Redacting Passports and Government IDs Before Sharing

Redact Passport and ID: Remove Personal Identifiers from ID Document Scans

Passport scans are a primary target for identity theft. Sharing an unredacted passport scan over email, messaging apps, or cloud storage exposes the document number, nationality, full name, date of birth, and machine-readable zone: all the information needed to impersonate someone in certain identity verification contexts.

Redacting a government ID scan before sharing requires covering at minimum the document number, the photograph, and any biometric data. What you leave visible depends on the recipient's legitimate need. A landlord verifying age needs only the date of birth; they do not need the document number or photo. Drawing rectangles over unnecessary fields and exporting the raster PNG provides a legally adequate copy for most verification purposes while limiting exposure.¹

What to redact on a passport or government ID

Passport document numbers follow a specific pattern: US passports issued since 2021 use a nine-character perforated alphanumeric number (one letter followed by eight numbers) and enable fraudulent applications in some foreign jurisdictions.² The machine-readable zone at the bottom of the passport photo page encodes name, nationality, document number, date of birth, and expiry in a scannable format that software can extract in milliseconds. Cover the MRZ entirely when sharing a passport scan unless the recipient specifically requires it for verification.

Photograph, MRZ, and document number coverage

Dates of birth and expiry dates reveal age and validity period respectively. The photograph enables facial recognition correlation. Depending on the purpose of sharing, you may need to redact the photo, the MRZ, the document number, or all three. CapyToolkit's OCR Redactor covers each region with opaque rectangles in the exported raster image, so no software can recover the original content from the shared file.

Driver's license and national ID redaction

Driver's licenses contain a different but equally sensitive set of identifiers: license number, address, date of birth, and in some jurisdictions a digital fingerprint indicator or organ donor code. Sharing a license scan for age verification purposes requires only the date of birth to be visible. Cover the license number, home address, and any biometric indicator for a minimal disclosure that serves the age verification purpose without creating an identity theft risk. Building on this, national ID cards and residence permits carry unique national identification numbers that function as universal identifiers in many countries. Redact the national ID number and any biometric chip indicator unless the recipient has a legitimate regulatory requirement for it.

Workflow for ID document redaction

Scan or photograph the document and export as JPEG. Drop it onto the OCR Redactor drop zone. After OCR extracts text, draw rectangles over the document number, MRZ block, photograph area, and any additional fields your analysis determined should be covered.³ Review the text panel to confirm those fields are replaced with block characters. Export the PNG. For repeated ID verification workflows, you can establish a consistent checklist of fields to redact for each document type. Consequently, the same workflow applies regardless of which country's document you are processing, because the OCR Redactor has no built-in document type recognition and treats all regions as image areas you mark manually.

Passport structure under ICAO 9303 and the MRZ encoding format

ICAO Doc 9303 defines the physical layout and data encoding standard for Machine Readable Travel Documents, including the TD3 format used by standard passport booklets. A TD3 passport MRZ occupies two lines of 44 characters each on the biographical data page. The first line encodes document type, issuing state, surname, and given names using uppercase Latin letters, digits, and a filler character. The second line encodes passport number, nationality, date of birth, sex, expiry date, and personal number, along with four check digits at positions 10, 20, 28, and 43 plus a composite check digit at position 44.⁴

Why the MRZ requires redaction even when visual fields are covered

The MRZ must be redacted for most disclosure purposes because any MRZ parser can recover all encoded identity fields from those two text lines in milliseconds. Covering only the photographed face and the printed document number in the visual zone is insufficient: a recipient with scanning software recovers the passport number, date of birth, personal number, and expiry date from the machine-readable zone. Your redaction rectangle must span the entire two-line MRZ block at the bottom of the biographical data page to prevent this recovery.

Minimum disclosure principles for remote verification contexts

Remote verification workflows often require only that a document is genuine and unexpired and that the holder's name matches a self-declaration. A contractor submitting a passport scan to prove right-to-work eligibility, for example, does not need to share their passport number, date of birth, personal number, or MRZ with the verifying party. Sharing only the minimum necessary fields is both a privacy principle under GDPR Article 5(1)(c) and a practical limit on damage if the received copy is later exposed in a data breach.¹

Applying minimum disclosure in the OCR Redactor

In the OCR Redactor, draw rectangles over the passport number field in the visual data zone, the date of birth, the personal number field, the entire MRZ block, and the holder photograph. Leave the holder name, issuing country label, and expiry date visible if the verification workflow requires those fields. Export the PNG and confirm the remaining visible fields are limited to exactly what the receiving party needs for the stated verification purpose. This check takes under two minutes and produces a disclosure-ready image that carries no more identity information than the transaction requires.

The two-minute review step is worth doing before every share. CapyToolkit's OCR Redactor shows the covered words in the text panel as you draw, so you can confirm the remaining visible fields match the stated purpose rather than guessing from the image alone. Treat any field outside the recipient's need as something to cover, because a smaller disclosure footprint reduces the harm if the copy is later leaked or mishandled, so strip a passport's MRZ and photo first before sharing anything.

When to use this

Use this tool when you must share a copy of a passport or government ID with a landlord, employer, platform, or counterparty but want to minimize the personal information disclosed beyond what the specific purpose requires.

Examples