IATA BCBP

Overview

The Bar Coded Boarding Pass (BCBP) is the industry-standard data format that airlines encode into the 2D barcode printed on, or displayed by, a passenger's boarding pass. It is defined by IATA Resolution 792, which specifies "the required characteristics of the elements and format of the Bar Code on the Boarding Pass" [1]. The data are a fixed-and-conditional set of structured ASCII fields — passenger name, flight, seat, sequence number and so on — laid out as length-prefixed records and rendered into a barcode symbol [1].

BCBP is carrier-agnostic about symbology within a defined set. The standard names four symbologies that may carry the data: pdf417, aztec, DataMatrix and qr-code. The default barcode on a printed boarding pass is pdf417; the three matrix codes (aztec, DataMatrix, qr-code) are used for mobile (phone-displayed) boarding passes and may also appear on printed passes [1].

History

BCBP was set as an industry standard when the IATA Passenger Service Conference of 2004 unanimously approved Resolution 792, and the standard was first published in 2005 [1, 3]. Its purpose was to provide a barcode solution for the electronic-ticket world and to fully replace the previous boarding-pass standard, Resolution 722c "Automated Ticket/Boarding Pass – Version 2" (ATB2), which used a magnetic stripe [1].

BCBP was a pillar of IATA's "Simplifying the Business" (StB) program. IATA's Board of Governors set a mandate that all IATA member airlines be capable of issuing BCBP by the end of 2008 and that 100% of boarding passes carry a 2D bar code by the end of 2010; the 2008 Passenger Services Conference set a sunset date of 31 December 2010 for the change, which corresponded to eliminating magnetic stripes on boarding passes [1, 3]. The ATB2 magnetic-stripe standard expired in 2010 [3]. Adoption ramped quickly: from 9 BCBP-capable airlines at end-2005 to roughly 200 by end-2008 [3].

Resolution 792 is maintained by IATA's BCBP group of experts and has gone through successive versions. The accompanying Implementation Guide reached Version 7 (dated 2 March 2021); IATA notes that guide "Version 6" was skipped so the guide's number would match the current Resolution 792 version [1].

Technical specification

One pass per passenger, up to four legs. Before BCBP, airlines issued one boarding pass per flight leg. The BCBP format lets an airline encode either one leg or several legs of an itinerary into a single barcode; the encoding carries up to four legs of a journey [1, 6].

Field model. Resolution 792 (Attachment A) defines the formatting of each item: alphanumeric items are usually left-justified with trailing blanks (e.g. passenger name DESMARAIS/LUC␣␣␣), and numeric items usually carry leading zeros (e.g. seat 001A). Attachment C defines acceptable values and the sizes of variable-length fields [1]. Items fall into three classes [1]:

• Mandatory items — always populated; if unavailable at issuance they are filled with blanks so the character count stays correct.
• Conditional items — populated when the airline's system has them; otherwise blanked, and the conditional field's size can be shortened if trailing fields are unused.
• Airline individual-use item — free space for airline-proprietary data.

Mandatory unique (per-pass) and repeated (per-leg) structure. The barcode begins with a format code and a leg count, then a unique header block followed by a repeated per-leg block. The mandatory fixed-length layout is (lengths in bytes) [6]:

Field	Len	Notes
Format Code	1	always M [6]
Number of Legs Encoded	1	1–4 [6]
Passenger Name	20	SURNAME/FIRST [6]
Electronic Ticket Indicator	1	E distinguishes e-ticket vs ticketless product (item 253) [1, 6]
Operating Carrier PNR Code	7	the record locator [6]
From City Airport Code	3	IATA airport code [6]
To City Airport Code	3	IATA airport code [6]
Operating Carrier Designator	3	IATA airline code [6]
Flight Number	5	[6]
Date of Flight	3	Julian day-of-year [6]
Compartment Code	1	cabin type, not fare class (item 71); per Resolution 728 [1, 6]
Seat Number	4	e.g. 001A [6]
Check-in Sequence Number	5	[6]
Passenger Status	1	[6]

Conditional / structured-message blocks. After the mandatory data, optional length-prefixed blocks carry conditional items (version number; field-size bytes; source of check-in, item 12; source of boarding-pass issuance, item 14; date of issue as a Julian date, item 22; baggage-tag licence-plate numbers, items 23/31/32; selectee/TSA indicator, item 18) plus an airline individual-use field and, finally, an optional security section [1]. Field-size items 6, 10 and 17 carry, in ASCII-printed hexadecimal, the byte size of the conditional structured messages that follow [1]. Item 18 (selectee indicator) is conditional in general but mandatory for itineraries involving United States travel, where it carries the TSA-defined vetting status [1].

A BCBP without personal data is still uniquely identifiable by the combination of date of flight (Julian), operating carrier code, flight number, check-in sequence number and from-city code — which lets systems detect duplicate scans at security [1].

Symbology carriers. The default printed-pass carrier is pdf417, chosen because it was the first open, royalty-free 2D symbology able to encode the required data, conforming to ISO/IEC 15438 [1]. pdf417 does not scale well for a four-leg trip with all conditional elements filled in, so the standard also allows the matrix codes [1]. For mobile, the three permitted matrix symbologies are aztec (ISO/IEC 24778; ~900 alphanumeric characters in an 83×83 cell code), DataMatrix (ISO/IEC 16022; ~862 characters in 80×80), and qr-code (ISO/IEC 18004; ~938 characters); matrix codes fit phone screens better than the linear-stacked pdf417 [1].

Use cases

• Boarding and check-in across four channels — desk, self-service kiosk, web, and mobile; a BCBP can be obtained through any channel [1].
• Security checkpoints, lounge and fast-track access — third parties scan the barcode for access control; strict format compliance matters because interline partners and third-party operators must be able to read the data [1].
• Interline / through-check — one barcode encodes several operational legs, including funnel flights identified by a single member flight number [1].
• Duplicate-pass detection — the unique field combination flags a boarding pass scanned twice at security [1].

Implementations

• georgesmith46/bcbp — JavaScript, MIT. encode()/decode() for BCBP; supports any number of legs (documented to BCBP version 6). ~62 stars; last pushed 2024 [7].
• ncredinburgh/iata-parser — Java, Apache-2.0. Parser for the boarding-pass format described in IATA Resolution 792. ~33 stars; last pushed 2020 [7].
• ThatDesert/bcbp — Python, GPL-3.0. Decodes IATA-standard boarding passes (pip install bcbp). ~7 stars; last pushed 2022 [7].

Comparison

BCBP is unusual among the standards in this encyclopedia because it defines a data format independently of its carrier symbology and then permits four symbologies. The practical split is: pdf417 for paper (default; open, royalty-free, dense for a linear-stacked code) versus aztec / DataMatrix / qr-code for phone screens (square matrix codes that render and scan better on a backlit display) [1]. This is the inverse of the aamva-dl driver-licence standard, which mandates exactly one symbology (pdf417) and forbids the others. Unlike a payment QR or a verifiable-credential format, BCBP carries cleartext structured data with no mandatory cryptographic protection of the payload — the optional security section exists but is not always populated [1].

Fun facts

• A printed boarding-pass barcode can be read by ordinary barcode apps to reveal the passenger name, route and the 6-character PNR (record locator); combined with a surname, that locator can be enough to log into an airline's "manage my booking" site [3].
• A widely-cited 2020 incident: a posted photo of a boarding pass belonging to former Australian PM Tony Abbott led, via the airline's booking site, to exposure of his passport number and internal PNR remarks — illustrating that the barcode payload is not private data [3].

Status

Active and effectively universal. BCBP is the global standard for boarding-pass barcodes; the magnetic-stripe predecessor (ATB2) expired in 2010, and more than 200 airlines use BCBP [3]. Resolution 792 continues to be maintained and versioned by IATA's BCBP experts, with the Implementation Guide at Version 7 (2021) [1].

Sources

1. Bar Coded Boarding Pass (BCBP) Implementation Guide, Version 7 — IATA, 2021
2. Common Use Standards — IATA
3. Boarding pass — Wikipedia, 2026
4. What's in my boarding pass barcode? — The JavaDude Weblog, 2017
5. bcbp — Encoding/decoding library for the IATA Bar Coded Boarding Pass — georgesmith46 (GitHub), 2024

Deployments

No country reports mention this standard by name.

Regions / aggregations not mapped to a single country

• Universal