bcbp

Overview ¶

Package bcbp decodes an IATA Bar Coded Boarding Pass (Resolution 792) — the text string encoded in the PDF417 / Aztec / QR barcode on a boarding pass. Boarding passes are routinely photographed, posted to social media and discarded intact; the barcode leaks the passenger name, the booking reference (PNR — which on many airline sites is enough, with the surname, to open the full reservation), the itinerary, seat, check-in sequence and frequent-flyer number. Decoding it is a core travel-OSINT / privacy-exposure check (companion to the MRZ decoder).

Wrap-vs-native judgement ¶

Native. The BCBP format is a fixed, fully-public layout (IATA
Resolution 792): a small header, then per flight leg a block of
fixed-width mandatory fields terminated by a hex field-size marker
that delimits the variable "conditional" (airline-use) section.
The structure is self-describing via those length markers, so
parsing is substring slicing driven by the declared sizes — no
dependency is justified. stdlib only, no new go.mod dep.

Verifiable / no confidently-wrong output ¶

The mandatory fields are fixed-width and were verified against the
canonical IATA Resolution 792 example boarding pass. Because every
leg's conditional section is length-prefixed, the leg boundaries
are found from the declared sizes rather than guessed, so a
multi-leg pass cannot be mis-sliced. The variable / conditional
(airline-use) section is surfaced as a RAW string rather than
decoded field-by-field — its sub-field layout is version-dependent
and airline-extensible, so guessing it would risk confidently-wrong
output; the high-value mandatory fields (name, PNR, route, flight,
seat) are the ones bodied out. The flight date is a day-of-year
(Julian) number with NO year, so it is surfaced as the raw day
count (1-366) and not resolved to a calendar date.