Reading the MRZ: How to Verify a Passport Like a Border Officer

The two lines of letters, digits, and angle brackets at the bottom of a passport photo page look like machine gibberish. They are the opposite: the machine-readable zone (MRZ) is a self-checking data structure, standardized worldwide, that lets anyone with the format in hand verify a passport's internal consistency in about a minute. Border officers do it with a swipe. You can do it with a pencil — and most counterfeiters still get it wrong.

If you accept passports as identity documents — for onboarding, KYC, tenant screening, right-to-work checks — the MRZ is the highest-value sixty seconds you can spend on the page.

Key takeaways

• The MRZ encodes name, document number, nationality, date of birth, sex, and expiry in a fixed layout with check digits over the critical fields.
• The check digits are computed with a public weighted algorithm — a fake with an invented document number usually fails the math.
• The MRZ must agree with the visual zone: every mismatch between the printed fields and the encoded fields is a red flag, not a typo.
• MRZ-valid does not mean genuine — it means internally consistent. It is a screen that catches lazy fakes, not a substitute for chip or source verification.

What the MRZ actually contains

A passport MRZ is two lines of 44 characters each, in a fixed international layout. Line one carries the document type, issuing state, and the holder's name, padded with < filler characters. Line two carries the document number, nationality, date of birth, sex, expiry date, an optional personal number — and, crucially, a check digit after the document number, the birth date, the expiry date, plus a composite check digit over most of the line.

The check digit algorithm is public: each character is converted to a value (digits as themselves, A=10 through Z=35, <=0), multiplied by a repeating weight of 7, 3, 1, and the sum is taken modulo 10. That single digit is remarkably good at catching fabrication, because a forger who invents a document number or shifts a birth year has to recompute every dependent digit — and template-shop fakes frequently don't.

The one-minute check

1. Recompute one check digit. Take the document number field and run the 7-3-1 math. If it fails, stop — you're done, and not in a good way.
2. Compare MRZ to visual zone. The printed name, number, dates, and sex must match what the MRZ encodes exactly. Transliteration follows fixed rules, so "close" is not a pass.
3. Check the dates against the person and the document. A birth date that makes the holder the wrong age, an expiry more than ten years out for an adult passport, an issue/expiry pair that doesn't match the issuing country's validity rules — all cheap tells.
4. Look at the typography of the zone itself. The MRZ is printed in a fixed monospaced OCR font at a fixed position. Proportional spacing, wrong glyph shapes, or a zone that sits visibly off-position betrays a rebuilt page.

Where fakes fail

Counterfeit passports cluster into three failure modes. Cheap fakes fail the math — the check digits simply don't verify, because the template was filled in by hand. Mid-tier fakes pass the math but fail agreement: the forger altered the visual zone (a new photo, a changed name) and left the original MRZ, so the two zones describe different people. Better fakes pass both, which is why the MRZ is a screen and not a verdict: a consistent MRZ tells you the document agrees with itself, not that the issuing state ever printed it. Law enforcement databases of stolen and lost travel documents exist precisely for that last gap — INTERPOL's SLTD database (interpol.int) is checked billions of times a year by border systems.

Beyond the two lines

Modern passports carry a contactless chip holding the same data signed by the issuing authority, and standards bodies publish extensive guidance on identity document verification and the biometric formats involved (nist.gov). If your process can read the chip, the cryptographic signature beats any visual inspection. If it can't, the MRZ plus a hard look at the photo page — pattern continuity, intact laminate, consistent personalization printing — is a defensible manual baseline. The same layered logic applies to simpler documents too; it's the approach we walk through in how to spot a fake ID.

The document tells on itself

The MRZ is a gift: a public, deterministic, self-checking structure that a forger must get perfectly right and frequently doesn't. Most document types have no equivalent — an invoice or a bank letter carries no check digits — which is why forensic analysis of the file itself matters so much everywhere else. When a passport page arrives as a scan or photo inside a PDF, the file's own history (edits, layers, generator traces) becomes a second MRZ of sorts: structure that has to be consistent, and usually isn't when someone has been in there. That structural read is exactly what an automated document forensics pass adds on top of the sixty seconds you now know how to spend on the zone itself.