What's in Your Train Ticket Barcode

Open a rail e-ticket and there is a dense square of black and white in the middle of the page. It looks like a QR code and it is not one. Point most phone cameras at it and nothing happens, which is the first clue that something different is going on.

It is an Aztec code, and inside it is a compressed, digitally signed ticket record. Unlike an airline boarding pass — whose barcode is plain, unencrypted text in a published IATA format — a rail ticket barcode is a binary envelope wrapped in a signature, built to be checked by a handheld reader on a moving train with no network.

This guide covers what that envelope contains, how the two families of European rail barcode differ, what it means when the record includes your passport number, and why your camera app struggles with it.

First: It Is an Aztec Code, Not a QR Code

Aztec is a separate 2D symbology, standardised as ISO/IEC 24778. Visually the giveaway is the centre: a QR code has three large square finder patterns in its corners, while an Aztec code has a single bullseye of concentric squares in the middle and no corner markers at all. Once you have seen it you cannot unsee it.

Rail and transit ticketing chose Aztec for practical reasons rather than fashion:

• No quiet zone required. A QR code needs a clear margin around it; Aztec does not, which matters when a ticket is printed on a crowded A4 page or shown on a phone with a cramped layout.
• Efficient at small sizes. The central bullseye doubles as the alignment structure, so proportionally less of the symbol is spent on finding it.
• Tunable error correction, useful for a document that will be crumpled in a pocket or displayed on a cracked screen.

Airlines reached the same conclusion for mobile passes, which is why Aztec turns up on both. For where Aztec sits among the codes you meet day to day, see our overview of the different types of barcodes, and if you have a code in front of you and are not sure what it is, the barcode format identifier will narrow it down from a description of what you can see.

Two Families, One Continent

There is no single European rail ticket barcode. There are two broad families, and which one you are holding depends on who sold you the ticket.

Both are signed. Both are designed to be validated offline. Neither is documented publicly in full — more on that below, because it matters for how much of the following you should take on trust.

Inside a UIC 918.3 Ticket

The UIC envelope is a fixed header followed by a signature and a compressed body. Open-source decoders that parse it in production read the fields in this order:

The compression is why the symbol is dense but not enormous, and why you cannot read anything out of a hex dump by eye. Inflate the payload and you get a run of containers, each labelled with a short tag:

• U_HEAD — the ticket header. Carrier code, order number, creation timestamp, flags, and up to two language codes.
• U_TLAY — the printed layout. The human-readable text the operator wants shown on the ticket, so that a reader can display what the passenger is looking at.
• 0080BL — Deutsche Bahn's proof-of-payment container, built from numbered sub-blocks (below).
• 0080VU — DB's multi-carrier container, the part other transit operators accept.
• U_FLEX — the newer ASN.1-based format, sometimes called FCB, which is where the standard is heading.

The sub-blocks are where the personal data lives

Inside 0080BL, data is carried in numbered "S-blocks". The set a given ticket uses depends on the fare and the operator, but the catalogue implemented by production decoders includes:

The three highlighted rows are the reason this article exists. A ticket bought against an identity document can carry, in the barcode, the traveller's full name alongside a code for which kind of document was used and its number. The document-type codes implemented by decoders cover credit card, rail discount cards, national identity card (Personalausweis) and passport (Reisepass).

None of that is encrypted. The signature proves the record was not altered; it does nothing to hide what the record says. Anyone who can photograph the symbol and run a decoder can read those fields — the same structural point as a driving licence barcode, which is also signed on some issues and readable regardless.

Inside a UK National Rail eTicket

Great Britain does it differently, and more compactly. An RSP barcode identifies its format with a two-character prefix — 06 for the current ticket format, with other prefixes for related products such as railcards — and the payload is encoded in base 26 rather than raw bytes.

The clever part is the cryptography. Rather than appending a signature to a plaintext record, the format uses RSA message recovery: the ticket record is inside the signature. A reader verifies with the published RSP public key and, in the same operation, recovers the record. Get a valid record out and you have simultaneously proved it was issued by an authorised retailer. What comes out is a tightly bit-packed structure rather than delimited text, which is how the whole ticket fits in a small symbol.

At the barrier, the barcode is one half of the check. Barrier and handheld readers also consult validation back-ends to establish whether that specific ticket has already been used, refunded or cancelled, and to record the scan. That is why a screenshot of somebody else's valid ticket does not reliably get two people through a gate: the signature says the ticket is genuine, and a separate system says whether it has already been spent.

How much of this is officially documented?

Not much, and it is worth being straight about it. Neither the UIC 918.3 specification nor the RSP barcode specification is published free to the public. The field tables above come from open-source decoder projects that have been used against real tickets for years, and those projects say plainly that their understanding is assembled from third-party sources and reverse engineering, and that some fields may be misinterpreted.

The direction of travel is more open. Newer work on rail ticket security sits under the European Union Agency for Railways — the technical document on digital security elements for rail passenger ticketing, ERA-REC-122/TD/02, is the reference for the newer barcode families (SSB, FCB, TLB and ELB), which use published asymmetric cryptography rather than anything secret.

So treat specific byte offsets as "what working decoders do", not as "what the standard says". The structural claims — Aztec symbology, signed record, compressed containers, name and document fields present on some tickets — hold up across independent implementations.

Why Your Phone Camera Will Not Read It

This is the most common complaint about rail e-tickets and it has a straightforward cause: the built-in camera app on most phones only acts on QR codes. Aztec is a different symbology, and pointing a QR-only scanner at an Aztec code produces nothing at all — not an error, just silence. Nothing is wrong with the ticket.

The situation differs by platform and changes with OS versions, so the honest guidance is: if your camera does nothing, the format is the likely reason, and a scanner that explicitly lists Aztec support will read it. Our guide to which barcodes a phone can actually scan goes through the format lists in detail.

Two practical notes if you are trying to read your own ticket:

• Decoding gets you bytes, not a ticket. A general scanner will return the raw contents. For UIC tickets that is compressed binary, so what you see is unreadable without a decoder that knows the container format. The boarding pass case is easier because that payload is plain text.
• A boarding pass decoder will not help. IATA BCBP and the rail formats share the Aztec symbology and nothing else. Our boarding pass decoder reads airline passes only.

What This Means in Practice

1. Do not post a photo of a rail ticket. This is the same advice as for boarding passes and it is better founded here, because the barcode may carry your name and an identity document number. Blurring the printed text does nothing; the barcode is the sensitive part.
2. A screenshot of your own ticket is normally fine to travel on, since the barcode is the ticket and it does not degrade — but check your operator's conditions, because some require the ticket be shown in their app rather than as an image.
3. Do not accept a forwarded ticket from a stranger. Barcode plus back-office validation means a resold or duplicated ticket is detectable at the barrier, and the record identifies the retailer that issued it.
4. Dispose of printed tickets properly. A used ticket remains decodable indefinitely. The travel is over; the name and document number in it are not.
5. Expect variation. Fields are optional. A walk-up ticket bought with cash will carry far less than an international fare booked against a passport.

Frequently Asked Questions

Is the barcode on a train ticket a QR code?

Usually not. European and UK rail e-tickets use Aztec codes, a different 2D symbology standardised as ISO/IEC 24778. The easy visual test is the centre: an Aztec code has a bullseye of concentric squares in the middle, while a QR code has three large squares in its corners. Some operators do use QR codes for other products, but the main ticket barcode is typically Aztec.

Why will my phone not scan my train ticket?

Most likely because the built-in camera app recognises QR codes and nothing else, so an Aztec code produces no reaction at all. That is a scanner limitation, not a fault in the ticket — the barrier readers at the station are purpose-built for it. A scanner app that explicitly lists Aztec among its supported formats will read the symbol.

Does a train ticket barcode contain my name?

It can. The container format used by several European operators defines sub-blocks for a passenger name, for a given name and surname pair, and for an identity document number with a code for the document type — including national identity card and passport. Whether a particular ticket uses them depends on the operator and the fare. A named advance fare booked against an ID document is far more likely to carry them than an anonymous walk-up ticket.

Can someone copy my ticket barcode and travel on it?

Copying the image is trivially easy, and it mostly does not work. The barcode is cryptographically signed, so an altered or invented one fails verification at the reader. A perfect copy of a genuine ticket passes that check, but validation systems also record which tickets have been scanned, so a duplicate presented after the original has been used is detectable. Treat your ticket like a bank note rather than like a receipt.

Is the data in the barcode encrypted?

No — it is signed, which is a different guarantee. A signature proves the record came from an authorised issuer and has not been modified. It does not conceal the contents. Anyone with the symbol and a decoder that understands the container format can read the fields, which is precisely why photographs of tickets should not be posted publicly.

Can I decode my own train ticket to see what is in it?

Partly. Any scanner that reads Aztec will return the raw contents, but for UIC-family tickets that is zlib-compressed binary inside a signed envelope, so the useful step is a decoder that understands the container structure. Several open-source projects do this and run entirely on your own machine. Be wary of uploading a ticket image to an unknown website — you would be handing over exactly the fields this article is about.

Why is a rail ticket barcode so much bigger than a QR code on a poster?

Because it carries much more. A poster QR code usually holds a short URL — a few dozen characters. A UIC rail ticket holds a header, a 50 or 64 byte signature and a compressed block of ticket containers, running to several hundred bytes even after compression. More data means more modules, which means a denser symbol at the same physical size.

The Short Version

The square on your rail e-ticket is an Aztec code, not a QR code, which is why a QR-only camera app ignores it. Inside is a cryptographically signed record: on the UIC side a header, signature and zlib-compressed containers; in Great Britain a bit-packed record recovered directly from an RSA signature.

The signature makes the ticket hard to forge and does nothing to hide what it says. On operators that use them, the fields include the traveller's name and the type and number of the identity document used to book. Signed is not the same as private.

Practical upshot: do not post pictures of tickets, bin used ones properly rather than leaving them on the seat, and if your camera refuses to read yours, the format is the reason.