the booking, sometimes including contact details and the last digits of a payment card.
• Sometimes: changing a seat assignment, or cancelling a flight outright.

The frequent flyer number is the second concern. Loyalty balances are a genuine target — miles are transferable and resellable — and a membership number is a starting point for a convincing phishing call. The ticket number and baggage tag are lower-value on their own but add credibility to a fraudster impersonating the airline.

There is also a field most travellers have never heard of: the selectee indicator, which records whether you were flagged for secondary security screening or are eligible for expedited screening. That is a piece of security information about you, sitting in a barcode, in clear text.

The practical upshot is not that boarding passes are dangerous objects. It is that a boarding pass is a document containing personal data, and it deserves the same handling as a bank statement: do not photograph it for social media, and do not leave it in the seat pocket or an airport bin. If you want it gone, bin it at home or shred it.

Three Things Almost Everyone Gets Wrong

The year of your flight is not in the barcode

The date-of-flight field is three characters long and holds only the day of the year, from 001 to 366. Day 326 is 22 November — but of which year, the barcode does not say. Any decoder that confidently prints a full date is making an assumption, usually that the flight is in the current year. That is normally right, and occasionally wrong across a new year boundary. Our decoder shows the assumption rather than hiding it.

The class letter is not a standard cabin code

The compartment code is a single letter, and there is a widespread belief that it maps to a fixed cabin: Y for economy, J for business, F for first. In practice these are the airline's own booking class letters. Carriers assign them themselves, use different letters for different fare buckets within the same cabin, and reuse the same letter to mean different things. Y very often is economy and J very often is business, but "very often" is not "always", and there is no IATA table that makes it universal.

The signature does not hide anything

Some passes end with a caret followed by a block of characters. That is the optional security section — a digital signature the issuing airline applies so a gate reader can detect a pass that has been altered or forged. It is a genuine security feature, and it is worth understanding what it does and does not do: it protects the airline against a fake pass. It does nothing at all to protect you, because every field before it is still plain text.

How to Read Your Own Boarding Pass Barcode

You need two things: something that can read PDF417 or Aztec, and something that can interpret the resulting string.

The first is the step that trips people up. Most phones' built-in camera apps recognise QR codes and little else — point one at the PDF417 on a boarding pass and typically nothing happens at all. That is not a fault with the pass; it is that PDF417 and Aztec are not in the camera app's repertoire. You need a scanner that handles the 2D formats beyond QR. Our guide on how to scan QR codes covers the general technique, and the same approach applies once your scanner supports the format.

Once you have the raw text, paste it into the boarding pass decoder to see the fields. If you are curious about the equivalent structured format used in retail and pharmacy, the GS1 barcode decoder does the same job for those, and what is GS1 DataMatrix explains that side of the world.

The Other Travel Scanning Risk

While we are on the subject of barcodes and airports: the risk running in the opposite direction is worth a mention. Rather than someone reading a code you own, the growing problem is you scanning a code someone else planted — a fraudulent QR sticker placed over a legitimate one on a parking meter, a hotel check-in poster or an airport information board, leading to a spoofed payment page. Security reporting through 2026 has consistently described this as a rising pattern in travel settings specifically.

The defence is simply to check where a code actually leads before acting on it. Our guide to QR code safety and fake QR codes covers how tampered codes are placed and how to spot them.

Frequently Asked Questions

Is it safe to post a photo of my boarding pass?

No. The barcode is readable from a photograph, and it contains your full name and booking reference in clear text — the same pair many airline websites accept to open a reservation. Depending on the airline that can expose your full itinerary and sometimes allow changes to it. Blurring the barcode is not reliable either, because error correction can let a partly obscured code still be read. The safe answer is not to post it at all.

What barcode format is used on a boarding pass?

Printed passes almost always use PDF417, a stacked two-dimensional format. Mobile passes commonly use Aztec, and some airlines use a QR Code or Data Matrix. The symbology varies but the text inside is the same IATA BCBP string in every case.

Why will my phone camera not scan my boarding pass?

Because most built-in camera apps only recognise QR codes. PDF417 and Aztec are different symbologies, and a camera app that does not implement them will simply do nothing when pointed at one. You need a scanner app that supports the wider set of 2D formats.

Can someone steal my frequent flyer miles from my boarding pass?

The barcode can contain your frequent flyer airline and membership number, but not your password or PIN, so it is not on its own enough to empty an account. It is a realistic starting point for a targeted phishing attempt, because someone quoting your membership number, flight and seat sounds convincingly like the airline. Treat unsolicited contact that opens with those details with suspicion.

What does the number after my seat number mean?

That is the check-in sequence number — it records that you were the nth passenger to check in for that flight. It is used operationally, for example in deciding who is offloaded first when a flight is oversold. It has no bearing on boarding order on most airlines.

Should I shred my boarding pass?

Shredding is the thorough option, and worth it if the pass carries a frequent flyer number. At minimum, take it home rather than leaving it in the seat pocket or an airport bin, and dispose of it there. The barcode remains readable long after the flight, and an old pass still reveals your name, your loyalty number and your travel pattern.

How long does the data in the barcode stay valid?

The booking reference typically stops being useful once the whole itinerary has flown and the booking closes, which can be weeks after a return trip. The frequent flyer number, your name and your ticket number do not expire at all. So a used boarding pass is not automatically harmless.

Do train and event tickets work the same way?

No. BCBP is specific to airlines. Rail operators and ticketing platforms use their own formats — including the UIC barcode standards used across European rail — and those encode different fields entirely. A boarding pass decoder will not read them.

The Short Version

Your boarding pass barcode is unencrypted plain text in a published IATA format. The mandatory 60 characters carry your name, booking reference, route, flight, seat and check-in status; the optional part that most airlines add carries your ticket number, frequent flyer number, baggage tag and screening indicator.

The realistic risk is not dramatic, but it is real: booking reference plus surname is a working credential on many airline sites, and the loyalty number is a phishing lever. Treat the pass as a document with personal data on it — do not post photos of it, and take it home to bin it.

And if you want to see precisely what yours says rather than take anyone's word for it, decode it. It takes about ten seconds, and it is the fastest way to understand why the advice exists.