How to read the MRZ on a passport or ID card, line by line
What each block of characters means, how the check digits work, and why a half-covered strip still leaks.
Short answer
YYMMDD and < is the filler that pads every unused position.- Every field in the second line is followed by a check digit, so covering a number but leaving its check digit lets someone test guesses against it.
<is not decoration — it is the filler character, and it counts as zero when a check digit is calculated.- On an ID card the strip is on the back, so redacting only the front leaves the whole machine-readable record intact.
Most guides — including ours — tell you to cover the machine-readable zone and leave it there. This one decodes it, because once you can see what each block of characters is, it becomes obvious why covering most of the strip is not the same as covering it.
Everything below comes from ICAO Doc 9303, the standard every machine-readable travel document follows. It is public, and it is the reason a scanner in one country can read a passport issued by another.
Where the strip is, and how big
Two sizes cover almost everything in a wallet:
| Document | Lines | Characters per line | Where |
|---|---|---|---|
| Passport (TD3) | 2 | 44 | Bottom of the photo page |
| ID card (TD1) | 3 | 30 | Back of the card |
Part 3 of the standard states the rule directly: machine readable data is arranged “in two lines (upper and lower) except for TD1 size travel documents where there are three lines”. And Part 5, which covers card-sized documents, is equally blunt about where it sits: “The MRZ is located on the back of the TD1.”
That single sentence is why so many redacted ID cards leak. People photograph the front, cover the number, and never turn the card over.
- Cover before sharing
- Usually safe to leave visible
Line 1 — the name line
On a passport, the first line breaks down like this:
- Positions 1–2 — the document code.
Pfor a passport, padded with<. - Positions 3–5 — the issuing State or organisation, as a three-letter code.
- Positions 6–44 — your name, 39 characters for everything.
The name is not written the way you write it. Your surname comes first, then two filler characters (<<), then your given names, with a single < between each component. Anything left over is padded with < to position 44. Diacritics are stripped: the standard does not permit them, because they “would confuse machine-reading equipment”.
So a long name gets truncated rather than wrapped — and the standard is specific that when it does, the last character has to be a letter, which is itself the signal that truncation happened.
Line 2 — the data line
This is the line that matters. On a passport, every field has a fixed home:
| Positions | What it holds |
|---|---|
| 1–9 | Document number |
| 10 | Check digit for the document number |
| 11–13 | Nationality (three-letter code) |
| 14–19 | Date of birth, as YYMMDD |
| 20 | Check digit for the date of birth |
| 21 | Sex — F, M, or < for unspecified |
| 22–27 | Expiry date, as YYMMDD |
| 28 | Check digit for the expiry date |
| 29–42 | Personal number or other optional data |
| 43 | Check digit for that optional field |
| 44 | Composite check digit over positions 1–10, 14–20 and 22–43 |
Dates are six digits, year first: 12 July 1942 is 420712. Which means a two-digit year — the standard’s own worked example — and no century. That ambiguity is the machine’s problem, not yours.
How the check digits actually work
Five of the 44 characters in that line are check digits, and they are not a hash or a signature. The calculation is simple enough to do on paper, and Part 3, section 4.9 spells it out in four steps: going left to right, multiply each character by a repeating weighting of 7, 3, 1; add the products; divide by 10; the remainder is the check digit.
Two rules make it work on text as well as numbers:
- Letters are valued A = 10 through Z = 35.
- The filler
<is given the value of zero.
That is the whole algorithm. It exists so a reader can tell it has parsed the strip correctly — the standard says the digits “permit readers to verify that data in the MRZ is correctly interpreted”.
Why this changes how you redact
Here is the part no MRZ explainer written for developers bothers with.
A check digit does not contain the value it protects. But it does let anyone test a guess against it, and discard roughly nine of every ten wrong ones for free. Leave the document number covered but its check digit at position 10 visible, and you have handed over a way to grade attempts. Leave position 44 visible — the composite digit, computed across the document number, the date of birth and the expiry date together — and you have handed over a way to grade attempts at all three at once.
None of this makes a partly redacted copy instantly readable. It makes it checkable, which is exactly the property you were trying to remove.
So the rule stays what it was, and now it has a reason behind it: cover the entire strip, every line, edge to edge. Not the numbers with the check digits peeking out. Not two lines of three. For how to do that on the rest of the document, see how to redact a passport or ID card — and remember that a solid box beats a blur, for reasons we cover separately.
Anonymize my ID covers the full strip on both sides of a card, on-device, without uploading the photo anywhere.
Frequently asked questions
How many lines and characters does an MRZ have?
It depends on the document size defined by ICAO Doc 9303. A passport (TD3) has two lines of 44 characters at the bottom of the photo page. A credit-card-sized ID (TD1) has three lines of 30 characters, printed on the back of the card. ICAO Doc 9303 Part 3 puts it plainly: the data is arranged in two lines, except for TD1 documents, where there are three.
What do the < characters in an MRZ mean?
The < is the filler character. It pads any field that does not fill its allotted positions, separates the components of your name, and marks a sex field left unspecified. Two of them together (<<) separate your surname from your given names. It is not an error or a redaction — and when a check digit is calculated, each < counts as zero.
How is an MRZ check digit calculated?
ICAO Doc 9303 Part 3 specifies it: take the characters of the field, multiply each in turn by a repeating weighting of 7, 3, 1, add the products, divide by 10, and the remainder is the check digit. Letters are valued A=10 through Z=35, and the filler < counts as zero.
Why does a partly covered MRZ still matter?
Because the check digits stay behind. A check digit does not reveal the value it protects, but it does let someone verify a guess and throw out nine of every ten wrong ones — and the composite digit at the very end is computed across the document number, date of birth and expiry date together. Cover the whole strip, edge to edge, on every line.