Barcode Scanning
Barcode scanning is the decoding of a printed symbol into the data it encodes. The technology is old, standardized and extremely reliable — and the property that matters for identity verification is what it does not do: a barcode carries no authentication of who produced it, so decoding one tells you what it says and nothing about whether to believe it.
| One-dimensional | Code 128, Code 39, EAN and UPC — a line of bars, limited capacity |
| Two-dimensional | PDF417, QR, Data Matrix, Aztec — a matrix, far higher capacity |
| Error correction | Built into 2D symbologies; damaged codes still decode correctly |
| On identity documents | PDF417 on U.S. driver’s licenses, encoding a defined field set |
| Capacity comparison | A retail barcode holds a product number; PDF417 holds a full record |
| What it guarantees | That the data was decoded correctly |
| What it does not guarantee | That the data is true, or that the encoder was legitimate |
| Verification value | Cross-referencing against the printed fields on the same document |
One-dimensional and two-dimensional
| 1D (linear) | 2D (matrix) | |
|---|---|---|
| Examples | UPC, EAN, Code 128, Code 39 | PDF417, QR, Data Matrix, Aztec |
| Typical capacity | A dozen or so characters | Hundreds to thousands |
| Usually encodes | A reference to look up elsewhere | The data itself |
| Error correction | Minimal — a check digit | Substantial — damaged codes recover |
| Reading requirement | A line across the bars | The whole symbol, at any rotation |
| Identity document use | Rare | PDF417 on driver’s licenses; QR on some national cards |
The capacity difference changes what a barcode is for. A retail barcode is a pointer — it identifies a product so a system can look up the price. A 2D barcode on an identity document is the record: name, date of birth, document number, address, issue and expiry all encoded directly, readable without any connection to a database.
That self-contained property is why 2D symbologies appear on documents at all. A roadside check or a bar door has no database access, and a PDF417 barcode works offline.
Why decoding is not verifying
This is the distinction the page exists to make, and it is the same one drawn under QR code scanning and data extraction.
A barcode is a container. Anyone can encode anything into one, and the symbology has no concept of who did it. A barcode generated five minutes ago with fabricated details decodes exactly as cleanly as one printed by a state licensing agency — error correction intact, check digits valid, format correct. Every quality signal the format provides is about transmission fidelity, not truth.
What makes a barcode useful in verification is therefore not the barcode. It is the comparison. The same information appears on the printed face of the document and in the encoded data, so:
Agreement means either the document is genuine or someone regenerated the barcode to match their alterations — which is a meaningfully higher bar than editing a photograph.
Disagreement means the document has been altered, and that conclusion requires no forensic analysis, no special hardware and no database. It is the cheapest strong signal available in document verification.
Why this matters for identity verification
Barcode reading is the most reliable part of document capture, and that reliability is exactly why it gets over-trusted. The data is clean, well-formatted and arrives with high confidence, so it flows downstream looking authoritative — when all that has been established is that a barcode was read correctly.
A system that decodes the barcode and stops has performed extraction on an unverified object. The work that makes it evidence is the cross-check against the printed fields, the security features check on the document itself, and where a chip is present, verifying a signature that a barcode fundamentally cannot carry.
That is the division identity document verification has to maintain, and why identity verification built on barcode reading alone has automated transcription rather than verification.
What barcode scanning can’t do
It does not authenticate the encoder. The format carries no proof of origin, so a fabricated barcode decodes as cleanly as a genuine one.
Error correction is not validation. It recovers damaged symbols; it says nothing about whether the content is true.
It cannot detect a replaced code. A newly printed barcode is a perfectly valid barcode.
It does not read what is not there. Many identity documents worldwide carry no barcode at all, so a system depending on one has no path for them.
Frequently asked questions
What is the difference between 1D and 2D barcodes?
One-dimensional barcodes are lines of bars holding roughly a dozen characters, usually a reference to be looked up elsewhere. Two-dimensional barcodes such as PDF417 and QR are matrices holding hundreds or thousands of characters, enough to encode a full record readable without any database connection.
Is the barcode on an ID document secure?
The decoding is reliable, and the format provides no security. A barcode carries no authentication of who encoded it, so one generated with fabricated details decodes exactly as cleanly as one printed by a licensing agency. Its verification value comes from cross-referencing against the printed fields, not from the barcode itself.
Why do identity documents use PDF417?
Because it holds enough data to encode a full record directly rather than a reference, and it works offline. A roadside check or a venue door has no database access, so a self-contained encoding is what makes the document useful where it is actually presented.
What does a mismatch between the barcode and the printed text mean?
That the document has been altered. It is the cheapest strong signal available in document verification, because reaching that conclusion needs no forensic image analysis, no special hardware and no database lookup — only reading both and comparing.
Related reading
- PDF417 — the symbology on U.S. driver’s licenses, in detail
- QR code scanning — the other 2D symbology, and where signed payloads change the picture
- Machine-readable zone — the passport equivalent, with check digits that validate the read
- Data extraction — the wider operation, and why structure determines reliability
