Mode S and ICAO 24-Bit Addresses: Every Aircraft's Digital Fingerprint

Strip away the paint, the registration on the tail, the flight number on the departures board and the callsign on the radio, and an airliner still has one name left, the truest one it owns. It is six hexadecimal characters long, something like A1B2C3 or 4CA2D6, burned into the configuration of its transponder, and it belongs to that airframe alone among every aircraft on the planet. Sell the aircraft to another airline and the livery changes; register it in another country and even this code changes with the flag it flies, but at any moment in its life the address is unique in the world fleet. Flight trackers call it the hex code. Engineers call it the ICAO 24-bit address. It is the serial number of the sky, and without it, modern surveillance and modern flight tracking would collapse into ambiguity.

Why 4,096 identities stopped being enough

The problem Mode S solved was arithmetic. Classic secondary radar identified aircraft by their squawk code, four octal digits offering exactly 4,096 combinations, a scheme we unpack in our guide to transponders and squawk codes. Codes had to be assigned locally, juggled between control regions, and recycled constantly; two aircraft on opposite sides of a continent might legitimately wear the same one. Worse, classic radar interrogation was a broadcast shout: every transponder in the beam answered at once, and near busy airports the overlapping replies garbled each other, a phenomenon with the wonderful name synchronous garble.

Mode S, developed at MIT Lincoln Laboratory in the 1970s under the name DABS and later standardized internationally, fixed both problems with one idea: give every airframe a permanent, globally unique binary address, 24 bits long. Twenty-four bits yield 16,777,216 combinations, and with the all-zeros and all-ones patterns reserved, 16,777,214 usable addresses, room for every aircraft that will fly for generations. With unique addresses, a ground station can interrogate one specific aircraft, selectively, hence the S, and no one else answers. The shouting match became a series of private phone calls.

Who hands out 16.7 million names

The address space is administered by ICAO under Annex 10 to the Chicago Convention, and it is carved up by country in blocks, like telephone country codes. The United States holds the largest allocation, the block from A00000 to AFFFFF, more than a million addresses. The United Kingdom uses 400000 through 43FFFF, Germany 3C0000 through 3FFFFF, and so on down to small states with allocations of a thousand or so. Each national registry assigns addresses to individual airframes when they are registered, which is why the hex code changes if an aircraft moves to a new flag: the address travels with the registration, not the metal. Details of the allocation scheme are published by ICAO and mirrored in national rules such as the FAA's registration procedures at the US Civil Aircraft Registry.

The American allocation hides a lovely piece of engineering tidiness: for US civil aircraft, the 24-bit address is derived algorithmically from the N-number, so N123AB maps to a specific hex code by pure computation, no lookup table required. Most other countries assign sequentially or administratively, so trackers rely on registry databases to translate address to registration. Either way, the mapping is public enough that a hobbyist receiver decoding hex 4CA2D6 can, within a second, tell you it belongs to a particular Ryanair 737 registered in Ireland; browse any airframe's details in our aircraft database and the hex code sits right beside the registration.

What Mode S actually changed on the radio

On the air, Mode S kept the old frequencies, interrogations at 1030 MHz and replies at 1090 MHz, so it could coexist with the Mode A/C world during a transition that is still, decades later, not quite finished. But the replies grew up. A Mode S downlink frame is 56 or 112 bits, protected by error-correcting code, and always contains the sender's 24-bit address. Interrogators can ask for specific registers from the aircraft's memory: selected altitude, airspeed, heading, callsign. Altitude reporting sharpened from 100-foot steps to 25-foot steps. And crucially for trackers, Mode S transponders also transmit spontaneously, short unsolicited squitters that exist so that collision-avoidance systems can discover neighbors, plus the 112-bit extended squitter that carries ADS-B position data, the broadcast dialect we anatomize in our ADS-B explainer.

That family relationship is worth stating plainly: ADS-B on 1090 MHz is not a separate radio system, it is a Mode S message type. The 24-bit address is the thread stitching every transmission together. When your receiver hears a position squitter, a TCAS acquisition squitter and a radar reply from the same aircraft, the shared address is what lets software fuse them into one coherent target, and it is also what lets multilateration servers match the same message across distant receivers to compute a position for aircraft that broadcast none.

Callsigns change by the flight, squawk codes by the sector, registrations by the owner. The 24-bit address endures, the one name an aircraft cannot fly without.

The fingerprint that built a hobby

For the flight tracking community, the hex code is the primary key of the entire enterprise. Databases mapping addresses to registrations, types, operators and photographs are the backbone of every tracking site and every spotting app. History services can reconstruct an individual airframe's life, every flight, every operator, every storage stint in the desert, by following one address through years of received messages. Fleet watchers detect aircraft sales when an address goes quiet and the same manufacturer serial number reappears under a new flag's block. Researchers at the OpenSky Network have used address-keyed histories for everything from emissions studies to detecting GPS jamming zones.

The address also underpins accountability journalism and public-interest tracking, which is precisely why it has become a privacy battleground. Because US addresses map algorithmically to registrations, anyone can resolve a hex code to an owner in seconds. In response, the FAA created the Privacy ICAO Address program, PIA, which lets eligible US aircraft fly domestically with a temporary alternate address not tied to their registration, swapped periodically. Combined with blocked-registration programs, the result is an arms race between privacy services and open-data trackers that we tour in our piece on tracking private jets. The addresses themselves, though, remain structurally public: they must be broadcast to be useful, and 16.7 million names shouted into open air will always find listeners.

Quirks, collisions and edge cases

The system's imperfections are as revealing as its design. Maintenance errors occasionally leave two aircraft transmitting the same address, and surveillance systems flag the resulting impossible teleporting target. Some transponders have shipped with default or mis-set addresses, producing ghost aircraft attributed to the wrong country. Military aircraft draw from national blocks but often rotate addresses or use reserved ranges, and a few states deliberately obscure their allocations. Light aircraft in some countries fly with portable transponders whose addresses follow the device rather than the airframe. None of this breaks the system, but all of it keeps database maintainers humble and makes cross-checking against registration, callsign and behavior a standard tracker's habit; our field guide to how tail numbers and registrations work makes a good companion read.

Step back, though, and the achievement is remarkable. A committee in the 1970s sized a namespace, nations agreed to share it, manufacturers burned it into avionics, and fifty years later a teenager with a soft-plastic antenna can pull a unique, globally coordinated identity out of the air from any airliner within two hundred miles, then watch that exact airframe cross the planet on a real-time map. The 24-bit address is infrastructure in the best sense: invisible, boring, and quietly holding up everything above it.

Six characters, twenty-four bits, one aircraft. Somewhere above you right now, a transponder is signing its true name several times a second, and now you know how to read the signature.