What’s in that USPS postage barcode?

I am publishing this post as a hobbyist, because I find barcodes cool (as demonstrated by a prior open source project using 2D barcodes that I worked on). Do not attempt to use this information for any illegitimate purpose. Counterfeiting postage is a federal crime. 18 U.S.C. § 501.

Blogs don’t really have to be about a single theme, but it’s nice when they let the blogger’s personality shine through. This post ties together some of my favourite things: 2D barcodes, high speed automation, printers, cryptographic signatures (!), postal mail and postage, fraud prevention, and even a little bit about patents! If you know me at all, you’ll understand why I find this stuff so ridiculously cool.

Background: printing stamps at home

Did you know that you can literally print your own postage? You have to pay for the value of the postage, of course, but with the right thermal printer and USPS-approved labels, there are “PC postage” services like pbSmartPostage (by Pitney Bowes, the same company that makes commercial postage meters and mailroom equipment for big businesses) and Endicia.com that will let you do so without monthly fees.

I should note that, given the cost of consumables, even without monthly fees, most people would not benefit from PC postage. But if you ever send certified mail, send letters in large envelopes or heavier than 1 ounce, ship packages, or send mail internationally — and I have done all of the above in the last few months alone (heck, I might be single-handedly keeping the post office in business) — it’s quite convenient to be able to print just the right amount (e.g. $4.155 for certified 2-ounce First Class lettermail) instead of figuring out how to stick eight-and-a-half (?) Forever stamps to one envelope or instead of waiting in line at the post office.

Sometimes I just want to prepare my mail at home, sipping tea, in my pajamas, you know?

The United States Postal Service only allows you to do so through authorized vendors, including pbSmartPostage, Endicia.com/DYMO Stamps, and Stamps.com. (Each of these companies operates under contract with the USPS.) Printed postage labels aren’t just graphics like preprinted stamps. They contain unique 2D barcodes, which the USPS calls “information-based indicia” (IBI), that validate the postage.

pbSmartPostage test stamp

As annoying as it may be to have a big advertisement at the top of the label paper, the pink strip is actually part of what allows the USPS to validate this kind of postage at high speed, automatically.

Ordinarily, the USPS equipment “look[s] for special ink in the stamp or postage area” to validate the postage. Plain ol’ stamps are “tagged” with some kind of fluorescence — phosphors in the paper, ink, or coating — that allow them to be recognized and validated by the high-speed Facer Canceler machines. That’s how they very quickly detect counterfeit stamps that might look real to the untrained eye. Meter imprints, used by business mailrooms, are printed in fluorescent ink, and now include the same kind of 2D barcodes, too.

Imprint from a Pitney Bowes postage meter, containing a barcode
Imprint from a Pitney Bowes postage meter, containing a barcode

Because PC postage, printed at home, is usually done by a thermal label printer — or, in some cases, by laser or inkjet printer — the fluorescence has to be in the label supplies, either in the label paper or the pink/orange strip, for the automated machinery to recognize these mailpieces as bearing postage.

But fluorescence only seems to be enough to detect the presence of postage. What information is encoded in the 2D barcodes (Pitney Bowes/pbSmartPostage appears to use Data Matrix barcodes)?

Peeking into the barcode

Here’s an example 1-cent postage label I printed, which we can analyze. (Please don’t try to use this — it won’t be valid postage if you reprint it, and it is a federal crime to counterfeit postage…)

Example $0.01 pbSmartPostage stamp

The label contains several important elements:

  1. Fluorescent strip, at top; see previous section for discussion
  2. 2D (Data Matrix) barcode
  3. Value of postage ($0.01)
  4. Sender ZIP code (02138)
  5. Device ID/type (024P0007631396)
  6. Apparently, some sort of customer ID (0017056389) — this line has remained the same across all of the postage I’ve printed
  7. Provider name (Pitney Bowes)

I’m not the first person to try decoding these barcodes by hand — some folks over at Stack Overflow have apparently tried. If you simply tried to scan the barcode with a standard smartphone app, you’d get seemingly unreadable gobbledygook.[1]

Barcode Scanner on IBI postage barcode

Well, obviously the USPS isn’t relying on gobbledygook. In fact, the 2D barcode encodes all of the remainder of the list (#3-7), in addition to other data fields and a cryptographic signature.

How do we know this? Well, two specifications from 1999 and 2000 defined the standards. US patent 7233930 assigned to Pitney Bowes, filed in November 2000, referred to these specifications and summarized the new barcoded postage standards:

The Information-Based Indicia Program (IBIP) is a distributed trusted system established by the USPS to retrofit and augment existing postage meters using new technology known as information-based indicia. The IBIP relies on digital signature techniques to produce for each mail piece an indicium whose origin cannot be repudiated. Thus, in contrast to traditional postage metering systems employing mechanical printing technology and physical security, the IBIP supports new methods of securely applying postage to mail pieces. Generally, the IBIP requires printing a high density two-dimensional (2D) bar code on a mail piece. The 2D barcode encodes various information associated with the mail piece and is subsequently signed with a digital signature.

The USPS has published detailed specifications for the IBIP. Generally, the IBIP is directed to two types of postage metering systems. The first type is referred to as a closed system and is defined in the INFORMATION BASED INDICIA PROGRAM—PERFORMANCE CRITERIA FOR INFORMATION-BASED INDICIA AND SECURITY ARCHITECTURE FOR CLOSED IBI POSTAGE METERINGS SYSTEMS, dated Jan. 12, 1999, (“IBIP Closed System Specification”). The second type is referred to as an open system and is defined in the INFORMATION BASED INDICIA PROGRAM—PERFORMANCE CRITERIA FOR INFORMATION-BASED INDICIA AND SECURITY ARCHITECTURE FOR OPEN IBI POSTAGE EVIDENCING SYSTEMS, dated Feb. 23, 2000, (“IBIP Open System Specification”). Together, the IBIP Closed System Specification and the IBIP Open System Specification define the requirements for next generation postage metering systems.

PC postage stamps that are printed for value (e.g. 2-ounce First Class domestic mail for $0.705) and can be affixed to any such mailpiece — rather than for a particular mailpiece (e.g. 2-ounce First Class domestic mail for $0.705 to John Doe in ZIP code 01234-5678) — seem to fall under the IBIP Closed System Specification. Page 9 of that specification includes a handy table:

Table A-1. Indicium Data Elements for IBIP Closed System postage

The majority of the barcode data is in a binary format, to keep the payload small and the printed barcode compact. This is why standard barcode decoders, which attempt to render the data as human-readable text, fail.

There is an online barcode reader that helpfully decodes the binary data. ClearImage recognizes the above postage stamp as this:[2]

0000  00 01 be ab 19 00 30 32  34 50 24 72 74 00 69 c7  | ~~~~~~024P$rt~i~ |
0010  e0 11 00 0a 00 00 67 9e  33 01 0c 1b 00 00 00 00  | ~~~~~~g~3~~~~~~~ |
0020  00 00 00 85 42 04 01 00  00 f7 da 05 00 30 30 30  | ~~~~B~~~~~~~~000 |
0030  30 96 48 00 92 0d c2 e4  62 eb 7f cb 95 c3 e5 8e  | 0~H~~~~~b~~~~~~~ |
0040  6c 59 e9 d8 28 87 fd bd  45 69 5c 21 c1 84 40 76  | lY~~(~~~Ei\!~~@v |
0050  79 9c d1 c6 05 54 c1 36  70 00 00 5a 08 00 00 08  | y~~~~T~6p~~Z~~~~ |
0060  00 00 00 00 00                                    | ~~~~~            |

Now we’re getting somewhere!

Fitting this hex data into the IBIP Closed System Specification, and correcting for the byte order, we can figure out each component:

Information decoded from the IBIP barcode
Information decoded from the $0.01 postage label barcode

Download this IBIP barcode decoder (Excel spreadsheet) to plug in your own data, after first extracting the 2D barcode’s binary payload. Maybe I could even create an app to decode the whole thing, from start to finish, in the near future…

We’ve done it!

We’ve decoded just about every bit of this barcode. Of course, I can’t actually validate the digital signature — that depends on having the public key of the cryptographic certificate issued by the IBIP Certificate Authority.[3]

If you were paying close attention, you can see how the barcode data matches the human-readable components. (Actually, this is how I determined the meaning of the human-readable lines besides the sender ZIP.)

  • The upper human-readable line of letters/digits under the ZIP code, 024P0007631396, is in fact a concatenation of barcode fields 4–6 (manufacturer ID 02, model ID 4P, serial number 0007631396).
  • The lower human-readable line of digits, 0017056389, is barcode field 12 (software ID, seemingly issued by the PC postage service to a user).
  • The sender ZIP, 02138, is encoded in part of reserved field 2.

Here’s the label again, if you wanted to confirm that the barcode matches the human-readable text:

Example $0.01 pbSmartPostage stamp

At this point, you might point out: hey, isn’t this wasted effort if all the information was already in the human-readable part?

Um, well, we learned a few more things:

  • The internal certificate serial number used in their PKI, not that we can do anything with it…
  • The “ascending register” tells us $299,943.785 in postage has supposedly been imprinted through this service.
  • The “descending register” tells us there’s about $383.735 in remaining value in the service before it runs out of postage. Dubious data, but I would not be surprised if this is actually the remaining amount on deposit (perhaps to mitigate fraudulent hacks depleting all their postage?).
  • The “licensing ZIP code” assigned to this service is apparently 06924, which is interesting, because that ZIP doesn’t correspond to any physical location. … This needs more investigation.
  • With more samples, we might see a pattern in how the rate category is assigned to different rates (0000 matches the human-readable First Class text).
  • We can at least tell that they’re not using RSA in the signature, which would be 128 bytes instead of only 40 bytes for DSA/ECDSA. With more samples from other providers, we might be able to confirm whether algorithm ID 01 actually corresponds to ECDSA.
  • Haven’t you ever just been curious? Does everything have to have a point? Isn’t it enough that it’s cool to see cryptography and barcodes applied at scale like this?

Closing thoughts

Amazingly, this system designed in 1999–2000 — relying on even older algorithms (heck, they’re using SHA-1 message digests) — was so durable, and reasonably secure, that it’s been in continuous operation for over 15 years. The design is really, really ingenious: a public key infrastructure (PKI) approach allows the USPS to validate mail offline, that is, without needing every stamp ever printed to be recorded in a central database before it can be validated.[4] And because elliptic curve cryptography is fast, automation could realistically validate every barcode on every mailpiece without pausing. Conceivably, millions of mailpieces have been processed every one of those years using this technology. It’s quite an engineering marvel.

Then again, the community of people who care about stamps, or cryptographically-secured barcodes,[5] or postal automation, is pretty small… Those interests just happened to have intersected for me.

Footnotes   [ + ]

1. To be totally accurate, the barcode decoder is properly decoding the 2D barcode into its constituent data, but it is (mistakenly) trying to decode that further as ASCII/ISO-8859-1/human-readable text.
2. The leftmost column is the byte index; the middle two blocks are the binary data represented in hexadecimal; and the right-most section is what the data would look like if it were transliterated directly into ISO-8859-1 (this isn’t useful for us).
3. ”Public key” here is used in its cryptographic sense. Practically speaking, the public key is not public in the layman’s sense, because it is likely only the postal meter/PC postage manufacturers and the USPS have access to it.
4. The latest generation of postal barcodes — Intelligent Mail, a 1D barcode that has mostly replaced POSTNET — does not replace Information-Based Indicia, although it supplements IBI for commercial mail, value-added services, and packages (IMpb). Intelligent Mail has sorting and tracking built-in, and individual mailpieces can be tracked centrally by the USPS, but the technology does not use public-facing cryptography because it does not serve the same purpose of validating postage. As of January 1, 2016, all postage evidencing systems must produce IBI and/or Intelligent Mail barcodes.
5. Did you know? Similar digital signatures are used to secure 2D barcodes (PDF417 for paper and Aztec/Data Matrix/QR for mobile) on airline boarding passes.

14 Replies to “What’s in that USPS postage barcode?”

  1. Hi Frederick, your post was very useful for me today! I had a legal issue where a private post meter didn’t show a date in the human readable indicia and claimed the letter was mailed 7 days before the date the Post Office postmarked it. I was preparing for a battle between which governs the postmark or the private meter stamp and accompanying mailing affidavit. I found your page and was able to decipher the IBI showing the actual date they printed the stamp on the envelope, 1 day before the postmark. Phenomenal news! I’ve spent way more time than I ever would have wanted to on this issue, but I wanted to thank you and also to provide some information for you as a token of my appreciation. Item 12 is actually the software id or serial number of the machine. I confirmed this with Pitney Bowes. In your example it’s the serial number of the PB machine that printed the stamp.

    1. Glad to hear this had a practical application!

      For what it’s worth, you were in the right if it came down to a dispute between the private meter impression and the postmark — the meter impression definitely only proves the date it was printed, not when it was tendered to the post office (although there may be regulations requiring that an item actually be tendered then, it’s doubtful that everybody complies with that). If there’s an official postmark, I have no doubt that it would prevail… especially given the legal significance given to postmarks, e.g., Internal Revenue Code § 7502 (giving weight to postmark for filing and paying taxes); Uniform Commercial Code § 1-201(b)(36) (defining “Send” for the sale of goods).

      As for the serial number in field 6, it’s possible that PC postage (which has no associated physical meter/printer) has a different use for it. I can’t be certain yet if it’s that one or field 12…

  2. I’ve been hunting for hours trying to find out what that 10 digit pitney bowes number is on its postage print. Four zeros followed by a 3. It must increment upwards or downwards as an accidental $00.00 imprint bearing 0000345802 dated May 15 2017 was printed on the back of the envelope and the actual postage shown a number in the same position as 0000345865 dated May 13. Gomer Pyle could see that they did not mail item until at least the 15 but wanted it to reflect an earlier date.

    1. Hello Bruce,
      this number is called the Meter ID, it is a unique id number associated with the meter serial number. Most Pitney Bowes ID’s begin with either a 1 or 3. Many mail houses have several meter machines, your mail was run through 2 different machines. What you see on the back of the envelope is referred to as a re-date. Because a meter imprint is pre-canceled, the meter machine is required to print an accurate date. As part of the user agreement of operating a meter machine, mail must be dated with the date that it is received by the USPS. Your letter was delayed in processing and had to be redated before it could be mailed. I would also bet that it had a commercial postage rate, either 0.373, 0.403, 0.423, or 0.453 if it was a first class letter.

  3. I did find this:

    QB5. “Connect +” series (digital), 2010.

    Similar to Type QB4 but with large DataMatrix barcode, and the eagle has a straight wing.
    U.S. POSTAGE >> PITNEY BOWES across the top.
    Identification numbers:
    A. 02 1W or 04 1W over 10-digit number starting with 00013/ 00014
    B. 04 1W or 02 4W over 10-digit number starting with 00003
    Town line: “ZIP” with ZIP code
    V/F: MeterCat 5 spaces.jpg$000.00o
    NOTE: The Connect+ system can print a path completely across the top of an envelope including the return address, slogan, and whatever, as well as the frank, and in multiple colors.

  4. I have sent my tax return on time via 1st class letter without tracking number. One month passed, they claim my tax return is not received. I did take photo of mailing label while in post office. Is there way to tell if the mail is delivered by decode the 2D barcode? Thanks.

  5. I need to mail two large envelopes to two different cities. I used the self-service machine at the post office and printed two labels. The cost was the same for both. Unfortunately, I mixed them up.

    Question: does it matter which postage label goes on which envelope? I have compared the two and they are the same with the exception of one sideways printed long code number.

    The machine gave me an itemized receipt, which I examined closely to see if I could match the numbers but those code #’s don’t appear to be on the receipt.

    Can I do eenie meenie?

    1. If it’s just domestic First Class mail, they should be interchangeable. Those machines should just be printing postage by value.

  6. I’ve noticed lately some of these QR coded stamps don’t appear to have been cancelled, but I’m guessing if you tried to reuse one it would be rejected and possibly bring postal authorities down on your head. Not sure if it’s intended as some kind of entrapment, but best be aware…

    1. Hi Bruce,
      A meter imprint is considered “pre-canceled”. While all postage fraud is illegal, postal inspectors don’t often hunt down offenders at the consumer level. Inspectors look for fraud in the six and seven digit range.

  7. I scanned a bar code from a PB Mail & Go vending machine. The schema above has a line 0060, but this indicia I have stops at 0050 at the end of field 15 (40 byte long signature). Following your tables above, field 16 is missing on my indicia (14 bytes). Something has obviously changed at the USPS – do you have an update? Additionally, there are vended stamps with half of the bar codes on them compared to what you picture here. Do you have a USPS document saying what these remaining fields contain? Thanks Len Nadybal, Wash. D.C. lnadybal@philatelic.info

  8. As the table schema above shows, field 16 is a “reserved” field that can be used for optional data or future extensions to the schema. Its absence is fully compliant with the decades-old spec.

    I’ll have to get my hands on a half-width postage barcode to decide it. It’s possible that those actually encode a subset of the information.

Leave a Reply