diff --git a/registrasion/migrations/0014_attendee_access_code.py b/registrasion/migrations/0014_attendee_access_code.py
new file mode 100644
index 00000000..a579f47a
--- /dev/null
+++ b/registrasion/migrations/0014_attendee_access_code.py
@@ -0,0 +1,21 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.9.2 on 2016-04-08 02:20
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+import registrasion.util
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('registrasion', '0013_auto_20160406_2228_squashed_0015_auto_20160406_1942'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='attendee',
+            name='access_code',
+            field=models.CharField(default=registrasion.util.generate_access_code, max_length=6, unique=True),
+        ),
+    ]
diff --git a/registrasion/migrations/0015_auto_20160408_0220.py b/registrasion/migrations/0015_auto_20160408_0220.py
new file mode 100644
index 00000000..acdde45f
--- /dev/null
+++ b/registrasion/migrations/0015_auto_20160408_0220.py
@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.9.2 on 2016-04-08 02:20
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('registrasion', '0014_attendee_access_code'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='attendee',
+            name='access_code',
+            field=models.CharField(max_length=6, unique=True),
+        ),
+    ]
diff --git a/registrasion/migrations/0016_auto_20160408_0234.py b/registrasion/migrations/0016_auto_20160408_0234.py
new file mode 100644
index 00000000..94beb184
--- /dev/null
+++ b/registrasion/migrations/0016_auto_20160408_0234.py
@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.9.2 on 2016-04-08 02:34
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('registrasion', '0015_auto_20160408_0220'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='attendee',
+            name='access_code',
+            field=models.CharField(db_index=True, max_length=6, unique=True),
+        ),
+    ]
diff --git a/registrasion/models.py b/registrasion/models.py
index fedaa68b..2719dd0e 100644
--- a/registrasion/models.py
+++ b/registrasion/models.py
@@ -1,5 +1,7 @@
 from __future__ import unicode_literals
 
+import util
+
 import datetime
 import itertools
 
@@ -32,8 +34,20 @@ class Attendee(models.Model):
         except ObjectDoesNotExist:
             return Attendee.objects.create(user=user)
 
+    def save(self, *a, **k):
+        while not self.access_code:
+            access_code = util.generate_access_code()
+            if Attendee.objects.filter(access_code=access_code).count() == 0:
+                self.access_code = access_code
+        return super(Attendee, self).save(*a, **k)
+
     user = models.OneToOneField(User, on_delete=models.CASCADE)
     # Badge/profile is linked
+    access_code = models.CharField(
+        max_length=6,
+        unique=True,
+        db_index=True,
+    )
     completed_registration = models.BooleanField(default=False)
     highest_complete_category = models.IntegerField(default=0)
 
diff --git a/registrasion/util.py b/registrasion/util.py
new file mode 100644
index 00000000..fb97d1d5
--- /dev/null
+++ b/registrasion/util.py
@@ -0,0 +1,15 @@
+import string
+
+from django.utils.crypto import get_random_string
+
+def generate_access_code():
+    ''' Generates an access code for users' payments as well as their
+    fulfilment code for check-in.
+    The access code will 4 characters long, which allows for 1,500,625
+    unique codes, which really should be enough for anyone. '''
+
+    length = 4
+    # all upper-case letters + digits 1-9 (no 0 vs O confusion)
+    chars = string.uppercase + string.digits[1:]
+    # 4 chars => 35 ** 4 = 1500625 (should be enough for anyone)
+    return get_random_string(length=length, allowed_chars=chars)