Once you step off the plane, a boarding pass looks like scrap paper. The black square or stripe printed on it says otherwise. Since 2010 almost every airline in the world has encoded passenger data in a two-dimensional barcode, and anyone with a free phone app can read it in seconds. That is why security writers and airlines alike now tell travellers to shred old passes and keep them off social media.

Printed airline boarding pass showing flight details and a barcode

What a boarding pass barcode contains

The barcode follows the IATA Bar Coded Boarding Pass (BCBP) standard. IATA set the two-dimensional PDF417 format as the industry standard in 2005, added a mobile version for phone passes in 2008, and announced on 15 December 2010 that airlines had completed the switch from magnetic-stripe cards. The changeover took five years, involved more than 2,000 airports, and was expected to save the industry up to US$1.5 billion a year.

The standard leaves room for different fields, but a typical pass encodes:

  • the passenger's name as it appears on the booking
  • the six-character booking reference, also called the record locator or PNR
  • flight number, date, route, cabin, seat and sequence number
  • in many cases the frequent-flyer airline and membership number

None of this is encrypted. A barcode is simply a machine-readable way of writing text, so a scanner app shows the contents in plain language.

Why the surname and booking reference matter

Airline websites let you open "Manage my booking" with just two things: your surname and your booking reference. Both are printed on the pass and stored in the barcode. That convenience is the weak point.

In October 2015 the security journalist Brian Krebs described how a reader decoded the barcode from a friend's Facebook photo of a Lufthansa boarding pass. With the name and record locator he could open the booking online, see the friend's phone number and upcoming flights, and he found options to change seats or cancel trips. The decoded data also showed the full frequent-flyer number, which United Airlines otherwise masks on its own correspondence.

A famous case: Tony Abbott's Instagram post

The best-known example came from Australia. In March 2020 the former prime minister Tony Abbott posted a photo of his Qantas boarding pass and baggage receipt on Instagram after a flight from Tokyo to Sydney. The six-character booking reference was visible. Using it with his surname on the Qantas website, the Australian software developer Alex Hope reached the booking and found Abbott's passport number, date of birth, phone number and email address.

Hope did not misuse the data. He alerted Qantas, the Australian government and Abbott himself, and published his account in September 2020. Qantas and its booking-technology provider Amadeus then restricted some of the details shown on the online booking pages.

How to keep and dispose of a boarding pass safely

  • Keep it until the trip is closed. Hold on to it until your miles are credited and any expense claim is filed; it is the easiest proof that you flew.
  • Shred it afterwards. Tear or shred it so that the barcode, name and booking reference are all destroyed. Never leave it in the seat pocket or a hotel bin.
  • Post the view, not the pass. A wing over the clouds says "I'm off" just as well. If you must share a document, black out the whole barcode or QR code plus the booking reference and frequent-flyer number with a solid box, and check the exported file.
  • Mind your phone. Mobile passes and screenshots sync to cloud albums; delete them once the trip is over.
  • Treat the frequent-flyer number like a password hint. It is often a step in account-recovery processes.

If you have already posted a pass, delete the image, log in to the booking through the airline's own app or website and check your details. Contact the airline through its published support channels if anything looks changed.

Our airport Wi-Fi guide covers another part of staying safe while you travel, and our carry-on packing piece shows where documents belong during the journey.

Sources