Basic Access Control uses document-derived information to establish protected communication between compatible passport chips and inspection devices.
Washington, DC, October 19, 2026 — Basic Access Control, commonly known as BAC, is an early electronic passport security mechanism that prevents unrestricted reading of chip data by requiring a compatible inspection device to derive access information from details already printed on the physical passport.
The system creates a protected communication session between the electronic passport and the reader, linking the contactless chip to information from the machine-readable zone and reducing the likelihood that someone can retrieve passport data simply by bringing an unauthorized reader near the document.
BAC Links the Printed Passport to the Electronic Chip
The central idea behind BAC is that access to electronic passport data should depend partly on information an inspector can obtain from the physical document, rather than allowing the chip to behave like an openly readable contactless memory device.
A compatible reader first captures selected information from the machine-readable zone, including data derived from fields such as the passport number, date of birth and expiration date, before attempting to establish protected communication with the electronic chip.
That design links the visible identity page to the hidden electronic component, so the reader generally needs access to specific document information before it can proceed with the BAC communication process.
The International Civil Aviation Organization’s travel document standards govern the broader technical framework for electronic machine-readable travel documents, defining interoperable structures and security mechanisms used by participating passport systems.
The MRZ Provides the Starting Information
The machine-readable zone contains standardized characters that allow compatible systems to quickly and consistently capture essential passport information using optical recognition technology.
Under BAC, selected MRZ information is processed according to the protocol so the reader and passport can derive the values needed to participate in an authenticated and encrypted communication session.
This arrangement does not make the MRZ itself secret because the information remains visibly printed on the passport, but it creates a practical barrier to casual contactless reading by requiring knowledge of the document’s specific data.
The mechanism therefore combines possession of the passport with standardized electronic procedures, creating a basic form of access control that was well suited to the first generations of interoperable biometric passports.
BAC Does More Than Simply Unlock the Chip
Calling BAC a simple password that opens the passport chip is misleading, because the protocol also establishes cryptographic session keys to protect subsequent communication between the document and reader.
Once both sides complete the required exchange successfully, the session can continue using secure messaging so that protected data does not travel between the passport and reader as unprotected plain information.
This encryption reduces the usefulness of passively intercepting contactless communication because an observer would not receive an immediately readable copy of the data exchanged during the protected session.
BAC therefore addresses both access and communication protection, although later protocols introduced stronger cryptographic properties as electronic passport technology continued to evolve.
The Chip and Reader Authenticate the Session
During the BAC process, the passport chip and reader perform a mutual authentication sequence intended to establish that both sides possess the correct document-derived keying information before protected communication proceeds.
This mutual process helps prevent a reader without the correct derived values from immediately accessing the protected electronic files stored inside the passport.
Once the session is established, the chip and reader can use newly generated session information rather than relying indefinitely upon the original MRZ-derived values for every subsequent protected exchange.
The result is a temporary secure communication environment created specifically for that reading session, which ends when the interaction between the passport and reader terminates.
BAC Helps Reduce Casual Skimming
One of BAC’s original security goals was to reduce the risk that someone could surreptitiously read passport information from a distance without first obtaining the document details needed to establish access.
Because the reader generally needs MRZ-derived information, merely placing an NFC-capable device near a passport should not provide unrestricted access to protected electronic data.
The passport chip’s short physical operating range already limits communication, while BAC adds another layer by requiring the appropriate electronic access sequence before protected information can be retrieved.
Together, these characteristics make electronic passport communication fundamentally different from an openly broadcasting wireless device that continuously transmits identity data to any nearby receiver.
BAC Uses Relatively Low-Entropy Document Information
BAC security is constrained because the source information used to derive its initial keys comes from predictable passport fields rather than a long random secret known only to the holder and issuing authority.
Passport numbers, birth dates, and expiration dates have far fewer possible values than modern cryptographic passwords or randomly generated high-entropy keys.
This limitation means BAC provides useful access control but does not offer the strongest protection available under contemporary cryptographic standards.
The evolution toward newer mechanisms reflects this reality, with later electronic passport designs adopting stronger protocols intended to better resist attacks targeting predictable document-derived information.
BAC and Passive Authentication Perform Different Jobs
BAC controls access to electronic passport data and protects communication during the reading session, while passive authentication addresses a separate question: whether the legitimate issuing authority digitally signed the protected chip information and whether it remains unchanged.
A reader can therefore establish a successful BAC session without that success alone proving the governmental authenticity of the passport’s stored information.
Cryptographic validation of the chip’s signed data requires separate trust information associated with the issuing country’s document-signing infrastructure.
The ICAO Public Key Directory supports participating authorities in exchanging the certificate information needed to validate digital signatures on electronic machine-readable travel documents across international borders.
Access Is Not the Same as Authenticity
This distinction between access and authenticity is one of the most important concepts for understanding electronic passport security because successfully reading chip data does not independently prove that the passport was legitimately issued.
BAC can establish a protected channel, but another process must determine whether the information retrieved through that channel carries valid cryptographic evidence connected to the expected issuing authority.
A counterfeit electronic document could theoretically respond to communication attempts, while still failing appropriate cryptographic validation if its stored information was not signed through the legitimate governmental trust structure.
Professional examination therefore evaluates several questions, including whether the chip can be accessed, whether its data remains intact and correctly signed, and whether the physical passport and traveler match that electronic information.
Smartphone Applications Can Use BAC
Many smartphone applications designed to read electronic passports can perform BAC when the passport generation and application support that protocol.
The application typically begins by scanning the machine-readable zone with the phone’s camera to obtain the information needed to derive the access values used during the NFC session.
Afterward, the user places the smartphone near the passport, allowing the phone’s contactless hardware to power the chip and attempt the protected communication sequence.
Travelers interested in how these electronic processes fit into broader document authentication can review the Amicus International Consulting guide to modern passport security and counterfeit detection, which explains how physical and digital checks reinforce one another.
Incorrect MRZ Data Can Prevent a Successful Session
Because BAC depends upon document-derived information, even a small error in the captured MRZ can prevent the reader from deriving the values needed to communicate successfully with the chip.
A smartphone application that misreads one passport-number character or records the wrong expiration date may therefore fail to establish access even when the electronic passport remains fully functional.
This behavior can make an apparent NFC problem look like a chip failure when the underlying issue actually comes from optical character recognition or incorrect manual data entry.
Carefully repeating the MRZ capture can sometimes resolve the problem, showing how closely the visible machine-readable text and electronic access process are connected.
Failed BAC Does Not Automatically Mean a Counterfeit Passport
A failed BAC session can result from several technical causes, including incorrect MRZ information, poor NFC positioning, damaged antennas, software incompatibility, or communication errors between the reader and chip.
Therefore, do not treat the result as definitive evidence that the passport is fraudulent or that the chip contains no valid information.
Professional examination considers repeated controlled attempts, document condition, reader performance and other available evidence before drawing conclusions about electronic functionality.
This caution mirrors the broader principle of passport authentication, where no single failed or successful test should automatically determine the authenticity of the entire document.
Secure Messaging Protects the Ongoing Exchange
After BAC successfully establishes the session, protected messaging helps secure commands and responses exchanged between the passport and reader.
This mechanism reduces the risk that someone intercepting the radio-frequency communication can simply read the information being transferred or alter commands without detection.
The protected session remains temporary and depends upon the cryptographic values established during that particular interaction.
Once the passport moves away from the reader and loses power, the session ends, requiring a new access sequence the next time compatible equipment attempts to communicate with the document.
BAC Was Important in Early ePassport Deployment
As electronic passports expanded internationally, governments needed a practical mechanism to restrict chip access while remaining interoperable across many border-control systems.
BAC offered a straightforward solution by using information already in the standardized machine-readable zone, rather than requiring travelers to carry separate passwords or electronic credentials.
That operational simplicity made the system practical for mass international deployment, especially when contactless passport technology was still being widely adopted.
Its design also let border authorities integrate electronic reading with familiar optical MRZ capture, creating a natural transition from traditional machine-readable passports to biometric electronic documents.
PACE Provides a Stronger Successor
Password Authenticated Connection Establishment (PACE) was introduced to provide stronger access protection than BAC while retaining the ability to derive access information from the physical travel document.
PACE uses more advanced cryptographic techniques to establish the protected communication channel, improving resistance against attacks that exploit the relatively predictable information used by BAC.
Modern electronic passport implementations increasingly rely on PACE where supported, although BAC remains historically important and still explains how many earlier generations of ePassports were designed to control access.
Understanding the transition from BAC to PACE also shows how passport security evolves over time rather than remaining fixed throughout the life of electronic travel-document technology.
Different Passport Generations Can Behave Differently
Travelers should not assume that every electronic passport uses exactly the same access protocol because implementation depends upon issuing country, document generation and the technical standards in effect when the passport series was designed.
An older biometric passport may support BAC, while a newer document from the same country may support PACE or additional security mechanisms.
This variation means smartphone applications and inspection systems must recognize the document’s supported protocols rather than attempting to use one universal communication method for every passport.
It also explains why two apparently similar electronic passports can behave differently when the same device or application reads them.
BAC Does Not Protect the Physical Booklet
Basic Access Control applies to electronic communication and does not determine whether the passport’s pages, binding, holograms or physical personalization remain genuine and untouched.
A passport can establish a valid electronic session while still requiring physical examination if authorities observe suspicious damage or structural inconsistencies elsewhere in the booklet.
Similarly, a physically convincing passport can fail electronic checks if the chip is damaged, improperly configured or inconsistent with the visible identity information.
Modern authentication becomes strongest when physical inspection, electronic access, cryptographic validation and biometric comparison all support the same identity and document.
BAC Does Not Confirm the Traveler’s Identity
Establishing protected communication with the chip also does not independently determine whether the person presenting the passport is the legitimate holder.
That question requires comparing the traveler with the biometric identity represented by the document, usually through visual inspection or automated facial comparison against the chip’s stored portrait.
BAC simply helps protect access to the electronic information used during those later processes.
The distinction reinforces the layered nature of passport security because access control, document authentication and traveler identification represent separate functions that must work together.
A Protected Channel Is Only One Part of the Security Architecture
BAC made electronic passports substantially more secure than a design in which any nearby compatible reader could retrieve chip information without first establishing controlled access.
Its use of MRZ-derived values and secure messaging creates a basic protected channel that links the physical document with its electronic component during inspection.
However, the protocol should be understood as one layer within a much larger system that also includes digital signatures, biometric information, physical security features, and government databases.
Its greatest contribution is limiting casual electronic access while supporting interoperable border processing, rather than providing a complete determination of passport authenticity on its own.
BAC Shows How Physical and Digital Security Intersect
The Basic Access Control architecture illustrates a defining feature of modern passports: their printed and electronic components are deliberately designed to reinforce one another rather than operate as completely separate systems.
Information visible in the machine-readable zone can help establish a protected electronic session, while information retrieved from that session can then be compared with the physical identity page and the traveler.
That relationship increases the number of consistency checks available to border authorities and makes it harder to conceal unauthorized manipulation across both physical and digital layers.
For legitimate travelers, BAC generally operates invisibly within seconds, yet the protocol represents an important stage in the development of secure electronic passports by connecting standardized printed information with protected contactless communication.
