Anyone who has flown within the past few years would have seen the now ubiquitous barcode on the boarding pass that’s scanned upon boarding the aircraft.
Over the years I have seen many people post images of these boarding passes online, often while reviewing new technologies such as mobile or web check-in. In most cases any personally identifiable plain-text information has been obfuscated yet the barcode has been left intact.
Eventually curiosity got the better of me and I decided to find out more information on the barcode standard, and the information contained within them.
History of the barcode
In 2005 the IATA (International Air Transport Association) commenced a five year project to deploy Bar Coded Boarding Passes (BCBP) across its member airlines to eliminate magnetic boarding passes. This change would allow airlines to use cheaper boarding pass stock, and even enable technologies such as web and mobile check-in – an advancement estimated to save the industry US$1.5bn annually.
What information do they contain?
When writing this article I sat out collecting various boarding pass barcodes both from my own archived web check-in and other boarding passes found on the Internet.
Using freely available software utilities, I decoded the barcodes and had a look to see what’s there. Here’s an example from a Qantas flight of mine taken last month (decoded from the barcode on the web check-in document):
M1EWING/SHAUN MR 1A11A1 BNESYDQF 551 107Y26J 37 00
That information translates to:
- M1: Format code ‘M’ and 1 leg on the boarding pass.
- EWING/SHAUN MR: My name.
- 1A11A1: My booking reference.
- BNESYDQF: Flying from BNE (Brisbane) to SYD (Sydney) on QF (Qantas).
- 551: Flight number 551.
- 107: The Julian date. In this case 107 is April 17.
- Y: Cabin – Economy in this case. Others including F (First) and J (Business).
- 26J: My seat.
- 37: My sequence number. In this case I was the 37th person to check-in.
- 00: Field size of airline specific data message. 00 as there isn’t any.
In this instance, Qantas are using the minimum data fields as required by the IATA BCBP standard, but what about other boarding pass types?
The next step was to try a real boarding pass issued at the airport.
M1EWING/SHAUN E1AAAAA SYDBNEQF 0524 106Y023A0073 359>2180
B 29 0 QF 1245678 128
There’s more information in this boarding pass barcode, which is as follows:
- M1: Format code ‘M’ and 1 leg on the boarding pass.
- EWING/SHAUN: My name.
- E1AAAAA: Electronic ticket indicator and my booking reference.
- SYDBNEQF: Flying from SYD (Sydney) to BNE (Brisbane) on QF (Qantas).
- 0524: Flight number 524.
- 106: The Julian date. In this case 106 is April 16.
- Y: Cabin – Economy in this case. Others including F (First) and J (Business).
- 23A: My seat.
- 0073: My sequence number. In this case I was the 73rd person to check-in.
- 3: My “passenger status”.
- 59: There is a various size field. This is the size
- >: Beginning of the version number
- 2: The version number.
- 18: Field size of another variable field.
- 0: My check-in source.
- B: Airline designator of boarding pass issuer.
- 2: Another variable size field.
- 9: Airline code.
- 0: International document verification. ’0′ as I presume is not applicable.
- QF: The airline my frequent flyer account is with.
- 1245678: My frequent flyer number.
- 128: Airline specific data.
After this I checked an iPhone boarding pass. This contains the same information as on an airport issued boarding pass.
What could you do?
Most of the information contained within the boarding pass is fairly mundane, and the main point to this exercise is – if you’re going to post an image of your boarding pass online and obfuscate your name – also obfuscate the barcode.
The booking reference is however contained within the barcode and someone could use that to manipulate your booking (if you have more flights to go).
Who is Eddy Chiu?
Qantas have an example web boarding pass on their web site for “FYSH/WILLIAM MR” – a name frequently seen on the sample Qantas cards and other literature.
Intriguingly the barcode on this boarding pass doesn’t match up with the details, and instead shows:
M1CHIU/EDDY MR 3XQ2QK SYDCBRQF 807 155Y22A 15
While Mr Chiu is on the same flight as on the boarding pass, he is not sitting in the same seat as Mr Fysh yet shares the same sequence number.
I suspect an easter egg or “calling card” from a developer.
Conclusion
Most of the information contained within the barcode is harmless, and besides the booking reference there is nothing that can’t be gleaned from a boarding pass left behind in a seat pocket.
However, if you are publishing an example of a boarding pass and don’t want your personal information (eg: name) to be discovered, then obfuscate the barcode as well!
I would also recommend not leaving your boarding pass on the aircraft when you disembark.
More information on the actual project and the standard is available on the IATA web site. NASA have also published a Julian Day Calendar.