What the South African smart ID card barcode contains

Published 11 September 2026 · 5 minute read

The PDF417 barcode on the back of a South African smart ID card is not encrypted. It holds plain text: twelve fields separated by the pipe character (|), starting with the surname, then the given names, the sex, a country code and the 13-digit ID number. Any PDF417 reader can read it; the work is in knowing which field is which.

That makes it very different from the driver's licence card, whose barcode is binary and encrypted. Mixing the two up is the most common integration mistake we see.

The twelve fields

A card barcode has this shape (values replaced with placeholders):

SURNAME|GIVEN NAMES|M|RSA|8001015009087|01 JAN 1980|RSA|CITIZEN|12 AUG 2023|.....|.........|....

Position	Example	Meaning
1	SURNAME	Surname
2	GIVEN NAMES	Full given names, not initials
3	M	Sex
4	RSA	A country code
5	8001015009087	13-digit ID number
6	01 JAN 1980	Date of birth, as `DD MON YYYY`
7	RSA	A country code
8	CITIZEN	Citizenship status
9	12 AUG 2023	A date, meaning not confirmed
10 to 12	digits	Meaning not confirmed

Two of these deserve caution. Positions 4 and 7 both read RSA on a South African citizen's card, so from citizens' cards alone you cannot tell which one is nationality and which is country of birth. And the date in position 9 looks like an issue date, but nothing we have seen confirms it. Treat any code that relies on those fields as a guess.

What the ID number itself tells you

The 13-digit number in position 5 has a fixed structure, the same one printed on the green ID book:

Digits 1 to 6: date of birth as YYMMDD
Digits 7 to 10: a sequence number, where 0000 to 4999 is female and 5000 to 9999 is male
Digit 11: 0 for a South African citizen, 1 for a permanent resident
Digit 12: historically a race classifier, now usually 8
Digit 13: a check digit calculated with the Luhn algorithm

Running the Luhn check on the scanned number is a cheap way to catch a misread before it reaches your records.

Decoding the card with Driverscan

Driverscan reads the card through its idNumber decoder. You can send the barcode text as-is or hex-encoded, either to /api/decode/idNumber or to /api/decode, which recognises the twelve-field layout and routes it for you:

curl -H 'Authorization: Bearer YOUR_API_TOKEN' \
     -H 'Content-Type: application/json' \
     -d '{"encrypted": "SURNAME|GIVEN NAMES|M|RSA|8001015009087|01 JAN 1980|RSA|CITIZEN|..."}' \
     https://driverscan.co.za/api/decode

The response returns the six fields whose meaning is established:

surname
names, the full given names
sex
idNumber
birthDate, converted from 01 JAN 1980 to 19800101
citizenshipStatus

The other six fields are deliberately not returned. A field with a guessed name in an API contract is worse than a missing one, because integrators build on it.

The response uses the same license object as the driver's licence decoders, so an integration that already handles licences can take ID cards without a second code path. Licence-only fields such as licenseNumber come back as empty strings.

The mistake to avoid

Do not send an ID card to the vehicle licence disc decoder. Both are unencrypted text, which is why they get confused, but the disc uses % as its separator and starts with %MVL. Sending a card to /api/decode/zavehicle returns HTTP 400 with an explanation rather than a result. If you are unsure what a scanner produced, send it to /api/decode and let detection decide.

Card versus licence: a quick comparison

	Smart ID card	Driver's licence card
Encrypted	No	Yes
Format	12 pipe-separated text fields	720 bytes of binary
Names	Full given names	Initials only
Photo in barcode	No	Yes
Driverscan decoder	`idNumber`	`zadriver`, or `zadriverpng` for the photo

For the licence side, see how to decode the encrypted South African driver's licence barcode.

Try Driverscan

Driverscan is a REST API run by Apex Technology. Register for an account to get an API token and the full documentation, or contact sales about volume pricing.