Passport OCR: how to extract data from a passport's data page and MRZ

Passport OCR is how you extract data from a passport automatically: it reads the data page, both the printed fields and the two-line machine readable zone (MRZ) at the bottom, and turns them into structured fields such as name, nationality, date of birth, passport number and expiry date. Banks, lenders and fintechs use it to onboard customers and run KYC checks without retyping passport details. The MRZ's check digits also let software catch misreads in the passport number and dates.

This guide shows what's on the data page, which fields to extract, how extraction works, the checks to run on every passport and where Docsumo fits.

What is passport OCR?#

Passport OCR is optical character recognition applied to one page: the passport's data page, the one with the holder's photo. ICAO Doc 9303, the international standard for machine readable passports, splits that page into a visual inspection zone (VIZ) of printed fields for people and a machine readable zone (MRZ) for machines.

The MRZ is two lines of 44 characters in the OCR-B typeface, using only capital letters, digits and the filler character <. It repeats the key printed fields in fixed positions, so software doesn't have to guess where anything is. That's also the usual answer to "what is OCR in a passport?": the MRZ was designed to be read by OCR. The specimen below is issued by Utopia (UTO), the fictional country ICAO uses for sample documents.

Fields you can extract from a passport#

The data page holds three groups of printed fields, and the MRZ repeats most of them. That repetition is what makes a passport easy to check.

• Holder

  Surname and given names, nationality, date of birth and sex, plus place of birth and a personal number where the issuing country includes them.

• Document

  Document type (P for passport), issuing country code, passport number and issuing authority.

• Dates

  Birth, issue and expiry. Birth and expiry dates are also in the MRZ with check digits; the issue date is printed only.

• MRZ

  Line 1 carries the document type, issuing country and name. Line 2 carries the passport number, nationality, birth date, sex, expiry date and optional personal number, with check digits.

For US banks, these fields line up with the Customer Identification Program (CIP) rule. A passport number and country of issuance can serve as a non-US customer's identification number, and a bank that verifies identity with a passport records the document type, its number, the place of issuance and the dates of issue and expiry. The issue date isn't in the MRZ, so reading the MRZ alone won't fill that record.

How to extract data from a passport with OCR#

Whatever tool you use, passport extraction runs through the same stages, from upload to your KYC or onboarding system.

1. CollectCustomers upload a phone photo or scan in your app or portal, or send it by email; put every file in one queue. Ask for photos without flash, since glare on the glossy page washes out characters.
2. Classify the pageFind the data page, and set aside other passport pages, visas or a different ID sent by mistake.
3. Read both zonesOCR reads the printed fields and the two MRZ lines, and extraction maps each value to a named field such as surname, passport number or date of birth.
4. CheckRecompute the MRZ check digits, then compare the MRZ with the printed fields and the application. On a worn or damaged page, a failed check digit points to the field to re-read.
5. Review and deliverFields that fail a check or were read with low confidence go to a person, with the value highlighted on the image. Everything else goes straight to your KYC or onboarding system.

Checks to run on every passport#

These are data checks. They catch misreads and mismatches between the passport and what the customer told you; they don't prove a passport is genuine.

• Check digitsRecompute the digits after the passport number, birth date, expiry date and personal number, and the composite digit that ends line 2. A mismatch usually means a misread, so re-read the field or send it for review.
• ExpiryThe passport is unexpired on the day you rely on it: the CIP rule names unexpired government-issued ID, such as a passport, as a document banks may use. MRZ dates use two-digit years (YYMMDD), so set the century before comparing.
• MRZ matches the printed pagePassport number, name, birth date, sex and expiry agree. Allow for ICAO's rules: the MRZ drops accents and apostrophes (Ö can become OE or O), turns hyphens into <, and truncates names that don't fit in 39 characters.
• Matches the applicationName and date of birth agree with what the customer entered, and the nationality and issuing country are what you expect.
• Nothing missingEvery field your records need was read, including the issue date, which only the printed page carries.

Here's a second Utopia specimen with its check digits recomputed and its printed page compared with the MRZ:

How to automate passport data extraction#

A passport rarely arrives alone: it comes with an application and often proof of address such as utility bills or bank statements. Docsumo reads the data page with a pre-trained passport model and handles any other document type, so the whole file is read together. A code step you add to the workflow can recompute the MRZ check digits and compare the MRZ with the printed fields. Fields below a per-field confidence threshold go to your reviewers, who click a field to see its source on the page; their corrections improve the model. Data goes to your KYC, onboarding or loan system through the API and webhooks. On the Enterprise plan, cross-document validation can check the passport's name and date of birth against the application and other documents, and case management keeps each customer's file together.

Docsumo works with the data on the page; it isn't an identity verification tool. It doesn't read the passport's chip, inspect security features or match a selfie to the photo, so teams that need those add an ID verification provider (see the best KYC document verification software). It runs in the cloud only, is SOC 2 Type 2 audited and ISO/IEC 27001:2022 certified, and doesn't use customer documents to train shared or third-party models; see security.

The bottom line#

Passport OCR turns a passport's data page into fields you can use, and the MRZ makes the result checkable. Recompute the check digits, compare the MRZ with the printed page and the application, read the issue date from the printed page, and send only the mismatches to a person. When you also need to know the passport is genuine and belongs to the person presenting it, add identity verification.

Book a demo with a sample onboarding file, or start a free trial.

Frequently asked questions#