What's in the Barcode on Your Driver's License
There is a dense rectangle of stripes on the back of your licence. It is not encrypted, it is not a database key, and it holds your name, date of birth and home address in text that any scanner can read in under a second.
Turn your driver's licence over. That dense block of fine stripes is a PDF417 barcode, and most people assume it is a reference number — something a police officer's terminal looks up against a state database.
It is not. It is plain text, written in a published standard, and it contains your full legal name, your date of birth, your home address and your document number. There is no key, no signature and no encryption. Any device that can read a PDF417 symbol reads every field, and the document that says what those fields mean is available to anyone who wants it.
That design is intentional, and for its original purpose it is a good one. It is also why an age check at a bar door can hand over twenty-something facts about you when the question on the table was a single yes or no.
The Short Answer
- It is not encrypted. The barcode is text in the AAMVA DL/ID Card Design Standard format, readable by any compliant scanner.
- It holds everything printed on the card, and usually more — name, date of birth, sex, height, eye colour, full address, document number, issue and expiry dates, licence class, restrictions, and often organ-donor and veteran flags.
- A scan is all-or-nothing. There is no way for a reader to request only your age. It receives the whole record.
- A clean decode proves nothing about authenticity. Unsigned text can be written by anyone; the card's physical security features are what establish that it is genuine.
- Whether a business may keep the data depends on your state, and in several states on why the scan was taken. There is no single federal rule.
Why This Is Worth Knowing Right Now
On 1 September 2026, the security journalist Brian Krebs reported that a dark-web marketplace was advertising access to more than 153 million driver's licence scans from the United States and Canada. Within days the identity-verification company IDScan.net confirmed that an unauthorised party may have accessed customer data held in its cloud platform, the FBI's New Orleans field office opened an investigation, and the first lawsuits were filed. Reporting on the advertised dataset described roughly 153 million driver's licences alongside about 10 million ID cards, 3 million international travel cards and several hundred thousand medical cards.
The detail worth sitting with is not the number. It is what a licence scan is. The business model of an ID-verification provider is to read the barcode on the back of a card at a bar, a dispensary, a car-rental desk or a clinic, and to do something with what comes back. What comes back is not "proof of age". It is the record described below.
So the useful question is not whether to trust any particular vendor. It is: when someone scans your licence, what have you actually given them? That is answerable precisely, because the format is published.
Every Field the Barcode Carries
The standard is maintained by the American Association of Motor Vehicle Administrators. Each field is introduced by a three-letter element identifier, and the value follows it directly. These are the ones you will find on a current card. The right-hand column is the part that matters: not what the field is called, but what it tells a stranger.
| Element | Field | What it gives away |
|---|---|---|
| DCS | Family name | Your legal surname, as recorded by the state |
| DAC | First name | Your legal first name |
| DAD | Middle name or names | Frequently used as a security question answer |
| DBB | Date of birth | Exact day, not just whether you are over a threshold |
| DAG, DAI, DAJ, DAK | Street, city, jurisdiction, postal code | Where you live, to the house number |
| DAQ | Licence or ID number | A durable identifier reused across insurance, employment and government records |
| DBD, DBA | Issue and expiry dates | How long you have held the card and when it lapses |
| DBC | Sex | As recorded on the card |
| DAU, DAY, DAZ, DAW | Height, eye colour, hair colour, weight | A physical description |
| DCF | Document discriminator | Uniquely identifies this physical card, distinct from the licence number |
| DCA, DCB, DCD | Vehicle class, restrictions, endorsements | Corrective-lens requirements and commercial entitlements |
| DDA | Compliance type | Whether the card is federally acceptable under REAL ID |
| DDE, DDF, DDG | Truncation flags | Whether each name was shortened to fit |
| DDK, DDL | Organ donor, veteran | Health and service status — arguably the most sensitive fields on the card |
| DCI | Place of birth | Present on some cards; another common security question answer |
| ZA to ZZ | Jurisdiction-defined subfiles | Whatever the issuing authority chose to add. Not documented in the standard. |
Around twenty of these are mandatory under the current revision of the standard, so the list is not a worst case — it is roughly a typical card. You can see your own by pasting the barcode text into our decoder, which names every field it finds and flags the personal ones.
What a Single Scan Actually Transfers
Here is the gap, stated plainly. An age check needs one bit of information: is this person over the threshold, true or false. A barcode scan delivers the entire record, because there is no mechanism in the format for asking a narrower question. The barcode is a printed rectangle; it cannot negotiate.
| The question being asked | What the format can answer | What the reader receives |
|---|---|---|
| Is this person over 21? | Nothing narrower than the whole record | Name, exact date of birth, address, document number, physical description |
| Is this card expired? | Nothing narrower than the whole record | The same |
| Is the name on this card the name on the booking? | Nothing narrower than the whole record | The same |
This is the same structural problem as the barcode on a boarding pass, which is also plain text and also hands over more than the gate reader needs — we covered that one in what's in your boarding pass barcode. The difference is that a boarding pass expires after one flight. Your address and date of birth do not.
And unlike a leaked password, none of this is rotatable. You cannot reissue your date of birth. Moving house to invalidate an exposed address is not a security measure anybody actually takes. That permanence is what makes the record worth as much as it is, and it is why address-and-name pairings circulate in criminal markets for years — the same dynamic behind the unsolicited parcels arriving with QR codes in them.
Who Scans It, and What They Are Allowed to Keep
There is no single national rule in the United States. Instead, a patchwork of state statutes governs whether a business may scan an ID at all, what it may extract, and how long it may hold the result. The differences are large enough to matter.
| State | The general shape of the rule |
|---|---|
| New Hampshire | The strictest regime in the country. Scanning, recording, retaining or storing personal information from a licence in electronic form is prohibited without authorisation from the state, with a narrow allowance for verifying age for alcohol sales provided the scanner does not store anything. |
| New Jersey | Scanning is permitted only for an enumerated list of purposes — verifying the authenticity of the card or the identity of someone paying by means other than cash, handling a return or exchange, or verifying age for age-restricted goods. Where the scan was for identity or age verification, the retailer may not retain the data. Data retained for other permitted purposes must be stored securely, with breaches reported to the state police. |
| Texas | Accessing or using digital information derived from a licence, or compiling a database of it, is restricted, and businesses are generally limited to information that appears on the face of the card. Separate legislation carves out specific circumstances in which retention is permitted. |
| Illinois | No dedicated barcode-scanning statute, but the Biometric Information Privacy Act applies with real force if the check also captures a facial scan to compare against the card. That turns an ID check into biometric collection, which carries its own consent requirements and a private right of action. |
| Most other states | Either no specific restriction, or rules limited to particular sectors such as alcohol retail or pharmacy. Where nothing prohibits retention, general consumer-privacy law is what applies, and in many states that is very little. |
Two honest caveats about that table. First, these are summaries of how the rules are generally described, not legal advice, and the statute governs — the details, exemptions and amendments are what decide any actual case. Second, much of the accessible material describing state ID scanning law is published by companies that sell ID-scanning equipment, which is a reason to read it carefully rather than a reason to dismiss it.
The practical upshot for an individual is narrow but real: in most places, asking whether the scan is stored is a reasonable question, and in a few places the answer is legally constrained.
Three Things Almost Everyone Gets Wrong
"The barcode is encrypted, so it is safe to photograph"
It is not encrypted, and a photograph of the back of a card is as good as the card for this purpose. A clear photo of a PDF417 symbol decodes exactly like the original. Posting a picture of a new licence — a surprisingly common thing to do — publishes the whole record.
"The barcode is just a pointer to a DMV record"
It is the record, copied onto the card. That is the whole reason the format exists: a reader in another state, or in a vehicle with no connectivity, has to be able to read a card without a lookup. Self-contained data is the feature. Self-contained data is also the exposure.
"If the barcode scans cleanly, the card is real"
This is the most consequential error, and businesses make it as often as individuals. Nothing in the barcode is signed. Well-formed text proves only that someone wrote well-formed text — and the tooling to write it is not hard to find. Authenticity comes from the physical security features of the card, from a check against the issuing authority, or from a cryptographically signed digital credential. A barcode decode is not a verification.
How to Read Your Own
Reading your own card is the fastest way to stop this being abstract, and it takes about a minute. There is one obstacle: most built-in phone camera apps recognise QR codes and nothing else, so pointing the default camera at a PDF417 symbol usually does nothing at all. You need a scanner that handles the format.
- Scan the barcode on the back of the card with an app that reads PDF417, and copy the raw text it returns.
- Paste that text into the driver's license barcode decoder. It runs entirely in your browser — nothing is uploaded.
- Read the field list. The decoder names each element, translates the coded values, counts how many fields the scan transferred, and marks which of them are personal rather than administrative.
No scanner app to hand? Photograph the back of the card flat and in good light, with the barcode filling most of the frame, and drop the photo below. It is read in your browser and never uploaded. The decoder page accepts the photo directly as well.
Scan a QR code or barcode from an image
Choose a screenshot or photo, drag one here, or paste it with Ctrl+V / ⌘V. It is read on your device and never uploaded.
If a field looks wrong, that is worth noting rather than ignoring. The printed face of a card and its barcode are produced by separate processes and occasionally disagree — a truncated surname, a stale address after a move. Readers act on the barcode.
One warning about what you will see if you try other tools: a decoder that assumes the wrong date order will report the wrong birthday. Dates are eight digits, and the order is MMDDCCYY in the United States but CCYYMMDD in Canada, so the same digits are two different dates. There is a clean way to resolve it without guessing, which is that a four-digit year cannot also be a month — but not every implementation bothers.
What Actually Fixes This
Not refusing the scan. The fix is already being deployed, and it is the mobile driver's licence: a cryptographically signed credential held in a phone wallet, built on the ISO/IEC 18013-5 standard published in 2021. As of mid-January 2026, 21 US states plus Puerto Rico had mDL programmes accepted by the Transportation Security Administration.
The property that matters is selective disclosure. An mDL can answer "is this person over 21" with a signed assertion and nothing else — no name, no address, no document number, no date of birth. Work on zero-knowledge proofs over the same credential format pushes this further still, letting a verifier confirm a threshold without receiving any underlying attribute at all. That is a genuine improvement rather than a repackaging: it changes what is technically possible to ask for, which is the actual constraint.
There is a gap worth naming, and civil-liberties groups have been pointing at it: the state laws that restrict barcode scanning were written for barcodes, and do not necessarily extend to digital credentials. A phone-based check can be built to disclose one bit — and can equally be built to hoover up everything and log the interaction, with fewer statutory limits than the plastic card it replaces. The technology permits restraint. It does not impose it.
Meanwhile the plastic card in your wallet will be valid for years, and the barcode on the back of it will keep handing over the full record to anything that reads it.
Frequently Asked Questions
Is the barcode on my driver's license encrypted?
No. It is plain text in a published format — the AAMVA DL/ID Card Design Standard — and any compliant reader can decode every field without a key. This is deliberate: the barcode exists so a card from one state can be read anywhere, including by a device with no network connection. The consequence is that the data is as readable to a stranger with a scanner as it is to a police officer.
What exactly does a bar receive when it scans my ID?
The whole record, not just your age. Typically that means your full legal name, exact date of birth, sex, height, eye colour, full home address, document number, issue and expiry dates, and licence class — around twenty fields. There is no way for the reader to ask a narrower question, because the barcode is a static printed symbol. Whether the bar may keep any of it depends on your state.
Can a business legally store the data from my licence?
It depends entirely on where you are. New Hampshire prohibits electronic retention of licence data without state authorisation, with a narrow carve-out for non-storing age verification. New Jersey allows scanning only for an enumerated list of purposes and forbids retention when the scan was for identity or age verification. Texas restricts compiling databases derived from licences. Many states have no specific rule at all. The statute governs, and this is a summary rather than legal advice.
Can someone steal my identity from a photo of the back of my licence?
A clear photograph of the barcode decodes exactly like the card itself, so a photo hands over the same full record. That combination — legal name, date of birth, address and document number in one place — is the raw material for account takeover and synthetic identity fraud. It is a genuinely poor thing to post publicly, and a significantly worse one than posting the front of the card.
Does a barcode that scans correctly mean the ID is genuine?
No, and this is the most commonly and most expensively misunderstood point. Nothing in the barcode is signed or verifiable. A well-formed barcode proves only that someone encoded well-formed text. Real authentication relies on the card's physical security features, a check against the issuing authority, or a cryptographically signed mobile credential. Treating a successful decode as verification is a mistake, not a shortcut.
Why does my phone camera not read the barcode on my licence?
Because most built-in camera apps only recognise QR codes, and the barcode on an identity document is PDF417 — a stacked format that looks like a dense block of stripes rather than a square of dots. You need an app that supports PDF417 specifically. Our guide to barcode types covers which formats look like what, and why identity documents standardised on this one.
What are the DAQ, DCS and DBB codes I keep seeing?
They are AAMVA element identifiers — three-letter labels that introduce each field. DAQ is the licence or ID number, DCS the family name, DBB the date of birth. They are not consistent across every version of the standard: the first name was DCT in the 2003 and 2005 revisions and is DAC now, and the family name was DAB in the original 2000 version. Cards issued under older revisions are still in wallets, which is why a decoder has to read the version number before it labels anything.
Does a mobile driver's license fix the privacy problem?
It makes the fix possible, which is not the same as guaranteed. An mDL built on ISO/IEC 18013-5 supports selective disclosure, so it can answer "over 21" with a signed assertion and disclose nothing else. But a verifier can also be built to request everything and log each interaction, and the state laws restricting barcode scanning were written for barcodes and may not cover digital credentials. The capability is a real improvement; whether it is used well is a policy question.
Should I refuse to let anyone scan my licence?
That is rarely practical and usually not the most useful response. Asking whether the scan is stored is reasonable, and in a few states the answer is legally constrained. The more actionable thing is to know what the record contains, so that when a verification provider is breached you can tell what was actually exposed rather than guessing from a press release. Decoding your own card once is enough to know that permanently.
The Short Version
The barcode on the back of your licence is unencrypted plain text holding around twenty fields, including your legal name, exact date of birth, home address and document number. A scan is all-or-nothing: there is no way to ask it only for your age. It proves nothing about whether the card is real. Whether a business may keep what it reads depends on your state, and in most states very little stops it. The mobile driver's licence can answer a single question without disclosing the rest, and 21 states plus Puerto Rico had a programme accepted by the TSA as of January 2026 — but the plastic card in your wallet will keep handing over everything for as long as it is valid.
Read your own once. It takes a minute, and it is the difference between knowing what was exposed and guessing.