# UIC Rail Ticket

> Source: https://docs.barcoder.ai/docs/standards/uic-rail-ticket
> research date 2026-10-30 · extracted at 2026-10-30
> Publisher: Barcoder — encyclopedia of QR, barcode and payment-code standards

Specifications:
- [TAP TSI TD B.12 — Digital Security Elements for Rail Passenger Ticketing (ERA, V2.0, 2023)](https://www.era.europa.eu/system/files/2023-10/ERA-OPI-2023-4%20-%20ERA_Technical_Document_TAP_B_12.pdf)
- [UIC IRS 90918-9, ed. 2 — Digital Security Elements for Rail Passenger Ticketing (paid)](https://shop.uic.org/en/14274-digital-security-elements-for-rail-passenger-ticketing-9793.html)
- [UIC IRS 90918-8, ed. 2 — Layout for electronically issued rail passenger tickets (paid)](https://shop.uic.org/en/14382-layout-for-electronically-issued-rail-passenger-tickets.html)
- [TAP TSI Annex B.7 — International Rail Ticket for Home Printing (ERA, 2011, replaced)](https://www.era.europa.eu:443/system/files/2022-11/tap-tsi-technical_document_tap_b_7.pdf)
- [UIC-barcode — UIC's ASN.1 modules and Java library](https://github.com/UnionInternationalCheminsdeFer/UIC-barcode)
- [IANA media type application/vnd.uic.tlb-fcb](https://www.iana.org/assignments/media-types/application/vnd.uic.tlb-fcb)

## Overview

**UIC rail ticket barcodes** are the family of signed 2D barcodes that European railways use to check tickets offline. The International Union of Railways (UIC) defines them in **IRS 90918-9**, and the EU Agency for Railways publishes the matching text as **TAP TSI Technical Document B.12**. B.12 names four barcode types: the small fixed-field **SSB**, the PDF417-based **ELB**, the layout-text **TLB** (the "DST" barcode of the old UIC 918-3 leaflet) and the structured **FCB** <sup>[1][1]</sup>.

The ticket data is not secret. It sits in the barcode in the clear, and an issuer's private-key signature, called the "seal", shows that nobody has changed it <sup>[1][1]</sup>. [Aztec](https://docs.barcoder.ai/docs/standards/aztec) is the main carrier and PDF417 the legacy alternative. Germany's VDV-KA and Britain's RSP-6 are separate national formats that solve the same problem, and they are covered here because they meet UIC barcodes at the ticket gate.

## History

Rail tickets were long protected by "Security in Paper": special stock that only issuers could print on. This made internet sales hard, because the ticket had to be fulfilled on secured paper. "Security in Data" moved the protection into a signature that the checker can verify but cannot create <sup>[1][1]</sup>.

No fetched source names an inventor or designer of the format. The dates below come from the documents themselves:

- **2007.** B.12 says the UIC 918.2 ATBv2 specification already recommended 2048-bit keys that year <sup>[1][1]</sup>. The fetched sources do not give a reliable publication date for UIC 918-3 itself.
- **16 December 2008.** In Britain, Rail Settlement Plan approved RSPS3001, a common mobile and self-print barcode standard developed with Masabi <sup>[26][26]</sup> <sup>[27][27]</sup>.
- **5 May 2011.** ERA released **TAP TSI Annex B.7**, "International Rail Ticket for Home Printing", under Regulation (EU) 454/2011. It described three certificate mechanisms, including the Digitally Signed Ticket (DST), and fixed the 87-module Aztec symbol <sup>[2][2]</sup>.
- **1 March 2019.** UIC issued the first edition of IRS 90918-8, on ticket layout <sup>[8][8]</sup>.
- **January 2020 to June 2023.** B.12 V2.0 was drafted on 10 January 2020, corrected on 26 June 2020 and published on 6 June 2023. B.12 and B.11 replace B.6 and B.7, which separates security elements from layouts, because the same barcode can appear on paper, screen or secured stock <sup>[1][1]</sup>.
- **June to July 2022.** Edition 2 of IRS 90918-9 is dated 1 June 2022 (99 pages) and edition 2 of IRS 90918-8 is dated 1 July 2022 (229 pages) <sup>[6][6]</sup> <sup>[7][7]</sup>. UIC published its FCB factsheet on 14 June 2022 <sup>[5][5]</sup>.
- **23 December 2025.** IANA registered `application/vnd.uic.tlb-fcb`, maintained jointly by UIC and ERA <sup>[9][9]</sup>.

## Technical specification

### The four barcode types

| Type | Carrier | Size | Data model | Best suited to |
|---|---|---|---|---|
| **SSB** Small Structured Barcode | Aztec or PDF417 | Aztec: 41 × 41, 114 bytes. PDF417: 144 bytes | Fixed fields at bit positions, no tags | Small tickets and limited print space |
| **ELB** Element List Barcode | PDF417 | Up to 144 bytes | Fixed fields, character coded, defined by SNCF | Older PDF417-only printers |
| **TLB** Ticket Layout Barcode | Aztec | 87 × 87, up to 621 bytes | Printed ticket text with positions | Showing the ticket on a checker's screen |
| **FCB** Flexible Content Barcode | Aztec (PDF417 only for very little data) | Variable | Tagged ASN.1, optional fields | Machine checking, gates, multi-contract tickets |

All values are from B.12 <sup>[1][1]</sup>. It says PDF417 remains because many older printers and readers cannot handle Aztec, and it treats Aztec as the better of the two <sup>[1][1]</sup>. UIC's shop text keeps the PDF417 element-list chapter for railways that still use it, but advises against new development on it <sup>[6][6]</sup>.

### Aztec parameters

- **TLB:** 87 modules (17 layers), at most 621 bytes of binary data, a physical size of 50 × 50 mm and an element size of about 23 mil. For low-cost inkjet printers, B.12 gives 25 mil as the optimal recommendation and 15 mil as the minimal one <sup>[1][1]</sup>.
- **SSB:** 6 layers, 41 × 41 modules, 24 × 24 mm, 0.59 mm per module and at least 150 dpi <sup>[1][1]</sup>.
- **FCB:** the number of modules follows from the message size <sup>[1][1]</sup>.
- **Error correction:** 23 % for all three. B.12 calls this "an absolute need" for reading in difficult conditions on a train <sup>[1][1]</sup>.

### Message structure (TLB and FCB)

TLB and FCB share one envelope, so a single Aztec symbol can carry both, plus domestic records. B.12 lists the permitted combinations, and the minimum is the envelope with either U_HEAD + U_TLAY or U_FLEX <sup>[1][1]</sup>.

| Part | Content |
|---|---|
| `#UT` | Message type, for "UIC Ticket" |
| Version | `01` or `02` |
| Company code | 4 digits, the RICS code of the signing railway |
| Key ID | 5 characters, managed by the signer |
| Signature | V1: 50 bytes of ASN.1, null-padded. V2: `r` and `s`, 32 bytes each, null-padded |
| Length | 4 digits, the length of the compressed message |
| Compressed message | The record sequence, compressed with DEFLATE |

Structurally illustrative only, not a real ticket:

```text
#UT 02 <company> <key id> <r> <s> <length> <DEFLATE(records)>
```

Every record starts with a 6-character ID, a 2-digit version and a 4-digit length <sup>[1][1]</sup>. The records are:

- **U_HEAD** holds the company code, a ticket key unique per issuer, the issue time as `DDMMYYYYHHMM`, flags and languages <sup>[1][1]</sup>.
- **U_TLAY** holds the ticket as text fields, each with line, column, height, width and formatting. A line runs from 0 to 14 and a column from 0 to 71. For international tickets the layout standard must be RCT2. A reader needs no code lists, because everything is readable from the barcode, but the result is text for a person rather than data for a machine <sup>[1][1]</sup>.
- **U_FLEX** holds the FCB data, described below <sup>[1][1]</sup>.
- **Company records** use a 4-digit company code and 2 free characters as the ID. B.12's example is `1180XY` for DB. Their contents are outside the standard <sup>[1][1]</sup>.

The order matters for compatibility. A reader built for the older TLB rules skips any record it does not know, so a barcode with both TLB and FCB still works on old devices <sup>[1][1]</sup>.

Text fields use UTF-8. Fixed-length fields are limited to printable characters U+0020 to U+007E, and length fields count encoded bytes, not characters <sup>[1][1]</sup>.

### FCB

FCB encodes its data as ASN.1 using **PER unaligned**, so an unused optional element costs 1 bit. Data can be held as codes or as text, for example a station code or a full station name, and the parties agree which to use. A barcode can hold the full contract ("security in data"), only an identifier for a server lookup ("security in server"), or a mix of the two <sup>[1][1]</sup>.

UIC publishes the ASN.1 modules openly. The `uicRailTicketData` module runs through versions 1.3, 2.0 and 3.0 in the repository's listing, with v3 the latest linked from its README <sup>[10][10]</sup>. The code is dual-licensed under EUPL 1.2 or later and Apache 2.0 <sup>[41][41]</sup>.

### Static and dynamic barcodes (DOSIPAS)

UIC's repository labels its barcode-header branch **DOSIPAS**. No fetched source expands the acronym <sup>[13][13]</sup>. The header replaces the `#UT` envelope with a PER-encoded `UicBarcodeHeader`:

- A `format` string, `U2` in the v2 module.
- **Level 1 data:** security provider, key ID, algorithm identifiers, end of validity and a list of data blocks, signed by the issuer.
- **Level 2 data:** an optional block signed with a second key whose public part is carried in level 1 <sup>[11][11]</sup>.

A static barcode needs only the level 1 signature. A dynamic barcode adds the level 2 fields and signature, and a `validityDuration` of 1 to 3600 seconds ties it to the time stamp in the dynamic content <sup>[11][11]</sup>. That content, tagged `FDCn`, can hold a time stamp, app ID, location and responses to a checker's challenge <sup>[12][12]</sup>. Data blocks tagged `FCBn` hold ticket data <sup>[11][11]</sup>. UIC says static barcodes work on paper or screen, while dynamic ones change every few seconds, work only on screen and help against copy fraud <sup>[5][5]</sup>.

### Signature ("seal")

B.12 uses "encrypted seal" and "DSA encrypt" for what is a digital signature: a SHA hash of the header and open data, signed with the issuer's private key, producing the integers `r` and `s` <sup>[1][1]</sup>.

| Barcode version | Algorithm |
|---|---|
| TLB/FCB V1 | SHA-1 with DSA-1024 or DSA-512, ASN.1 structured |
| TLB/FCB V2 | SHA-224 or SHA-256 with DSA-2048, `r` and `s` stored separately |
| SSB | SHA-1 with DSA-512 or DSA-1024, or SHA-224 with DSA-2048 |

B.12 calls the SHA-160 variants legacy and says the DSA-2048 variants can be used up to 2030. It also proposes to keep allowing DSA-1024 with SHA-224, because 2048-bit support lagged, so the two passages sit awkwardly together <sup>[1][1]</sup>. UIC's factsheet and header module add ECDSA, and the module's examples name ECDSA-256 and the P-256 curve <sup>[4][4]</sup> <sup>[11][11]</sup>.

Issuers should generate a new key pair at least every 18 months and publish the certificate at least 3 months before use. Key validity periods must overlap by at least the longest ticket validity, minus one day <sup>[1][1]</sup>. UIC runs the Public Key Management Website, which distributes the public keys that checkers need <sup>[15][15]</sup>. Test keys have IDs starting with `TT`, and a ticket signed with one is never valid, even if its specimen flag is unset <sup>[1][1]</sup>.

### Checking a ticket

The checker reads the symbol, decompresses the content, verifies the signature using the public key that the header identifies, and then displays the result. For TLB this is the printed layout, and for FCB the structured data is interpreted first <sup>[1][1]</sup>. The signature check can run alongside display, so staff can already read the route and class while it completes <sup>[1][1]</sup>. Deutsche Bahn publishes sample tickets for testing control devices, for both 918.3 and 918.9 <sup>[16][16]</sup>.

### National variants

**Germany: UIC 918-3\* and 918-9.** DB's online tickets follow UIC 918-3 and 918-9, and DB is moving to 918-9. Its 0080VU segment carried VDV-KA data inside a UIC barcode for tickets valid on both DB and local transport. For the Deutschland-Ticket, that data moves into a UIC 918-9 structure instead <sup>[16][16]</sup>. The open-source parser uic-918-3 names 0080BL, DB's container for proof-of-payment data, and warns that its logic rests on third-party sources because the UIC specifications are not free <sup>[19][19]</sup>.

**Germany: VDV-KA.** The VDV core application covers chip cards and barcodes, and its specifications are limited to VDV members <sup>[18][18]</sup>. The public Deutschlandticket guide describes three channels: chip card, the Motics ticket and the VDV-Barcode. The barcode channel is governed by the KA STB-SPEC, uses a tag-length-value product structure and reserves product numbers such as 9999 (subscription) and 9998 (job ticket). Because a VDV-Barcode can be copied, its validity is capped at one month, and staff must compare the passenger's name with an ID. The Motics channel is treated as uncopyable and may run for two years or more <sup>[17][17]</sup>. No fetched source states the VDV signature algorithm or names the standalone VDV-Barcode's symbology. The ticket-decoder project handles VDV data but calls its interpreter partial <sup>[21][21]</sup>.

**United Kingdom: RSP-6.** This is a separate format, not a UIC profile. A blogger's reverse engineering from January 2023 reports an Aztec symbol whose text starts `06`, followed by a short plain prefix and a base-26 block. The block is an RSA-signed message that contains the payload itself, which saves barcode space. The official specification is not public, and a Freedom of Information request for it went unanswered <sup>[28][28]</sup>. A 2026 Rail Engineer article describes keys held in a Rail Delivery Group repository and PKCS#1 v1.5 RSA checks, but its author is a developer writing about his own app, not the specification owner <sup>[29][29]</sup>. Masabi's 2008 announcement cites 1024-bit RSA <sup>[27][27]</sup>. No fetched source states outright that RSP-6 is the current form of RSPS3001, though the author reports Masabi's claim to have written RSP-6 <sup>[28][28]</sup>.

**Other railways.** These notes are community observations, often flagged as outdated:

- **Spain:** a 516-byte common Aztec with an RSA signature, alongside a 56-byte Renfe format in DataMatrix or QR <sup>[33][33]</sup>.
- **Finland:** VR's 107-byte Aztec follows ERA SSB version 1, with deviations <sup>[35][35]</sup>.
- **France:** SNCF uses Aztec and PDF417, and Normandie tickets use DOSIPAS with FCB <sup>[32][32]</sup>.
- **Poland:** PKP's barcode uses the 918.3 container, but its U_TLAY record claims RCT2 without following it <sup>[34][34]</sup>.
- **Austria:** ÖBB's company record is a simple JSON string under payload type 118199 <sup>[18][18]</sup>.

## Use cases

- **International rail tickets.** B.12 covers integrated reservation tickets, non-reservation tickets, group tickets and boarding passes. A company may sell international tickets only under agreements that let every checking organisation read the security element <sup>[1][1]</sup>.
- **Rail passes.** The SSB ticket types include InterRail and Eurail passes <sup>[1][1]</sup>.
- **Home printing and phone tickets.** B.7 was written for tickets printed at home after an internet sale, and UIC notes that barcodes need no secured paper <sup>[2][2]</sup> <sup>[4][4]</sup>.
- **Station gates and platforms.** FCB defines use cases for opening platform and station gates. Govia Thameslink reported in November 2023 that it had fitted 1,420 barcode readers across 710 gates at 98 stations in Britain <sup>[1][1]</sup> <sup>[31][31]</sup>.
- **Non-ticket rail services.** FCB can cover parking, delay confirmation, customer cards and a "digital stamp" annotation <sup>[1][1]</sup>.
- **Local public transport.** The Deutschlandticket links UIC and VDV data structures <sup>[16][16]</sup> <sup>[17][17]</sup>.
- **Travel-app extraction.** KDE's KItinerary project documents these barcodes for its travel-data extraction system, and a 38C3 talk began with moving tickets into Apple Wallet <sup>[18][18]</sup> <sup>[38][38]</sup> <sup>[25][25]</sup>.

## Implementations

| Project | Lang | Stars | Last active | Notes |
|---|---|---|---|---|
| [UIC-barcode](https://github.com/UnionInternationalCheminsdeFer/UIC-barcode) | Java | 56 | 2026-10 | UIC's own ASN.1 modules and library for TLB, FCB, SSB and DOSIPAS. It encodes and decodes content. Producing the image is left to a library such as ZXing <sup>[10][10]</sup> <sup>[14][14]</sup> |
| [uic-918-3](https://github.com/justusjonas74/uic-918-3) | TypeScript | 49 | 2026-10 | Node.js parser with optional signature checking and experimental U_FLEX support <sup>[19][19]</sup> |
| [ticket-decoder](https://github.com/user4223/ticket-decoder) | C++ | 34 | 2026-10 | Detects Aztec codes with OpenCV and zxing-cpp, and outputs JSON <sup>[21][21]</sup> |
| [onlineticket](https://github.com/rumpeltux/onlineticket) | Python | 76 | 2024-04 | DB ticket parser. Its 2010 proof of concept was mostly reverse engineered <sup>[20][20]</sup> |
| [kitinerary](https://github.com/KDE/kitinerary) | C++ | 49 | 2026-10 | KDE's travel data extraction system <sup>[38][38]</sup> |

For RSP-6, the Rust crate rsp6-decoder 0.1.0 (19 January 2023) is hosted outside GitHub at git.eta.st <sup>[30][30]</sup>.

## Comparison

- **TLB vs FCB.** TLB is simple for readers, because no code lists are needed, but it only supports showing the ticket to a person. FCB can be checked by machine and holds more kinds of contract, but readers need reference data. Choose TLB for inspector display, FCB for automation, or both in one symbol during a migration <sup>[1][1]</sup>.
- **SSB vs FCB.** B.12 says to use SSB only where space for an FCB is not available, because it stores only the bare minimum <sup>[1][1]</sup>.
- **UIC vs [IATA BCBP](https://docs.barcoder.ai/docs/standards/iata-bcbp).** BCBP carries structured ASCII fields and allows four symbologies <sup>[39][39]</sup>. UIC's TLB and FCB add compression and normally use Aztec, and their signature is what makes offline checking possible <sup>[1][1]</sup>.
- **UIC vs VDV-KA.** Reporting by heise calls the UIC route the simpler static barcode, and VDV-KA more complex, with central key management, secure signing modules and central recording of issued tickets <sup>[22][22]</sup>.
- **UIC vs RSP-6.** Both use Aztec and asymmetric signatures, but the formats are unrelated. UIC uses detached DSA or ECDSA signatures with a public envelope, and a public key directory. RSP-6 reportedly embeds its payload in an RSA signature, with no published specification <sup>[1][1]</sup> <sup>[28][28]</sup>.
- **UIC vs [Apple PKPass](https://docs.barcoder.ai/docs/standards/apple-pkpass).** A pass is a container that embeds a barcode, not a symbology <sup>[40][40]</sup>. The two are complementary.

## Fun facts

- B.12 compares adding FCB to TLB with the arrival of colour television: the new signal was added so that black-and-white sets kept working unchanged <sup>[1][1]</sup>.
- B.12's own figure labels the QR code "not used in international Rail Ticketing", and the text says QR is uncommon in rail because of technical limitations <sup>[1][1]</sup>.
- A TLB on secured paper can show "ON CIT PAPER" on the checker's screen, to reveal a copy shown on a phone <sup>[1][1]</sup>.

## Security incidents

The signature protects the ticket only while the private key stays private. In 2025, heise reported that an unauthorised site, d-ticket.su, sold Deutschlandtickets for months using a valid key, and that DB found about 50,000 suspicious tickets in its control logs. It also reported that in that system, transport companies generate their own private keys, and that TÜV Rheinland had flagged gaps in public key infrastructure and revocation lists at the end of 2023. How the key was obtained is unclear <sup>[22][22]</sup>. A 39C3 talk on 27 December 2025 covered the same site and direct-debit fraud, and said many systems cannot revoke such tickets <sup>[23][23]</sup>. VDV eTicket Service's managing director said in March 2025 that there had been no mechanism to cancel barcode tickets, and promoted Motics because it prevents copying <sup>[24][24]</sup>.

## Status

**Active.** IRS 90918-9 edition 2 and TAP TSI TD B.12 are the current texts in the sources fetched. UIC's shop describes leaflets 918-2 and 918-3 as decommissioned, and 918-3 as integrated into IRS 90918-9 <sup>[6][6]</sup> <sup>[7][7]</sup>. UIC's FCB page confirms IRS 90918-9, and also points to the key service <sup>[3][3]</sup>. UIC describes FCB as its most modern barcode standard, and said in 2022 that railways were deploying it <sup>[4][4]</sup> <sup>[5][5]</sup>. The Train Ticket Wiki says TLB is "mostly used at the moment" and places DOSIPAS on TER tickets in some French regions, but both pages are stubs <sup>[36][36]</sup> <sup>[37][37]</sup>.

The UIC-barcode repository was last pushed on 1 October 2026, and its OID register lists a draft v3 header <sup>[10][10]</sup> <sup>[13][13]</sup>. The DSA end date of 2030 in B.12 suggests a signature migration ahead <sup>[1][1]</sup>.

## Sources

[1]: https://www.era.europa.eu/system/files/2023-10/ERA-OPI-2023-4%20-%20ERA_Technical_Document_TAP_B_12.pdf
[2]: https://www.era.europa.eu:443/system/files/2022-11/tap-tsi-technical_document_tap_b_7.pdf
[3]: https://uic.org/passenger/passenger-services-group/article/fcb-flexible-content-barcode
[4]: https://uic.org/media-files/spip/documents/uic-passenger-flexible-content-barcode.pdf
[5]: https://uic.org/com/enews/article/uic-publishes-new-factsheet-on-the-flexible-content-barcode-fcb
[6]: https://shop.uic.org/en/14274-digital-security-elements-for-rail-passenger-ticketing-9793.html
[7]: https://shop.uic.org/en/14382-layout-for-electronically-issued-rail-passenger-tickets.html
[8]: https://eshop.normservis.sk/norma/irs-90918-8-1ed--1.3.2019.html
[9]: https://www.iana.org/assignments/media-types/application/vnd.uic.tlb-fcb
[10]: https://github.com/UnionInternationalCheminsdeFer/UIC-barcode
[11]: https://raw.githubusercontent.com/UnionInternationalCheminsdeFer/UIC-barcode/master/asn-specs/uicBarcodeHeader_v2.0.1.asn
[12]: https://raw.githubusercontent.com/UnionInternationalCheminsdeFer/UIC-barcode/master/asn-specs/uicDynamicContentData_v1.0.5.asn
[13]: https://raw.githubusercontent.com/UnionInternationalCheminsdeFer/UIC-barcode/master/oid.md
[14]: https://github.com/UnionInternationalCheminsdeFer/UIC-barcode/wiki
[15]: https://railpublickey.uic.org
[16]: https://www.bahn.de/p/view/angebot/regio/barcode.shtml
[17]: https://www.kcd-nrw.de/fileadmin/user_upload/Technische_Anforderung_Deutschlandticket_V1.5.pdf
[18]: https://community.kde.org/KDE_PIM/KItinerary/Barcode_Formats
[19]: https://github.com/justusjonas74/uic-918-3
[20]: https://github.com/rumpeltux/onlineticket
[21]: https://github.com/user4223/ticket-decoder
[22]: https://heise.de/-10376596
[23]: https://api.events.ccc.de/congress/2025/event/a2dd3dc7-ecae-50b3-82d9-266ad02f7a40/?format=api
[24]: https://railwaygazette.com/technology/deutschlandticket-retailers-take-on-the-cyber-mafia/68445.article
[25]: https://pretalx.c3voc.de/38c3/talk/802/
[26]: https://www.masabi.com/news/uk-rail-agrees-mobile-ticketing-standard/
[27]: https://www.masabi.com/news/new-mobile-barcode-tickets-for-uk-rail/
[28]: https://eta.st/2023/01/31/rail-tickets.html
[29]: https://www.railengineer.co.uk/the-machine-truth-of-rail-ticketing/
[30]: https://docs.rs/crate/rsp6-decoder/latest
[31]: https://www.mynewsdesk.com/uk/gtr/pressreleases/eticket-readers-speed-rail-passengers-through-every-single-ticket-gate-on-gtr-network-3289634
[32]: https://community.kde.org/KDE_PIM/KItinerary/SNCF_Barcodes
[33]: https://community.kde.org/KDE_PIM/KItinerary/Renfe_Barcodes
[34]: https://community.kde.org/KDE_PIM/KItinerary/PKP_Barcode
[35]: https://community.kde.org/KDE_PIM/KItinerary/vr.fi_Barcode
[36]: https://trainticket.wiki/ticket-standards/uic-standards/dosipas.html
[37]: https://trainticket.wiki/ticket-standards/uic-standards/tlb.html
[38]: https://github.com/KDE/kitinerary
[39]: https://docs.barcoder.ai/source/standards/iata-bcbp
[40]: https://docs.barcoder.ai/source/standards/apple-pkpass
[41]: https://raw.githubusercontent.com/UnionInternationalCheminsdeFer/UIC-barcode/master/LICENSE.txt

[1] [Technical document TAP TSI TD B.12: Digital Security Elements for Rail Passenger Ticketing, V2.0](https://www.era.europa.eu/system/files/2023-10/ERA-OPI-2023-4%20-%20ERA_Technical_Document_TAP_B_12.pdf) — EU Agency for Railways, 2023
[2] [TAP TSI Annex B.7: International Rail Ticket for Home Printing, V1.1](https://www.era.europa.eu:443/system/files/2022-11/tap-tsi-technical_document_tap_b_7.pdf) — European Railway Agency, 2011
[3] [FCB: Flexible Content Barcode](https://uic.org/passenger/passenger-services-group/article/fcb-flexible-content-barcode) — UIC, accessed 2026
[4] [FCB: Flexible Content Barcode factsheet](https://uic.org/media-files/spip/documents/uic-passenger-flexible-content-barcode.pdf) — UIC Passenger Department, 2022
[5] [UIC publishes new factsheet on the Flexible Content Barcode (FCB)](https://uic.org/com/enews/article/uic-publishes-new-factsheet-on-the-flexible-content-barcode-fcb) — UIC eNews, 2022
[6] [IRS 90918-9, Digital Security Elements for Rail Passenger Ticketing, ed. 2](https://shop.uic.org/en/14274-digital-security-elements-for-rail-passenger-ticketing-9793.html) — UIC shop, accessed 2026
[7] [IRS 90918-8, Layout for electronically issued rail passenger tickets, ed. 2](https://shop.uic.org/en/14382-layout-for-electronically-issued-rail-passenger-tickets.html) — UIC shop, accessed 2026
[8] [IRS 90918-8, 1st edition, 1.3.2019](https://eshop.normservis.sk/norma/irs-90918-8-1ed--1.3.2019.html) — Normservis catalogue, accessed 2026
[9] [Media type application/vnd.uic.tlb-fcb](https://www.iana.org/assignments/media-types/application/vnd.uic.tlb-fcb) — IANA, 2025
[10] [UIC-barcode repository](https://github.com/UnionInternationalCheminsdeFer/UIC-barcode) — UIC, accessed 2026
[11] [uicBarcodeHeader ASN.1 module](https://raw.githubusercontent.com/UnionInternationalCheminsdeFer/UIC-barcode/master/asn-specs/uicBarcodeHeader_v2.0.1.asn) — UIC, accessed 2026
[12] [uicDynamicContentData ASN.1 module](https://raw.githubusercontent.com/UnionInternationalCheminsdeFer/UIC-barcode/master/asn-specs/uicDynamicContentData_v1.0.5.asn) — UIC, accessed 2026
[13] [OID register](https://raw.githubusercontent.com/UnionInternationalCheminsdeFer/UIC-barcode/master/oid.md) — UIC, accessed 2026
[14] [UIC-barcode wiki](https://github.com/UnionInternationalCheminsdeFer/UIC-barcode/wiki) — UIC, accessed 2026
[15] [Public Key Management Website](https://railpublickey.uic.org) — UIC, accessed 2026
[16] [Barcode information for control devices](https://www.bahn.de/p/view/angebot/regio/barcode.shtml) — Deutsche Bahn, accessed 2026
[17] [Technische Anforderung Deutschlandticket, V1.5](https://www.kcd-nrw.de/fileadmin/user_upload/Technische_Anforderung_Deutschlandticket_V1.5.pdf) — VDV eTicket Service, 2023
[18] [KItinerary: Barcode Formats](https://community.kde.org/KDE_PIM/KItinerary/Barcode_Formats) — KDE Community Wiki, accessed 2026
[19] [uic-918-3](https://github.com/justusjonas74/uic-918-3) — GitHub, accessed 2026
[20] [onlineticket](https://github.com/rumpeltux/onlineticket) — GitHub, accessed 2026
[21] [ticket-decoder](https://github.com/user4223/ticket-decoder) — GitHub, accessed 2026
[22] [Rail Industry Risks Deutschlandticket: Potential Damages Up to €500 Million](https://heise.de/-10376596) — heise online, 2025
[23] [All my Deutschlandtickets gone: Fraud at an industrial scale](https://api.events.ccc.de/congress/2025/event/a2dd3dc7-ecae-50b3-82d9-266ad02f7a40/?format=api) — 39C3 schedule, Chaos Computer Club, 2025
[24] [Deutschlandticket retailers take on the cyber mafia](https://railwaygazette.com/technology/deutschlandticket-retailers-take-on-the-cyber-mafia/68445.article) — Railway Gazette, 2025
[25] [What's inside my train ticket?](https://pretalx.c3voc.de/38c3/talk/802/) — 38C3, 2024
[26] [UK rail agrees mobile ticketing standard](https://www.masabi.com/news/uk-rail-agrees-mobile-ticketing-standard/) — Masabi, 2008
[27] [New mobile barcode tickets for UK rail](https://www.masabi.com/news/new-mobile-barcode-tickets-for-uk-rail/) — Masabi, 2008
[28] [Reversing UK mobile rail tickets](https://eta.st/2023/01/31/rail-tickets.html) — eta.st, 2023
[29] [The machine truth of rail ticketing](https://www.railengineer.co.uk/the-machine-truth-of-rail-ticketing/) — Rail Engineer, 2026
[30] [rsp6-decoder 0.1.0](https://docs.rs/crate/rsp6-decoder/latest) — docs.rs, 2023
[31] [eTicket readers speed rail passengers through every single ticket gate on GTR network](https://www.mynewsdesk.com/uk/gtr/pressreleases/eticket-readers-speed-rail-passengers-through-every-single-ticket-gate-on-gtr-network-3289634) — Govia Thameslink Railway, 2023
[32] [KItinerary: SNCF Barcodes](https://community.kde.org/KDE_PIM/KItinerary/SNCF_Barcodes) — KDE Community Wiki, accessed 2026
[33] [KItinerary: Renfe Barcodes](https://community.kde.org/KDE_PIM/KItinerary/Renfe_Barcodes) — KDE Community Wiki, accessed 2026
[34] [KItinerary: PKP Barcode](https://community.kde.org/KDE_PIM/KItinerary/PKP_Barcode) — KDE Community Wiki, accessed 2026
[35] [KItinerary: vr.fi Barcode](https://community.kde.org/KDE_PIM/KItinerary/vr.fi_Barcode) — KDE Community Wiki, accessed 2026
[36] [DOSIPAS](https://trainticket.wiki/ticket-standards/uic-standards/dosipas.html) — Train Ticket Wiki, accessed 2026
[37] [TLB](https://trainticket.wiki/ticket-standards/uic-standards/tlb.html) — Train Ticket Wiki, accessed 2026
[38] [kitinerary](https://github.com/KDE/kitinerary) — GitHub, accessed 2026
[39] [IATA BCBP](https://docs.barcoder.ai/source/standards/iata-bcbp) — Barcoder research report, 2026
[40] [Apple PKPass](https://docs.barcoder.ai/source/standards/apple-pkpass) — Barcoder research report, 2026
[41] [UIC-barcode LICENSE.txt](https://raw.githubusercontent.com/UnionInternationalCheminsdeFer/UIC-barcode/master/LICENSE.txt) — UIC, accessed 2026

## Deployments

_No country reports mention this standard by name._

## Regions / aggregations not mapped to a single country

- Europe