Reading a PDF417 barcode

Flip over almost any North American driver's licence or provincial ID card and you'll find a dense, rectangular barcode on the back — rows of black and white bars packed tightly together. That's a PDF417 barcode, and it is one of the most useful pieces of an ID document, because it repeats, in a machine-readable form, most of the information printed on the front. This post explains what's actually in it, the standard that defines it, and how it's used alongside the printed side to verify a document.

What PDF417 actually is

PDF417 is a stacked linear barcode format — “PDF” stands for Portable Data File, and “417” refers to the structure of each encoded symbol (4 bars and spaces, 17 units wide). It can hold far more data than a simple 1-D barcode like the kind on a grocery item: names, addresses, dates, document numbers, physical descriptors, all in one scan. It's the format North American driver's licences and ID cards use because it packs a meaningful amount of structured text into a small, printable space that a standard scanner or camera can decode without special hardware.

The AAMVA standard

The specific way that data is organized inside the barcode — which fields appear, in what order, using what codes — is defined by AAMVA, the American Association of Motor Vehicle Administrators. The AAMVA standard is what lets a barcode scanner decode a Nova Scotia licence and a California licence the same way, even though the two cards look different and are printed by different provincial and state authorities. Each issuer implements the AAMVA structure with its own jurisdiction-specific details, which is why reliable barcode reading needs to recognize the issuer first, then apply that issuer's exact version of the standard.

Part of decoding a barcode correctly is identifying who issued it. Every AAMVA-compliant barcode carries an IIN — an Issuer Identification Number — a short numeric code that identifies the specific licensing authority that produced the card. ShieldID's document reading recognizes all 13 Canadian provinces and territories and the great majority of US states, territories and DC by their barcode issuer identification, with emerging coverage of some Mexican states as well, so the barcode itself tells the system which jurisdiction's field layout to expect before it even reads the data.

What's actually encoded

A typical AAMVA barcode on a driver's licence encodes structured fields including the holder's full legal name, date of birth, address, document/licence number, issue and expiry dates, sex, height, eye colour, and licence class or restrictions, depending on the issuer. None of this is a photo — the barcode is text data, not an image — which is exactly why it's useful as a second, independent source for the same facts that are printed on the front of the card.

Why cross-checking the barcode against the front matters

The printed front of a card, the PDF417 barcode on the back, and — for passports — the MRZ (machine-readable zone) at the bottom of the photo page are three separate representations of largely the same information, produced through different printing and encoding processes. ShieldID reads all of them and checksums and cross-checks the results field by field, rather than trusting a single source. If the name in the barcode doesn't match the name printed on the front, or a checksum embedded in the MRZ doesn't validate, that's flagged as its own signal — a per-field discrepancy, not folded silently into one overall pass or fail.

This is also why an unfamiliar or non-standard document is not simply refused. If a barcode is unreadable but the printed front and a passport MRZ (where applicable) still check out, the system reports what it could verify and what it couldn't, field by field, rather than rejecting the whole document because one of three sources didn't cooperate. A landlord, a lender or a compliance lead sees exactly which piece of data has confidence behind it and which doesn't — which is a more useful answer than a single opaque yes or no.

Why this matters for fraud

Forging a barcode that matches a fraudulent front-of-card design correctly, in the exact AAMVA layout for the claimed issuer, with checksums that validate, is a meaningfully harder problem than altering a printed name or photo alone. Cross-checking three independent sources — print, barcode, and MRZ where applicable — against each other is one of the more effective, least glamorous tools in document verification: it doesn't rely on spotting a visually altered image, it relies on catching the places where a forgery's different layers disagree with each other.