What Is Actually Inside the Barcode on a Driver's Licence

Turn over almost any driver’s licence issued in the United States or Canada and you will find a dense black rectangle roughly the size of a postage stamp stretched into a bar. Most people assume it is a serial number — a reference key that a police officer’s terminal looks up in a database.

It is not. There is no lookup. Everything is already in the barcode.

That rectangle is a PDF417 symbol, and it contains a complete, self-describing text record of the cardholder’s details. Understanding what is in there is the difference between checking an ID and actually verifying one.

PDF417 in one paragraph

PDF417 is a stacked linear barcode — think of it as seventeen or so rows of ordinary barcode stacked on top of each other, which is where the “17” in the name comes from. A single symbol can hold well over a kilobyte of text, versus about twenty characters for the barcode on a tin of beans. It also carries Reed–Solomon error correction, which is why a licence that has spent two years in a wallet still scans reliably even when scratched.

It was standardised in the early 1990s and adopted by AAMVA — the American Association of Motor Vehicle Administrators — as the machine-readable layer for North American driver licences and ID cards. Every US state, the District of Columbia, and the Canadian provinces encode to that shared specification.

The structure

The payload is plain text with a rigid opening sequence. A real one begins something like this:

@ ANSI 636014100002DL00410288ZC03290015DLDAQY1234562
DCSPUBLIC
DACJOHN
DADQUINCY
DBB19850512
DBA20280512
DBD20220512
...

Reading that from the top:

@ — the compliance indicator. Every AAMVA payload starts with it. Its absence is an immediate red flag.

ANSI — the file type, confirming the record follows the ANSI/AAMVA standard.

636014 — the Issuer Identification Number (IIN). This identifies the issuing jurisdiction. 636014 is California. This one field is quietly one of the most useful checks available: if the front of the card says Texas and the IIN says California, you are holding something interesting.

10 — the AAMVA version number. The standard has been revised repeatedly since 2000, and each revision changed which fields are mandatory and how some are formatted. A version number that did not exist when the card was supposedly issued is a strong signal of a template-built forgery.

Subfile designators — the remainder of the header describes what record types follow and where each begins. DL is a driver licence subfile; ID is an identification card; ZC and similar are jurisdiction-specific extensions where states put their own data.

Then come the data elements, each a three-letter code followed immediately by its value.

The field codes worth knowing

Code	Meaning	Format
DCS	Family name / surname	Text
DAC	First name	Text
DAD	Middle name(s)	Text
DBB	Date of birth	YYYYMMDD
DBA	Expiry date	YYYYMMDD
DBD	Issue date	YYYYMMDD
DAQ	Licence / ID number	Alphanumeric
DAG	Street address	Text
DAI	City	Text
DAJ	State / province	2-char code
DAK	Postal / ZIP code	Text
DBC	Sex	1 = male, 2 = female
DAU	Height	e.g. 070 IN or 178 CM
DAY	Eye colour	3-char code, e.g. BLU
DCK	Inventory control number	Text

For age verification, DBB and DBA are the whole job. Everything else is context — but context is what catches forgeries.

One clarification that matters for privacy conversations: the barcode does not contain the photograph. It has no biometric data at all. It is text.

Why this is better than looking at the front

Two reasons, and the second is the interesting one.

It removes human arithmetic. Comparing a date of birth against a legal cutoff is a task humans perform badly at 1am in bad light with a queue building. Machines do not misread a 3 as an 8.

It creates a consistency check that forgers routinely fail. Printing a convincing card front is a graphics problem — expensive, but solved, and the counterfeit market solved it years ago. Encoding a correct barcode is a data problem: you need the right IIN for the state, the right AAMVA version for the issue year, correct field ordering, correct terminators, and every value matching what is printed on the other side.

Many fakes simply do not clear that bar. Common failures:

• The barcode does not decode at all — it is a decorative image of a barcode
• It decodes to the template vendor’s placeholder data
• DBB in the barcode does not match the printed date of birth, because the front was edited and the back was not
• The IIN belongs to a different state than the card front claims
• The AAMVA version predates or postdates what the issuing state was using

None of these are visible to the eye. All of them are trivial to detect once you can read the barcode.

The honest limits

Reading the barcode is the strongest single check available at a door, and it is still not proof.

A well-made fake encodes correctly. If a forger takes the trouble to write valid AAMVA data with the right IIN and a matching front, the barcode will scan clean. Barcode verification raises the cost of a successful fake substantially; it does not make one impossible.

A borrowed real ID passes perfectly. The most common way an underage person gets served is not a counterfeit at all — it is an older sibling’s genuine licence. The card is real, the data is real, the barcode is flawless. Nothing technical will catch this. Only comparing the photo to the face and asking a question the borrower cannot answer will.

Not every jurisdiction uses it. Passports use MRZ — the two lines of chevron-separated text at the bottom of the photo page, a completely different standard. UK and EU documents vary widely: some carry MRZ, some carry a chip, some carry neither in a form you can read at a door.

So the barcode is a filter, not a verdict. It catches the mid-tier fakes that make up most of what a busy venue sees, it removes the arithmetic errors, and — this is the part that matters when something goes wrong — it produces a timestamped record that a check occurred.

What this means for your door

If you take one thing from this: the back of the card is where the information is, and the front is where the forger’s effort went.

Whatever you use to read it — dedicated hardware, a phone app, a friend who works in security and owes you a favour — checking that the encoded data agrees with the printed data is the single highest-yield verification step available in the eight seconds you have.

That check is exactly what we are building into a phone. If your venue would use it, the early access list below is where to get it first — and where to tell us which documents your door sees most, so we build for those.