Most people look at the photo page of a passport and see one thing. An examiner sees several layers of the same information, written in different ways for different readers, each protected differently. Their agreement is part of what makes the document genuine.
A shared standard for every passport
Passports and most ID cards follow ICAO Document 9303, the international standard that fixes where the data sits, how the machine-readable zone is written and how the chip is signed. A passport's MRZ is two lines of 44 characters; an ID card's is three lines of 30. Because the rules are public and precise, a document that breaks them is detectable by software, character by character.
The printed page, read by OCR
Every field on the document is read through OCR: name, date of birth, document number, dates of issue and expiry. Reading the fields is what removes manual typing from the counter, and it is also the first source the other two are compared against.
The MRZ: the lines at the bottom
The machine-readable zone is the two or three lines of characters at the foot of the photo page. It repeats the key data in a standard format, with check digits that are calculated from the data itself. A document number or a date that was altered on the page and not in the MRZ, or altered without recalculating its check digit, stops matching.
Barcodes on other document types play a similar role: a compact, structured copy of the printed data that can be parsed and compared field by field.
The chip: signed by the issuer
Where the document carries one, the NFC chip holds the holder's data and photograph, signed by the issuing authority. It is the hardest layer to forge, because the signature cannot be reproduced without the issuer's keys. Where the phone allows it, the chip is read over NFC and its content is compared with what is printed.
Reading them against each other
Each source on its own can be faked with enough effort. Three sources that have to agree field by field, with the chip signed and the check digits valid, are a far higher bar. The verdict weighs all of them together, alongside the optical checks in visible, UV and infrared light.
- Printed data read by OCR, so no one types it at the counter.
- MRZ and barcode parsing, with the check digits verified.
- NFC chip reading where the document and the device support it.
More than 200 countries
Formats differ from one country to the next, and from one generation of the same document to the next. The platform covers more than 200 countries and hundreds of document types, with the rules for each one, so that a counter does not have to know in advance which document is about to be placed on the scanner.
How a check digit catches an edit
Each key field in the MRZ, such as the document number, the date of birth and the expiry date, is followed by a check digit. It is computed by weighting each character 7, 3, 1 in turn and taking the sum modulo 10. Change a single digit of the date and the check digit no longer adds up, unless the forger recalculates it, and then the MRZ still has to agree with the printed page and with the chip.
Questions about the MRZ and the chip
What is the MRZ on a passport?
The machine-readable zone: the lines of characters at the foot of the photo page that repeat the key data in a standard format, with check digits, so that a machine can read and validate it.
What does reading the NFC chip prove?
That the data and photograph on the chip were signed by the issuing authority. The signature cannot be reproduced without the issuer's keys, which makes the chip the hardest layer to forge.
What if the document has no chip?
The check relies on the printed page, the MRZ or barcode, and the optical checks in visible, UV and infrared light, all weighed together in the verdict.