What Is the Machine Readable Zone (MRZ) on a Passport?

INTERPOL’s database of stolen and lost travel documents holds over 138 million records. In 2023 alone, law enforcement officers queried it 3.6 billion times, flagging more than 232,000 compromised passports at border checkpoints worldwide. Every one of those checks starts with the same two printed lines at the bottom of the passport’s identity page. Those two lines are the Machine Readable Zone.

Understanding what MRZ data contains, what it omits, and how automated systems validate it is the foundation for any organisation running document-based identity checks.

What is MRZ in passport?

The Machine Readable Zone (MRZ) is a standardised strip at the bottom of a machine-readable passport or identity document, consisting of two or three rows of OCR-readable characters that encode the holder’s core identity data, following formats defined by ICAO Doc 9303.

What does the MRZ actually contain?

The MRZ is not a separate security element. It is a printed, machine-readable copy of the data already visible in the document’s Visual Inspection Zone (VIZ). Both zones carry the same core identity fields, including surname and given names, document number, nationality, date of birth, gender, and document expiry date. The MRZ does not store biometric data, photographs, or the holder’s address.

Each character position in the MRZ is fixed by ICAO Doc 9303, 8th edition, which took effect in January 2026. The standard defines three document types. Type 3 is the standard passport booklet, with two lines of 44 characters each. Smaller, credit-card-sized documents fall under Type 1, using three lines of 30 characters each. Relatively rare in practice, Type 2 covers documents with two lines of 36 characters.

The check digit: the MRZ’s built-in tamper signal

Each data field in the MRZ is followed by a check digit, calculated from the preceding characters using a weighted modulo-10 algorithm. Individual check digits cover the document number, date of birth, expiry date, and optional data fields. A composite check digit then covers the entire MRZ.

If anyone physically alters a printed MRZ field, the check digit for that field will no longer match. An OCR system that recalculates all five check digits can detect most surface-level document tampering without any secondary intelligence. This is why MRZ check-digit validation has become a standard step in automated document verification workflows.

How MRZ readers extract and validate passport data?

A dedicated MRZ reader, or an OCR-based verification system, processes a document image in three sequential stages.

Step 1: Capture and Segmentation

Using the MRZ zone’s fixed position relative to the document type, the system locates and isolates it for recognition. High-resolution capture matters here because worn documents, glare, and lens distortion all affect character accuracy.

Step 2: Character Recognition

OCR technology converts the MRZ characters to text. The MRZ uses the OCR-B typeface, a font designed for machine readability with minimal character ambiguity. This design choice is what made early automated passport scanning viable with 1980s-era optical hardware.

Step 3: Validation

Every check digit is recalculated from the extracted characters and compared against the printed values. The system also cross-checks MRZ data against VIZ fields visible elsewhere on the document and tests for internal date consistency. A mismatch at any point triggers a rejection flag or a manual review queue.

Where MRZ falls short and what that means for fraud?

MRZ validation confirms that the printed data is internally consistent. It does not confirm that the document is genuine.

A skilled counterfeiter can produce an entirely fabricated identity page carrying a valid MRZ, because the check-digit algorithm is publicly documented. The MRZ cannot tell a verification system whether the document number belongs to a real issued passport, whether that passport has been reported stolen, or whether the person presenting it is the rightful holder.

This is why MRZ extraction is treated as a baseline, not a complete check. Full passport verification adds layers on top by cross-referencing against databases like INTERPOL’s SLTD, reading the digitally signed chip data in ePassports, and running biometric face matching against the document photo.

Most passports issued today contain an embedded NFC chip alongside the MRZ. The chip stores a cryptographically signed copy of the holder’s data, including a facial image, protected by digital signatures from the issuing country’s certificate authority. NFC verification reads this chip directly and validates the signature chain, providing a level of assurance that no printed MRZ can replicate.

Opportunities and Challenges MRZ has in automated KYC and remote onboarding

For organisations running remote Know Your Customer, MRZ extraction is typically the first data-capture step in a document submission flow. When a user photographs or scans their passport, an automated system reads the MRZ before anything else. The extracted fields pre-populate the identity record, the check digits confirm field integrity, and the document type is established for the stages that follow.

ICAO required all 193 member states to issue only machine-readable passports from 2010 and set a hard expiry deadline for non-machine-readable passports of November 2015. Any passport presented through a remote onboarding flow today should be fully machine-readable. The variation across compliance programs lies in how much additional validation is applied beyond the MRZ layer.

For KYC purposes under FATF customer identification standards, MRZ extraction eliminates manual data entry errors and speeds processing. It stops well short of meeting the document authenticity checks most financial regulators expect. Effective document verification combines MRZ data extraction with forensic image analysis, NFC chip reading where available, and liveness-checked biometric matching to confirm that the person submitting the document matches its recorded holder.

Shufti’s approach to document verification

Forged passports can carry a valid MRZ, stolen documents pass check-digit tests, and chip-less documents leave a verification gap that only forensic image analysis can close. Shufti’s document verification reads RZ data, recalculates all check digits, cross-references against 10,000+ document templates across 240+ countries and territories, and chains into NFC chip reading and face matching through a single API call.

Request a demo to run your passport flows against the full pipeline and see where your current process stops and where a layered approach picks up.

What Is the Machine Readable Zone (MRZ) on a Passport?

• The MRZ is the two-line OCR strip at the bottom of a passport’s identity page, defined by ICAO Doc 9303.
• It encodes the holder’s name, document number, nationality, date of birth, gender, and expiry, each protected by check digits that flag tampering.
• MRZ extraction confirms the printed data is internally consistent; it does not confirm the document is genuine. Treat it as the first layer of a verification stack, not the only one.

INTERPOL’s database of stolen and lost travel documents holds over 138 million records. In 2023 alone, law enforcement officers queried it 3.6 billion times, flagging more than 232,000 compromised passports at border checkpoints worldwide. Every one of those checks starts with the same two printed lines at the bottom of the passport’s identity page. Those two lines are the MRZ on passport pages, the Machine Readable Zone.

Understanding what MRZ data contains, what it omits, and how automated systems validate it is the foundation for any organisation running document-based identity checks.

What is MRZ in passport?

The Machine Readable Zone (MRZ) is a standardised strip at the bottom of a machine-readable passport or identity document, consisting of two or three rows of OCR-readable characters that encode the holder’s core identity data, following formats defined by ICAO Doc 9303. In plain terms, the MRZ passport meaning is simple: it is a machine-readable copy of the human-readable data printed on the same page, designed so border systems and automated readers can pull identity fields in milliseconds.

What does the MRZ actually contain?

The MRZ on a passport is not a separate security element. It is a printed, machine-readable copy of the data already visible in the document’s Visual Inspection Zone (VIZ). Both zones carry the same core identity fields, including surname and given names, document number, nationality, date of birth, gender, and document expiry date. The MRZ does not store biometric data, photographs, or the holder’s address.

Each character position in the MRZ is fixed by ICAO Doc 9303, 8th edition, which took effect January 2026. The standard does not define a single layout, it defines a family of formats for different document categories. Knowing which format you are reading is the first step in any verification flow.

Types of MRZs used today

ICAO Doc 9303 defines three machine-readable travel document (MRTD) formats, plus dedicated layouts for machine-readable visas. Each has its own line count, character length, and field positions. A verification system that assumes “passport” will misread an ID card or a visa, so format detection has to happen before character parsing.

TD1 (Type 1) – 3 lines × 30 characters

The smallest layout, designed for credit-card-sized documents. TD1 is the format you’ll see on most national ID cards, US Permanent Resident Cards (“green cards”), and many residence permits and crew member certificates. The compressed three-line structure squeezes the same core fields into a smaller footprint.

TD2 (Type 2) – 2 lines × 36 characters

The least common of the three. TD2 covers a small group of legacy ID booklets and some older official travel documents. New issuance is rare, but verification flows still see TD2 documents in circulation, particularly from holders whose IDs were issued before the global TD1 migration.

TD3 (Type 3) – 2 lines × 44 characters

The standard passport booklet format. If your verification flow processes passports, TD3 will be the dominant format you encounter. Every ICAO-compliant passport issued today uses this layout, regardless of the issuing country, which is why most engineers use “MRZ” and “TD3” interchangeably even though the two are not the same thing.

MRV-A and MRV-B – machine-readable visas

Visa stickers affixed to passport pages also carry their own MRZ. MRV-A uses two lines of 44 characters (matching TD3 dimensions), while MRV-B uses two lines of 36 characters. Verification systems handling business travel, immigration, or cross-border financial onboarding need to recognise visa MRZs separately from the passport MRZ on the same document.

The takeaway: The MRZ code passport readers parse is not a single fixed structure. It is a family of formats, and verification accuracy depends on detecting the correct format before character parsing begins.

The check digit: the MRZ’s built-in tamper signal

Each data field in the MRZ is followed by a check digit, calculated from the preceding characters using a weighted modulo-10 algorithm. Individual check digits cover the document number, date of birth, expiry date, and optional data fields. A composite check digit then covers the entire MRZ.

If anyone physically alters a printed MRZ field, the check digit for that field will no longer match. An OCR system that recalculates all five check digits can detect most surface-level document tampering without any secondary intelligence. This is why MRZ check-digit validation has become a standard step in automated document verification workflows.

How MRZ readers extract and validate passport data

A dedicated MRZ reader, or an OCR-based verification system, processes a document image in three sequential stages.

Step 1: Capture and Segmentation

Using the MRZ zone’s fixed position relative to the document type, the system locates and isolates it for recognition. High-resolution capture matters here because worn documents, glare, and lens distortion all affect character accuracy.

Step 2: Character Recognition

OCR technology converts the MRZ characters to text. The MRZ uses the OCR-B typeface, a font designed for machine readability with minimal character ambiguity. This design choice is what made early automated passport scanning viable with 1980s-era optical hardware.

Step 3: Validation

Every check digit is recalculated from the extracted characters and compared against the printed values. The system also cross-checks MRZ data against VIZ fields visible elsewhere on the document and tests for internal date consistency. A mismatch at any point triggers a rejection flag or a manual review queue.

Passport MRZ code explained: where MRZ falls short and what that means for fraud

MRZ validation confirms that the printed data is internally consistent. It does not confirm that the document is genuine.

A skilled counterfeiter can produce an entirely fabricated identity page carrying a valid MRZ, because the check-digit algorithm is publicly documented. The MRZ code on a passport cannot tell a verification system whether the document number belongs to a real issued passport, whether that passport has been reported stolen, or whether the person presenting it is the rightful holder.

This is why MRZ extraction is treated as a baseline, not a complete check. Full passport verification adds layers on top by cross-referencing against databases like INTERPOL’s SLTD, reading the digitally signed chip data in ePassports, and running biometric face matching against the document photo.

Most passports issued today contain an embedded NFC chip alongside the MRZ. The chip stores a cryptographically signed copy of the holder’s data, including a facial image, protected by digital signatures from the issuing country’s certificate authority. NFC verification reads this chip directly and validates the signature chain, providing a level of assurance that no printed MRZ can replicate.

Opportunities and challenges MRZ has in automated KYC and remote onboarding

For organisations running remote KYC, MRZ extraction is typically the first data-capture step in a document submission flow. When a user photographs or scans their passport, an automated system reads the MRZ before anything else. The extracted fields pre-populate the identity record, the check digits confirm field integrity, and the document type is established for the stages that follow.

ICAO required all 193 member states to issue only machine-readable passports from 2010 and set a hard expiry deadline for non-machine readable passports of November 2015. Any passport presented through a remote onboarding flow today should be fully machine-readable. The variation across compliance programmes lies in how much additional validation is applied beyond the MRZ layer.

For KYC purposes under FATF customer identification standards, MRZ extraction eliminates manual data entry errors and speeds processing. It stops well short of meeting the document authenticity checks most financial regulators expect. Effective document verification combines MRZ data extraction with forensic image analysis, NFC chip reading where available, and liveness-checked biometric matching to confirm that the person submitting the document matches its recorded holder.

Shufti’s approach to document verification

Forged passports can carry a valid MRZ, stolen documents pass check-digit tests, and chip-less documents leave a verification gap that only forensic image analysis can close. Shufti’s document verification reads MRZ data, recalculates all check digits, cross-references against 10,000+ document templates across 240+ countries and territories, and chains into NFC chip reading and face matching through a single API call.

Request a demo to run your passport flows against the full pipeline and see where your current process stops and where a layered approach picks up.