Originally published at Editable Templates: https://editable-templates.cc/drivers-license-passport-mrz-privacy-security-guide
TL;DR — The Machine Readable Zone (MRZ) on passports and IDs is designed for fast, reliable reading of a few key fields. It’s not encryption, and it doesn’t store hidden biometrics. This guide explains what MRZ does, how check digits work, and how to share ID images more safely online.
What is the MRZ?
The MRZ is the block of two or three lines of characters (letters, numbers, << fillers) found on passports and many IDs. It standardizes a subset of fields (like name, document number, nationality, birth/expiry dates) so machines can read them consistently.
- Why it exists: speed, accuracy, global interoperability.
- Where it appears: typically at the bottom of the data page (passports) or on the back (some IDs).
- Not a chip: MRZ is printed text; it’s separate from e-passport chips (NFC).
What the MRZ reveals (and doesn’t)
Reveals: a limited set of textual data and simple integrity checks (check digits).
Doesn’t reveal: secret images, fingerprints, face templates, or “hidden” private data.
If you see an online claim that MRZ includes “secret biometrics,” that’s a myth. It encodes only standardized text fields plus simple check digits.
How check digits work (plain-English)
MRZ check digits are error-detection numbers. A fixed algorithm weighs each character of a field (e.g., document number), sums them, then reduces to a single digit. Scanners recompute and compare the result to detect typos.
- Purpose: catch mistakes and basic tampering.
- Not encryption: they neither protect nor hide data; they just validate it.
Privacy risks & safe-sharing tips
- Redact what’s not needed. If you must share an ID image, hide the MRZ and sensitive fields unless absolutely required.
- Use synthetic data when testing. Never publish real MRZ data publicly.
- Store minimally. If you collect ID images for compliance, protect them with access controls and short retention.
- Beware of context leaks. Even a harmless screenshot can contain MRZ data at high resolution.
Safe on-site MRZ demos (sample data only)
Use only synthetic or redacted data.
FAQs
Does the MRZ expose my full personal data?
No. It’s a small, standardized subset—mainly identifiers and dates.
Are MRZ check digits a form of encryption?
No. They detect input errors; they don’t encrypt or decrypt anything.
Is it legal to test MRZ parsers?
Yes—when you use synthetic/redacted data and comply with laws/policies. Never use tools to forge or misrepresent IDs.
Resources (authoritative)
- ICAO Doc 9303 — Machine Readable Travel Documents
- NIST SP 800-63 — Digital Identity Guidelines
- CNIL — privacy resources
Education & security awareness only—do not use tools to forge or misrepresent identity documents.