Passport machine-readable zone (MRZ): format, validation and detection

What it is

The machine-readable zone at the foot of a passport's photo page carries the data in a fixed layout. Maskflare's Global pack detects it, and the HIPAA Safe Harbor, GDPR (EU/EEA), UK GDPR, US personal data and Swiss nDSG health profiles include the pack.

In Maskflare this is the detector passport_mrz, labelled "Passport machine-readable zone (MRZ, ICAO 9303 TD3)", category id document number, in the Global pack.

Format and layout

• Two lines of 44 characters. Line one starts with P and carries the name, with << between surname and given names. The detector also accepts line two on its own.
• Line two holds the passport number, nationality, date of birth, sex, expiry and optional personal number, with check digits after the fields.
• The text can be separated by a newline, whitespace or an escaped newline.

How the check works

Each field's check digit is computed with weights 7, 3, 1 repeating over the field's characters (digits as themselves, letters as 10 to 35, the filler < as 0), summed modulo 10. Maskflare checks the check digits for the document number, birth date, expiry date and personal number, the composite check digit, and that both dates are real.

Valid and invalid examples

In running text the valid example reads, for instance, passport: P<UTOERIKSSON<<ANNA<MARIA<<<<<<<<<<<<<<<<<<< L898902C36UTO7408122F1204159ZE184226B<<<<<10. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.

Regex and validation caveats

• The example is a fictional test value with a made-up issuing state code (UTO) and a made-up name, so it should identify no real person.
• OCR errors in an MRZ copied from a scan break the check digits, so a damaged MRZ can slip through.
• A passport number on its own, outside an MRZ, is not covered by this detector.

How to detect it in LLM traffic

Passport machine-readable zone (MRZ) text comes from scanned documents and photos that were run through OCR, and from forms people paste whole. The risk is the same in either case: the model receives a document's full identity block, not just the question about it.

Maskflare scans the text of the request, including text extracted from attached files and images, and replaces each match with a token before the request is forwarded.

If you build the detection yourself

1. Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
2. Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Passport machine-readable zone (MRZ) candidates.
3. Apply the layout rules from the section above. This identifier has no check digit to recompute, so expect more look-alikes than with a checksum-based format.
4. Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.

How Maskflare handles it

• Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token).
• Monitor first: alert (counted, forwarded unchanged).

The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.

Compliance profiles that include it

5 of the 6 compliance profiles include the Global pack, and applying them turns this detector on: HIPAA Safe Harbor, GDPR - EU/EEA, UK GDPR, US personal data and Switzerland - nDSG health data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.