MRZ Validator

MRZ validation has two layers. First, structural checks ensure the input has the right number of lines and characters, and uses only A–Z, 0–9 and the filler <. Then, each numeric field is recomputed with ICAO 9303's weighted algorithm: character values are multiplied by repeating weights 7, 3, 1 and the sum modulo 10 must equal the printed check digit.

For TD1, TD2 and TD3 documents there's also a composite check digit that protects the document number, date of birth, expiry date and optional data together.

This last check is especially useful when deciding whether to trust a borderline read. A single mis‑scanned character will usually break not just one, but several of the protected fields and the composite digit at the same time. That means MRZ validation can turn a fuzzy OCR result into a clear yes/no signal: either the data is self‑consistent according to ICAO 9303, or it is not.

In practice, this makes MRZ validation one of the most cost‑effective safeguards you can add to an identity workflow. It requires no network calls, no external keys, and no special hardware—just a straightforward implementation of a public, stable standard. Yet it instantly filters out a large class of errors (like OCR confusion between O and 0, or misaligned lines) and raises the bar for deliberate tampering, since attackers must produce MRZ strings that satisfy all check digits simultaneously.

For any system that ingests passport or ID data—whether at a border checkpoint, in a banking app, or during remote onboarding—enforcing MRZ validation means higher data quality, fewer manual reviews, and stronger protection against fraud. It is a simple, deterministic step that turns raw machine reads into reliably verified identity data, and that reliability is exactly what both regulators and customers expect.