Machine Readable Zone (MRZ)
The machine-readable zone (MRZ) is the block of monospaced text at the bottom of a passport’s identity page or the back of an ID card, encoding the holder’s key details in a fixed format defined by ICAO Doc 9303. It exists so a machine can read the document without interpreting the printed layout, and so the printed layout can be checked against something.
| Standard | ICAO Doc 9303 |
| Font | OCR-B, monospaced, fixed pitch |
| TD1 format | Three lines of 30 characters — ID cards |
| TD2 format | Two lines of 36 characters — older ID and travel documents |
| TD3 format | Two lines of 44 characters — passports |
| Encoded fields | Document type, issuing state, name, document number, nationality, date of birth, sex, expiry date, optional data |
| Filler character | < — used for padding and as a separator |
| Integrity mechanism | Check digits over individual fields and a composite check digit |
| Chip relationship | The MRZ supplies the key that unlocks an ePassport chip |
| What it is not | Encrypted, signed, or a security feature in itself |
How it works
The MRZ is a fixed-width transcription, not a compression. Every field sits at a defined character offset, padded with the filler character < where it does not fill its allocation. A parser does not search for a name; it reads characters 6 through 44 of line one and knows that is where the name lives. Names are transliterated into a restricted character set, which is why diacritics disappear and why some names are truncated.
Check digits are the interesting part. Individual fields — document number, date of birth, expiry — each carry a check digit computed with a weighted 7-3-1 scheme, and a final composite digit covers several fields together. A single mistyped character produces a check digit mismatch immediately, which is what makes MRZ parsing reliable enough to build workflows on.
The MRZ also does a job that has nothing to do with reading text. On a biometric passport, the key that unlocks the chip is derived from MRZ fields, so a reader must optically scan the printed zone before the chip will respond at all. That is the mechanism preventing a passport from being read through a bag — the chip will not talk to anyone who has not already seen the page.
Why it matters for identity verification
The MRZ’s value is redundancy. It duplicates what is printed above it, which means the two can be compared — and a mismatch between the printed date of birth and the encoded one is a tampering signal available in milliseconds.
That cross-check catches a specific and common attack: altering the printed data on a genuine document. Changing a printed date of birth is comparatively easy. Recomputing the MRZ, including its check digits, and reprinting it in OCR-B at the correct pitch is meaningfully harder, and forgers routinely skip it. The result is a document whose two halves disagree.
Remotely, the MRZ is unusually well-behaved. It is high-contrast monospaced text designed for machine reading, so it survives a phone photograph better than almost any other element on the page — the security features degrade under compression and poor lighting, and the MRZ largely does not. That makes reading and cross-checking the MRZ one of the most dependable signals available in a remote flow, and Microblink’s identity verification workflow treats a printed-to-encoded mismatch as a strong reject.
MRZ vs the barcode on a driver’s license
| Machine-readable zone | PDF417 barcode | |
|---|---|---|
| Where | Passports and ID cards, ICAO standard | North American driver’s licenses, AAMVA standard |
| Form | Human-readable OCR-B text | Two-dimensional barcode |
| Standard | ICAO Doc 9303 | ISO/IEC 15438 with AAMVA data rules |
| Error handling | Check digits per field plus a composite | Reed–Solomon error correction |
| Unlocks a chip | Yes, on ePassports | No |
| Readable by eye | Yes, with effort | No |
| Encrypted | No | No |
Both exist for the same reason and neither is a security feature. They duplicate the printed data so a machine can read it quickly and so the two copies can be compared.
What it can’t do
It is not encrypted or signed. Anyone can compose a valid MRZ, including correct check digits, from arbitrary data. The check digits protect against transcription errors, not against forgery — they prove the text is internally consistent, not that it is true.
A valid MRZ does not mean a valid document. A completely fabricated passport can carry a perfectly well-formed machine-readable zone. Its value comes entirely from being compared against something else: the printed page, the chip, or an issuer record.
It loses information about the name. Transliteration into a restricted character set strips diacritics and truncates long names to fit. An MRZ name that does not exactly match a printed name may reflect the standard working as designed rather than tampering, which is a frequent source of false positives.
It says nothing about the bearer. The MRZ describes the document holder as recorded at issue. Whether the person presenting it is that holder is a biometric question the zone cannot address.
Frequently asked questions
What does the MRZ on a passport contain?
Document type, issuing state, holder’s name, document number, nationality, date of birth, sex, expiry date, and optional data such as a personal number — plus check digits over several of those fields.
Why do the two lines of an MRZ contain so many angle brackets?
The < character is the filler. Every field occupies a fixed number of characters, so anything shorter is padded, and the same character separates surname from given names.
Can the MRZ be faked?
Yes. It is neither encrypted nor signed, so a valid MRZ can be composed from any data with correctly computed check digits. Its usefulness comes from comparing it against the printed page or the chip, not from the zone itself.
Does every ID document have a machine-readable zone?
No. Passports carry one under ICAO standards, and many national ID cards do. U.S. driver’s licenses generally do not — they use a PDF417 barcode on the reverse instead.
Related reading
- PDF417 — the equivalent cross-check on North American licenses
- Biometric passport — where the MRZ doubles as the chip key
- Document capture — getting an image good enough to parse the zone
- Identity document verification — how the cross-check fits the wider flow
