Passport OCR: how to extract data from a passport's data page and MRZ

Passport OCR is the automatic way to extract data from a passport. It reads the data page, including the two-line machine readable zone (MRZ) at the bottom. The output is fields such as name, nationality, date of birth, passport number and expiry date. Banks, lenders and fintechs use it to onboard customers and run KYC checks without retyping. The MRZ's check digits let software catch a misread passport number or date.

Below, we cover the data page, the MRZ character by character, the checks to run on every passport and where Docsumo fits.

What is passport OCR?#

Passport OCR is optical character recognition applied to one page of the passport. That page is the data page, the one with the holder's photo. ICAO Doc 9303 is the international standard for machine readable passports. It splits the data page into a visual inspection zone (VIZ) of printed fields for people and a machine readable zone (MRZ) for machines.

MRZ OCR: how software reads the machine readable zone#

The MRZ is two lines of 44 characters in the OCR-B typeface. It uses only capital letters, digits and the filler character <. The MRZ was designed for OCR software to read. So when people ask "what is OCR in a passport?", they usually mean the MRZ.

Every field sits at a fixed position, so MRZ OCR doesn't have to guess where anything is. Line 1 holds the document type, the issuing country code and the name. Two fillers (<<) separate the surname from the given names. Line 2 holds the passport number, nationality, date of birth, sex, expiry date, personal number and check digits. The table gives the position of each.

Software computes each check digit from its field. It multiplies each character's value by 7, 3 and 1 in a repeating pattern, adds the results and keeps the last digit of the total. The figure below works through the birth date. When a recomputed digit doesn't match, one character was usually misread. Dates hold only digits, so a letter O in a date is a misread zero.

The MRZ alone won't fill a KYC record. It has no issue date, it drops accents, and it cuts long names short. Read the printed page too, and compare the two. The specimen below is issued by Utopia (UTO), the fictional country ICAO uses for sample documents.

Fields you can extract from a passport#

The data page holds three groups of printed fields, and the MRZ repeats most of them. That repetition is what makes a passport easy to check.

• Holder

  Surname and given names, nationality, date of birth and sex, plus place of birth and a personal number where the issuing country includes them.

• Document

  Document type (P for passport), issuing country code, passport number and issuing authority.

• Dates

  Birth, issue and expiry. Birth and expiry dates are also in the MRZ with check digits; the issue date is printed only.

For US banks, these fields line up with the Customer Identification Program (CIP) rule. A passport number and country of issuance can serve as a non-US customer's ID number. A bank that verifies identity with a passport records the document type and its number. It also records the place of issuance and the dates of issue and expiry. The issue date isn't in the MRZ, so reading the MRZ alone won't fill that record.

How to extract data from a passport with OCR#

Whatever tool you use, passport extraction runs through the same stages, from upload to your KYC or onboarding system.

1. CollectCustomers upload a phone photo or scan in your app or portal, or send it by email; put every file in one queue. Ask for photos without flash, since glare on the glossy page washes out characters.
2. Classify the pageFind the data page, and set aside other passport pages, visas or a different ID sent by mistake.
3. Read both zonesOCR reads the printed fields and the two MRZ lines. Extraction maps each value to a named field such as surname, passport number or date of birth.
4. CheckRecompute the MRZ check digits, then compare the MRZ with the printed fields and the application. On a worn or damaged page, a failed check digit points to the field to re-read.
5. Review and deliverFields that fail a check or were read with low confidence go to a person, with the value highlighted on the image. Everything else goes straight to your KYC or onboarding system.

Checks to run on every passport#

These are data checks. They catch misreads and mismatches between the passport and what the customer told you; they don't prove a passport is genuine.

• Check digitsRecompute the digits after the passport number, birth date, expiry date and personal number, and the composite digit that ends line 2. A mismatch usually means a misread, so re-read the field or send it for review.
• ExpiryThe passport is unexpired on the day you rely on it. The CIP rule names unexpired government-issued ID, such as a passport, as a document banks may use. MRZ dates use two-digit years (YYMMDD), so set the century before comparing.
• MRZ matches the printed pagePassport number, name, birth date, sex and expiry agree. Allow for ICAO's rules. The MRZ drops accents and apostrophes, so Ö can become OE or O. It turns hyphens into < and truncates names that don't fit in 39 characters.
• Matches the applicationName and date of birth agree with what the customer entered, and the nationality and issuing country are what you expect.
• Nothing missingEvery field your records need was read, including the issue date, which only the printed page carries.

Here's a second Utopia specimen, with its check digits recomputed and its printed page compared with the MRZ.

How to automate passport data extraction#

A passport rarely arrives alone. It comes with an application and often proof of address such as utility bills or bank statements. Docsumo reads the data page with a pre-trained passport model and handles any other document type, so the whole file is read together. A Python code step you add to the workflow can recompute the MRZ check digits and compare the MRZ with the printed fields. Fields below a per-field confidence threshold go to your reviewers. They click a field to see its source on the page, and their corrections improve the model. Data goes to your KYC, onboarding or loan system through the API and webhooks. On the Enterprise plan, cross-document validation can check the passport's name and date of birth against the application and other documents. Case management, also on the Enterprise plan, keeps each customer's file together.

Docsumo works with the data on the page; it isn't an identity verification tool. It doesn't read the passport's chip, inspect security features or match a selfie to the photo. Teams that need those add an ID verification provider; see the best KYC document verification software. Docsumo runs in the cloud only and is SOC 2 Type 2 audited and ISO/IEC 27001:2022 certified. It doesn't use customer documents to train shared or third-party models; see security.

Our take. Judge passport OCR by the whole onboarding file, not by the one page. A perfect read of the passport helps little if its name and birth date don't match the application. So set up the checks between documents first, then tune how each page is read.

If your team still retypes passport details#

Passport OCR turns a passport's data page into fields you can use, and the MRZ makes the result checkable. Recompute the check digits and compare the MRZ with the printed page and the application. Read the issue date from the printed page, and send only the mismatches to a person. When you also need to know the passport is genuine and belongs to the person presenting it, add identity verification.

Book a demo with a sample onboarding file, or start a free trial.

Frequently asked questions#