Introduction
Every day, millions of people fly from one point to another. Moreover, right now, hundreds of thousands of people are in the sky. I'm sure you've never thought about it—hundreds of thousands of people right above your head.
Each of these people must have a boarding pass for their commercial flight. However, few of these millions of people think about how much information about them and their flight is on that boarding pass.
Today, I want to tell you about the boarding pass. I've studied a lot of information about the data on it and am ready to share it with you. Most people treat boarding passes for flights as trash after their journey is over. Some may keep it somewhere for future reference, but in most cases, boarding passes end up in the trash. Moreover, they aren't even torn. The boarding pass contains a lot of information that others, with malicious intent, can use to their advantage.
Text Information on the Boarding Pass
So, here is your boarding pass. You are sitting in the airport, holding it in your hands at your boarding gate, waiting for the boarding announcement. Now, let's take a look at it, just a regular glance, without any special scanners, just look at it. Let's do it together.
So, everything is signed here. The first thing we see is our full name, followed by the flight number, the date of departure, and the departure time. That's the end of the first line. Overall, there isn't much sensitive information here yet, but its combination already represents much greater value than each detail separately. But let's continue.
The second line contains the main information about the flight. The departure column indicates the 3-letter airport code (IATA) (I wrote about codes here) and the same code for the arrival airport. Below them are the names of the departure and arrival cities. Next is the scheduled boarding completion time and the departure airport gate number. Here we see another less sensitive part as an independent piece of information. However, if we combine this information with the details on the first line, we already know quite a lot about you. We know that a person with this full name departed at a certain time from one city and landed in another city. Moreover, we already know which plane this person flew on because we have the flight number. If you are not hiding from pursuit, this information will not be sensitive for you as an ordinary person. Yes, someone can find out that you moved from one place to another, so what?
The last line of the boarding pass contains your seat number on the plane, the ticket number (which number you received from the entire plane), and the booking number. In general, not very valuable information, but in fact, this is the most valuable information on the entire ticket that you can just read. Why? Because the booking number is indicated here.
From ancient times to this day, using only the Last Name + Booking Number combination, you can enter the control panel of your reservation (in fact, manage your flight conditions). There you can choose a seat, specify onboard meals, cancel the flight, change the service class, and so on. But besides that, right there, there is part of additional data that cannot be on your ticket, for example, all your past or future flights (which you can also manage).
And now let's try it in practice. There is one moment—your booking "lives" until you sit in the plane. After that, your reservation goes into the "closed" status because you are already on the plane; you can no longer order additional services using your reservation because the plane is already loaded with everything it was designed for. That is, being on the plane, you cannot order something to eat, except what may already be on board. But as long as you are not on the plane and your plane is being serviced, there is time to place an order, and then your order will be taken into account and loaded on board. There are also time limitations for this before departure, but we digressed from the topic.
Since I have already completed the flight on this ticket, and my reservation "died," we will still try to reach some of my data. Open the browser and go to the official website of this airline, select "manage booking," and enter our data.
Overall, that's it. You can't do any more operations with the booking number. So, let's look at the ticket again and see what else we can get, already using some additional services?
Barcode
We intentionally skipped this part at the beginning because it requires additional means, and not everyone understands what it is and how to deal with it.
If you are wondering, we are talking about those mysterious black dots on the boarding pass—they are called a barcode. It's the same as a barcode but can contain and does contain much more information.
You probably noticed that your ticket gets "beeped" with this barcode, and then you go through security or proceed to boarding. Now, let's figure out what information this code holds. But first, I'll take a step back.
App in the Air
Once upon a time, when I started flying actively, my friend recommended an app called "App in the Air." She said you could easily add your tickets to it by simply scanning the barcode on the boarding pass in this app. If you don't have a boarding pass yet, you can add it manually using the flight number and departure date (the app will pull other flight details itself). I found it convenient and installed the app. By the way, I still use it, and I invite everyone to add me as a friend there. Flight information shows up there the fastest for me.
Back then, I was already curious about what could be encoded in that barcode since scanning it provided me with complete information about my flight. This raised many questions about this "knowledge reservoir" called a barcode.
Not so long ago, I started developing a section on this website called "Flights," something similar to the App in the Air. It's a section where I add all the information about my flights and want to keep it as a collection, but in an electronic form. Knowing what barcodes are, I never thought about what information is stored in the barcode on the boarding pass. I just wanted to add them to my electronic ticket, and I had to study what information they should contain so I could generate them for each of my tickets.
I started digging on the internet, but besides the official documentation, I found nothing. However, it was a superficial search. I started reading the documentation I found first and extracted a few concepts from it, which I will explain in detail later. After that, I began googling using the data and abbreviations from the documentation and found a little more information, but it was still very little. I didn't think it was so secretive, or maybe people just don't care or find it uninteresting.
Despite long and diligent searches, I finally unraveled this knot, using all the resources. So, get ready; I will now publish information contained in my barcode on the boarding pass.
M1FEDORUK/PAVEL NIKOLAE1CL97C LEDKGDDP 0535 262Y014B0019 128>218 0OO B 000391966070
We'll leave it here for now, but we'll come back to it later.
PDF14, BCBP, and IATA
Confusing abbreviations in the heading, right? Now I'll explain everything.
So, let's start with IATA. What is IATA?
The International Air Transport Association (IATA) is an international non-governmental organization. Its headquarters are in Montreal, Canada, with the European center in Geneva, Switzerland. IATA has 120 offices worldwide.
IATA was organized on April 19, 1945, in Havana, Cuba. IATA is the main mechanism for cooperation between airlines in promoting safe, reliable, and economical air transport—in the interests of consumers worldwide.
This is part of the information taken from Wikipedia; you can read more there. It explains everything in detail and is interesting.
In general, IATA is an organization that unites all air carriers on the planet. Periodically, they hold congresses and meetings to create new resolutions and new standards for air transport and passenger service.
Okay, we've covered IATA; this organization issues new standards. Now, let's understand what BCBP is. This is precisely one of those standards published and developed by IATA. BCBP stands for Bar-Coded Boarding Pass.
It all began in the 2000s when aviation was rapidly gaining momentum, along with the development of information technologies. The production of boarding passes with magnetic stripes was quite labor-intensive, expensive, and involved many other challenges. Eventually, there was a need to identify passengers more cost-effectively, and that's where the idea of using only a printed ticket came into play.
Thus, in 2005, the BCBP standard was published as a new primary standard for tickets - "Resolution 792." Later, it was followed by the DLC - "Resolution 722c Automated Ticket/Boarding Pass – Version 2." This allowed and paved the way for the use of electronic boarding passes since, essentially, all the printed information on the boarding pass is only needed for you, and the airport services only require the barcode on the boarding pass. Therefore, it could be "fit" into electronic devices that are always with you. With the release of the first iPhone, the first electronic boarding passes appeared. As I mentioned earlier, that time was an era of developing new technologies.
Alright, in general, we've figured it out. IATA introduced the BCBP standard, and everyone started using new boarding passes with barcodes. But what about PDF17?
And here we come to the last abbreviation in this chain of standards and organizations developing them. PDF17 is the barcode generation standard, in other words, it defines how a barcode looks. There are many of them, and each has its own standard with its own name or even a patent, like Spotify, for example.
By the way, every time you say QR code, you probably think of the code with black squares. Yes, you are absolutely right, but in reality, you are naming not how the code looks, but the standard of this barcode. Yes, it's a barcode from the family of 2D barcodes. And one more interesting thing, you probably never knew that the full name of QR is Quick Response Code. That's right, there's an article about these standards on Wikipedia, it's also interesting there.
And now we finally get back to our barcode on our boarding pass. If you've read the article on Wikipedia, the link to which I provided above, you generally understand that any barcode is just encrypted information for faster and more convenient reading by various devices (scanners). With the barcode on the boarding pass - it's the same story; it's just information. And now I'll tell you how you can decipher it yourself.
If you have an iPhone or iPad, you can install a scanner from the AppStore. If you don't own an iPhone/iPad or simply don't want to install any software, you can use the website. I will demonstrate using the website as an example.
So, here's what we do: we go to the specified website and select the barcode standard - PDF17.
Upload a part of the image with our barcode. A part to make it easier and faster for the parser to find the barcode on our image. And click the "Read" button.
The barcode will be recognized, and then it will be decoded. After that, the website will give us a page with the decoded barcode.
So, we get the scanning result.
M1FEDORUK/PAVEL NIKOLAE1CL97C LEDKGDDP 0535 262Y014B0019 128>218 0OO B 000391966070
This is precisely the data I mentioned earlier. Now comes the most interesting part: we will read them and understand what each line means. As we remember, this is the BCBP standard, so here is a strict order of data; this is how they should be encrypted. Remove one space, and that's it, your boarding pass scanners will no longer work correctly (more likely, they won't work at all).
So, here's what I managed to decipher based on the documentation and all the material studied. In addition, I manually tried to change this data and convert it back into a barcode. Then, using the "App in the Air" application I mentioned at the beginning, I added this flight. And yes, I succeeded! Obviously, App in the Air probably does not consider many of the data in this barcode; for example, the technical data of the airline. However, it was able to add the flight. I also intentionally tried to specify incorrect data or data of a non-existent flight (at the time of adding a flight, App in the Air connects to the flight database, and if it really exists, it adds it), then App in the Air could not add it because it does not exist or never existed in reality. Thus, I was able to generate barcodes.
But, besides me, there are many libraries on GitHub written in various languages, mostly in JavaScript and C. I also found a online barcode generator for boarding passes.
In general, that's all. This turned out to be a small study on the topic, which I decided to share with you, as many people in my environment might find this topic interesting.
Conclusion
Now we know that there is much more information stored in the barcode of a boarding pass than is printed in text on the actual boarding pass. As we found out, the barcode contains the ticket number, so with it alone, you can find out more about you, and it can actually be used for authentication in the airline's personal account.
Since the barcodes on my website will not contain real electronic ticket numbers, I can publish them publicly, mostly for aesthetics rather than any real application.
Respect the privacy of your personal data and do not publish boarding passes containing reservation numbers and barcodes. Other data is not particularly sensitive if you don't want to hide from someone. But in that case, I think you won't have the idea of publishing them on the Internet.