APRS Passcode — What It Is, How It Works, and How to Get Yours

Sooner or later, every APRS user runs into the same five-digit number. You type it into the APRS World mobile app, into a Yaesu FT3DR, into a home-brew iGate config file, or into a website that wants to authenticate you against APRS-IS. It is called the APRS passcode, and almost everyone misunderstands it. This guide explains exactly what it is, what it is not, how the algorithm works, and where to get one safely.

If APRS is new to you, start with our pillar guide: What is APRS?.

The Single Most Important Fact

An APRS-IS passcode is not a password and not a security token. It is a publicly computable integer derived from your callsign by a published algorithm. Anyone can compute anyone else's passcode. The number does not authenticate you — it merely demonstrates that you have read the algorithm, which is taken as a (very weak) signal that you are a real APRS user and not random Internet noise. Treat the passcode like a return-address sticker, not like a credit-card number.

This matters for two reasons:

  1. There is no such thing as "your passcode getting leaked". It is already public information; if you have ever told anyone your callsign, they can recover it in milliseconds.
  2. APRS-IS does not provide identity authentication. Anyone with knowledge of your callsign and the public algorithm can connect to APRS-IS as you. The defence against impersonation is social, regulatory, and per-server — not cryptographic.

How the Algorithm Works

The passcode is a 16-bit unsigned integer derived from the base callsign (i.e. with any SSID like -9, -1, etc. stripped). The algorithm itself is a simple ASCII-based rolling XOR checksum. Reference C-language source has been distributed publicly since at least the mid-1990s and is documented in many open-source iGate projects, including aprx and Direwolf 1.

The high-level steps:

  1. Strip the SSID from the callsign (W1ABC-9 → W1ABC) and uppercase it.
  2. Initialise an unsigned 16-bit accumulator to a fixed seed value (0x73E2 in the published reference).
  3. Walk the callsign two characters at a time, shifting the first character left by 8 bits and XOR-ing both into the accumulator.
  4. Mask off the sign bit so the result fits in 15 bits.
  5. The remaining integer (0 through 32767) is your passcode.

The whole function is roughly 15 lines of C, runs in microseconds, and produces a stable result for any given callsign — your passcode never changes for the same callsign, regardless of which generator you use.

Why Bigger Networks Treat It as a Courtesy Filter

If the passcode is publicly computable, what is the point? Three things:

  1. It blocks accidental misuse. Web crawlers, scripts written by non-hams, and naive software that does not know about APRS-IS will not produce a valid passcode by accident. The passcode is a tiny gate that keeps obvious noise out.
  2. It signals "I read the docs". Tier 2 server operators take a callsign-with-correct-passcode pair as evidence the connecting party has read at least the basic APRS-IS connection guide and is making a good-faith effort to participate.
  3. It enables per-callsign rate limiting and audit logging. Servers log every connection by callsign. If a callsign starts misbehaving (flood-beaconing, generating malformed packets, transmitting on bands the operator is not licensed for), Tier 2 operators can block that callsign at the network level. The passcode is what ties the connection to a specific log entry.

What the passcode does not do:

In other words, the passcode is the network equivalent of a hat that says "I am an APRS operator". It is not a passport.

Read-Only Access — -1

If you are connecting to APRS-IS purely to read packets — for example, building a website that displays APRS data, or running an analytics dashboard — you do not need a real callsign-derived passcode at all. The well-known passcode -1 marks a connection as read-only. Tier 2 servers will accept it, send you the packet stream you filtered for, and refuse to forward any beacon you try to inject. Most websites, including aprs.world, use exactly this mode for their public live-map data.

This is documented in the original APRS-IS connection protocol 2 and is widely respected across all Tier 2 servers.

Where to Get Your Passcode

Several routes, all of which produce the same number:

We recommend computing your passcode locally on a device you control rather than fetching it from a stranger's website — not because the number is secret (it is not), but as a general matter of habit. Web-form generators are fine; just remember the result is something a 50-line Python script could equally compute offline.

What If My Passcode "Stops Working"?

It will not, because passcodes are stateless — they are recomputed by the server on every connection from your declared callsign. If your client is being rejected, the cause is almost always one of:

  1. Wrong callsign in the client config. Check capitalisation and SSID stripping. ta4ohn-9 and W1ABC-9 may both work, but the passcode must be computed from the upper-case base W1ABC.
  2. Wrong server address. Tier 2 server names occasionally change. Use a generic round-robin address like rotate.aprs2.net rather than a specific Tier 2 hostname.
  3. Network blocking outbound TCP port 14580. Some restrictive Wi-Fi networks (hotels, schools, airports) block this. Try a different network.
  4. Your IP has been temporarily rate-limited for sending malformed packets. Pause for a few minutes and try again.

The passcode itself is rarely the cause.

Frequently Asked Questions

Can I use the same passcode on multiple devices simultaneously? Yes — APRS-IS allows the same callsign to connect from multiple sources, typically one per SSID (W1ABC, W1ABC-9, W1ABC-10...). Use different SSIDs to differentiate them so packets are not duplicated.

Do I need a different passcode per SSID? No. The passcode is computed from the base callsign only (SSID stripped). W1ABC-1 and W1ABC-9 share the same passcode.

My friend says my passcode is wrong. They computed it the same way every other client does. If two implementations disagree, one of them has a bug. Cross-check against a third reference such as Direwolf or aprx.

Is there a passcode for clublog or shortwave or the ISS APRS digipeater? No. The passcode is purely an APRS-IS thing. RF-only operations — beaconing on 144.800 MHz, digipeating, hitting the ISS digipeater on 145.825 MHz — do not require any passcode at all. You only need it the moment you start uploading to or downloading from an APRS-IS Tier 2 server.

What if I do not have a callsign yet? Then you cannot get a passcode — the algorithm requires a valid callsign as input. You can still consume APRS data read-only (passcode -1), and you can read all the public guides on aprs.world, but you cannot beacon or upload until you have your ticket. See the licensing section in our pillar guide for how to get there.

Coming to aprs.world

We plan to ship a built-in passcode helper directly on aprs.world — point your browser at the site, type your callsign, get your passcode locally in JavaScript. In the meantime any of the existing online generators or in-app calculators work fine.

Footnotes

  1. WB2OSZ Direwolf, source for aprs_tt.c and related files. https://github.com/wb2osz/direwolf ↩

  2. APRS-IS, "Connecting to APRS-IS". http://www.aprs-is.net/Connecting.aspx ↩