Why you should never post your boarding pass on social media
The barcode on your boarding pass contains more personal information than most travelers realize. Here is what it encodes, who can read it, and what to do with it after the flight.
The boarding pass photograph is one of the most common travel social media posts. The gate number, the destination, the airline logo, and the seat assignment tell your story without words. It also broadcasts, to anyone who knows how to read a barcode, information that has no business being public.
This is not a theoretical risk. It is documented, with specific and reproducible consequences demonstrated by security researchers, reported by journalists, and experienced by travelers who learned the hard way what their barcode contained.
WHAT THE BARCODE ACTUALLY ENCODES
The barcode on a commercial boarding pass follows the BCBP (Bar Coded Boarding Pass) standard, developed by IATA (International Air Transport Association). The standard defines exactly what data is encoded in the barcode, and the list is longer than most passengers expect.
At minimum, a BCBP barcode contains your full name as it appears in the booking system, your frequent flyer number if one is attached to the reservation, your booking reference or PNR (Passenger Name Record), the flight number, the departure and arrival airports, the date of travel, the cabin class, and your seat assignment. In many implementations, it also contains your ticket number, your security status (whether you have been cleared for expedited screening), and a sequential number tied to your check-in order.
The booking reference is the most consequential field. A six-character alphanumeric code, it is the key to your entire reservation in the airline’s system. Anyone with your booking reference and your last name, both visible in the barcode, can access your reservation through the airline’s manage-my-booking portal. From there, they can see your contact details, your passport number (if you entered it during booking), your travel companions, your seat assignment, and, in some cases, your meal preferences and special assistance requests. On many airlines, you can also change your seat, add baggage, or cancel the booking entirely.
The frequent flyer number is the second consequential field. Combined with your name and booking reference, it provides enough information to attempt access to your loyalty account through credential stuffing or social engineering. Loyalty accounts contain accumulated miles, stored payment methods, and, in some programs, the equivalent of thousands of dollars in travel credit.
WHO CAN READ IT
The barcode is not encrypted. It is encoded in a standard format that any barcode scanner can read, and any online decoder can interpret. A photograph of a boarding pass barcode posted to Instagram can be decoded in under thirty seconds using freely available tools that require no technical knowledge.
Security researcher Brian Krebs documented this comprehensively in 2015, demonstrating that a boarding pass photograph posted by a public figure contained enough information to access the subject’s frequent flyer account. The demonstration required only the barcode image and a basic online decoder. Nothing has changed in the underlying standard since then.
The threat is not primarily from sophisticated attackers. It is from the combination of publicly available information and the low effort required to use it. A publicly posted boarding pass photograph provides raw material for a booking modification, a loyalty account takeover, or a social engineering attempt against the airline’s customer service. The information is specific enough to be credible and complete enough to be actionable.
THE PHYSICAL BOARDING PASS AFTER THE FLIGHT
The same logic applies to the paper boarding pass after travel. A boarding pass left in a hotel room, dropped in an airport bin, or discarded with checked bags is readable by anyone who picks it up. The booking reference remains valid after travel in most airline systems for a period ranging from weeks to months, depending on the carrier. The frequent flyer number does not expire.
The correct disposal method is shredding. In the absence of a shredder, tearing the boarding pass into pieces small enough that the barcode cannot be reconstructed is sufficient. Folding and discarding is not.
This applies equally to boarding pass receipts printed by self-service kiosks, bag tag receipts that contain the same PNR, and hotel key card envelopes that some properties print with guest reservation details.
WHAT TO DO
Before posting any travel photograph that includes a boarding pass, mobile or printed, check that the barcode is not visible. A boarding pass with the barcode covered or cropped out of frame communicates everything the post is intended to communicate and exposes nothing.
After the flight, shred the paper boarding pass or tear it into small pieces before discarding it. Delete the mobile boarding pass from your phone’s wallet once the trip is complete. The data it contains remains sensitive even after the flight has landed.
If you discover that a boarding pass photograph has been posted publicly with the barcode visible, contact the airline immediately to have your booking reference changed and ask your loyalty program to review recent account activity. The exposure is recoverable. It requires acting before someone else acts first.
The boarding pass is a functional identity document, not a travel souvenir. It contains your name, your booking details, your frequent flyer account, and the key to your reservation. Treat it accordingly, both before and after the flight.
