Barcodes and QR codes on documents: what they reveal, and why to mask them

A barcode or a QR code on a document is not decoration. It stores real data in machine-readable form, often the same name, address or account number you just blacked out in the visible text. Scan it, and the code can undo your redaction in one tap.

Why a barcode can undo your redaction

Most redaction tools work on the words you can see. A barcode shows a pattern of bars or squares that a scanner turns back into text. If that hidden text repeats your name, account number or address, a black box over the printed version does nothing. The code still holds the original value, and anyone with a phone and a scanner app can read it in seconds.

What does the 2D-Doc code on French documents contain

France uses a system called 2D-Doc on many official supporting documents. It is built and specified by the Agence Nationale des Titres Sécurisés, the ANTS. Utility bills used as proof of address, tax notices and bank statements often carry one of these square barcodes. The code stores the exact data printed on the page, plus a digital signature.

That signature lets a receiving office check the document was not altered, using ANTS's own technical specification. An estimate in that same specification puts the number of these supporting documents used in French procedures at more than 20 million a year. The data in the barcode is signed, not encrypted, so any 2D-Doc reader app can display the underlying name and address in plain text.

• Proof-of-address bills: the resident's first name, last name and full postal address.
• Bank statements used as proof (RIB): the account holder's name, plus IBAN and BIC.
• French tax notices (avis d'imposition): the taxpayer's name, tax number and reference income.
• Every 2D-Doc document: the paper's issue date and a digital signature that flags any edit.

What does a boarding pass barcode reveal

Airlines follow a shared format called the Bar Coded Boarding Pass, or BCBP, set by IATA's Resolution 792. IATA's implementation guide, in force since 2018, lists the passenger's name as a mandatory field. The same barcode carries the flight, the seat and a short alphanumeric code called the booking reference, also known as the PNR locator.

That booking reference matters more than it looks. A security researcher scanned a real barcode live for Global News in 2017 and read it in seconds. Global News reported that the same reference can unlock a passenger's frequent-flyer number, phone number and even future flights on the same loyalty account. Posting a clear photo of a used boarding pass can hand all of that to a stranger, long after the flight has landed.

David Horton, a security and technology expert, told Global News about it in December 2017. His rule fits in one line: take your boarding pass, don't put it in the family album, then shred it.

What other codes carry your data

Barcodes are not only on ID papers and boarding passes. The EPC069-12 standard covers invoices too. A QR code on a SEPA invoice, set by the European Payments Council, can carry the beneficiary's name, IBAN, BIC and the amount due. In Switzerland, the QR-bill fully replaced the old paper slip on 1 October 2022, per SIX Group. It encodes the creditor's IBAN, name, the amount and a payment reference.

Parcel and courier labels carry a tracking barcode next to the recipient's printed name, address and phone number. Event tickets and health passes hold similar QR codes: a name, a validity window and sometimes an ID or membership number. Blurring the printed name on any of these and leaving the code untouched leaves the same data one scan away.

How do you check a code before you share it

You do not need special tools to see what a code says. A modern phone's camera app can usually read a QR code and show the decoded text before you open anything. An older 1D barcode needs a scanner app instead. Point the camera, read the preview text, and treat it exactly like the printed text beside it. If a name, number or address shows up, mask the code too.

• Scan every code yourself before you post or send the page.
• Check the small print near footers and margins, not just the main barcode.
• If the text shows a name, number or address, mask the whole code.
• Cropping a corner is not enough. Cover or blank out the entire code block.
• When in doubt, remove the code and rewrite the information by hand.

ONYRI Sanitize reads a document's text to find and mask sensitive data, but it cannot read what a barcode or QR code encodes. Use its Draw an area tool to cover the whole code by hand, and the flattened export keeps only your masked page. The limit: you still have to spot every code yourself, including small ones tucked into a footer.

A redaction is only as good as its weakest layer. Black out the visible name, then check every code on the page the same way a scanner would. A few seconds with your phone's camera can save you from handing out the very data you meant to hide.