Are Boarding Pass QR Codes Safe?
Scanning your boarding pass at the gate is completely safe — the gate reader is just verifying your seat. The real risk is not at the airport. It is in what the QR code contains, and what happens when someone else can read it.
The short answer
Boarding pass QR codes issued by airlines — through an airline app, airline website, or airport kiosk — are safe to scan at the gate. The code is read by the airline's own verified equipment, and you are not exposed to any digital threat simply by presenting your boarding pass for scanning.
The concern is not about what happens at the gate. It is about what is inside the QR code, and what someone else can do with that data if you hand it to them by mistake — by posting a photo online, forwarding the wrong file, or leaving a paper pass on a plane seat.
Most travelers do not realize how much personal information is encoded in that small square. Knowing what is there helps you protect it.
What your boarding pass QR code actually contains
Airline boarding passes follow a standard format called BCBP (Bar Coded Boarding Pass), defined by the International Air Transport Association. Anyone with a free QR code reader can decode the data in seconds. A typical boarding pass encodes:
- Your full name as it appears on your travel document
- Your airline code, flight number, and departure date
- Your departure and arrival airports
- Your seat assignment and passenger sequence number
- Your booking reference — also called a PNR or record locator, a six-character code like “AB3XY7”
- Your frequent flyer number (if you have one linked to the booking)
The booking reference is the critical piece. Combined with your last name, it gives anyone access to the airline's “manage my booking” page — where they can view your full itinerary, see your passport details if stored, change or cancel reservations, and in some cases transfer or redeem accumulated frequent flyer miles.
There have been well-documented cases of travelers losing thousands of frequent flyer miles after posting boarding pass photos on social media — the PNR was visible in the QR code, the name was visible in the printed text, and that was enough.
Where the actual risks are
Posting boarding pass photos on social media
A photo of your boarding pass — even one that appears to just show the printed text — almost always also shows the QR code. Anyone in your follower list, or anyone who finds the post later, can decode the QR code and extract your PNR and name. This is the most common way boarding pass data is abused.
Leaving paper boarding passes behind
Paper boarding passes left on seats, in seat-back pockets, or dropped in airport trash cans are readable. Shred them — or at minimum, fold and tear them so the QR code is destroyed — before discarding.
Third-party booking sites and check-in services
Boarding passes issued through third-party travel apps — not the airline's own app — are generally still safe to scan at the gate, because the underlying QR code data is generated by the airline. However, be cautious about phishing emails impersonating airlines with fake boarding pass attachments. A fake boarding pass QR code that you scan on your phone (not at the gate) could redirect to a phishing login page. If you receive a boarding pass attachment and you did not book directly with the airline, open it only through the airline's official app or website — not by clicking links in the email.
Screenshots in your camera roll
If your phone is lost, stolen, or your cloud account is compromised, screenshots of boarding passes in your camera roll expose your travel history and PNR. Delete them after your trip.
How to protect your boarding pass data
- Never post boarding pass photos online — not even to show off a trip or business-class seat. The QR code is always visible even in casual photos.
- Shred paper boarding passes after your trip, or at minimum destroy the QR code portion before putting it in the trash.
- Delete screenshots from your camera roll after the flight lands. Your booking reference is no longer useful to you, but it may still work in the airline's system for weeks.
- Use the airline's official app rather than email attachments or third-party apps when possible — it minimizes the number of places your boarding pass data is stored.
- Enable PIN or biometric lock on your phone — this protects boarding passes and everything else in your camera roll from casual physical access.
If you are a frequent traveler with a large miles balance, treat your boarding pass with the same care you would give a password. The PNR printed on it — and encoded in the QR code — is a direct key to your booking and potentially your loyalty account.
For more on how QR codes are used in travel-related scams, see our guide to QR code scams at the airport.
Frequently asked questions
Are boarding pass QR codes safe to scan?
Yes — at the gate, boarding pass QR codes from airlines are safe. The gate scanner simply reads the encoded flight data to verify your seat. The privacy concern is not what happens when the airline scans your pass; it is what happens when anyone else scans it. The QR code encodes your name, PNR, and frequent flyer number, which together can give a stranger access to your booking on the airline's website. Protect your boarding pass the way you would protect a password.
What personal information is in a boarding pass QR code?
A standard airline boarding pass QR code contains your full name, airline, flight number, departure and arrival airports, departure date, seat assignment, passenger sequence number, booking reference (PNR), and often your frequent flyer number. With your name and PNR, anyone can access the airline's “manage my booking” portal and potentially view or alter your reservation, access passport details you have stored, or redeem frequent flyer miles. This is why you should never photograph and post your boarding pass publicly.
Can someone steal my identity from a boarding pass QR code?
A boarding pass QR code alone is unlikely to enable full identity theft, but it does expose your booking reference and frequent flyer account number. With those two pieces of data plus your name, a scammer can access the airline's website, view your upcoming trips, and in some cases drain or transfer your miles balance. Documented cases of miles theft after social media boarding pass posts are real. The risk is account-level fraud, not full identity theft — but it is still significant if you have a valuable miles balance. Shred paper passes and delete screenshots after your flight.
Scan smarter every time you travel.
QRsafer checks every QR code's destination against real-time threat databases the moment you point your camera — flagging phishing pages, fake login portals, and known scam domains before the page even loads. Replace your phone's default scanner and know instantly whether a code is safe, risky, or dangerous.