How Do Passports Work?

Your passport is about 32 pages of treated paper, a polycarbonate data page, a small chip, and a cover reinforced with metallic fibers. It gets you across international borders. It’s also, if you know what to look for, a remarkably sophisticated document — the product of decades of accumulated anti-forgery technology, international standardization, and public-key cryptography borrowed directly from online banking.

Most people know their passport number. Almost nobody knows what their passport actually does.

The organization that designs passports

Every passport in the world follows standards set by ICAO — the International Civil Aviation Organization, a specialized UN agency based in Montreal. ICAO doesn’t issue passports; it publishes Document 9303, a specification that defines everything from the size of the booklet (125mm × 88mm, approximately the size of a checkbook) to the layout of the data page to the cryptographic protocols for the chip.

Airlines and border control systems around the world are built around ICAO 9303. If a country wants its passport accepted at automated border gates anywhere on earth, it follows the standard. This is why all passports look vaguely similar despite being issued by 193 different countries: they’re all built to the same spec.

The standard is revised periodically as technology improves and as forgery methods evolve. The biometric chip requirement — ICAO’s biggest recent change — was phased in from 2006 onward, and most countries have now fully transitioned.

The data page

The data page (also called the biographical page or photo page) is the most security-dense part of the passport. Modern passports use a polycarbonate data page rather than paper — a solid plastic card, similar to a credit card, where the data is laser-engraved directly into the material rather than printed on the surface.

This matters for forgery resistance. With a paper page, a forger could potentially scrape off printed information and reprint it. Laser engraving creates marks that go through the material — altering them would visibly damage the page.

The data page contains:

The visual inspection zone: your photo, name, nationality, date of birth, sex, place of birth, date of issue, date of expiry, and passport number — everything a border agent reads with their eyes.

The machine-readable zone (MRZ): the two lines of characters at the bottom of the page, using OCR-B font designed for optical scanning. The MRZ encodes your biographical data in a standardized format, along with check digits that allow readers to verify the data wasn’t corrupted. Every automated passport reader scans this first.

The chip: a small RFID chip embedded in the page (in many passports) or the cover. More on this below.

Security features: what you can and can’t see

Passports contain security features at multiple levels of visibility, designed for different types of authentication:

Features visible to anyone: Holograms (often overlaid on the photo), embossed or laser-engraved elements, fine-line patterns in the background (called “guilloche” printing, the same technique used on banknotes), and the overall print quality.

Features visible only under UV light: Fluorescent inks that appear invisible in normal light but glow under ultraviolet — often forming patterns or additional text. Border security routinely uses UV lights to check these. Many countries’ passport pages contain complex UV-reactive designs invisible to casual inspection.

Features visible only under infrared light: Some inks absorb infrared rather than reflecting it, creating patterns invisible at visible wavelengths but detectable by IR scanners. These are harder to reproduce without the exact ink formulations.

Laser-perforated serial numbers: Many passports have the passport number (or a variation of it) physically perforated through multiple pages using a laser. The holes align when pages are stacked. A forger who changed the printed number would need to physically reperforate the entire booklet.

Security paper: The paper itself contains randomly distributed synthetic fibers (often in multiple colors), sometimes visible to the naked eye. Genuine security paper is manufactured by a small number of specialized facilities worldwide and is difficult to obtain outside government supply chains. Counterfeit paper can be detected under magnification.

Watermarks: Embedded in the paper manufacturing process, visible when held to light. Unlike printed designs, these can’t be replicated with standard printing equipment.

Microprinting: Text printed at sizes around 0.2mm — visible as a texture pattern to the naked eye but readable under magnification. Often used in the background patterns of biographical pages.

No single feature is unbeatable. The system works because combining ten to twenty overlapping security features simultaneously creates a forgery challenge that effectively requires state-level resources — the kind available to national mint and document printing facilities, but not to criminals.

The biometric chip: public-key cryptography in your pocket

The most significant addition to passports in the last two decades is the chip — technically an RFID (radio-frequency identification) chip that complies with ISO/IEC 14443, the same standard used by contactless credit cards.

The chip stores what ICAO calls the Logical Data Structure: a standardized set of data groups including your photo (stored as a JPEG2000 or JPEG image), your biographical data, and optionally fingerprints and iris data for countries that collect them.

But the crucial element isn’t the stored data — it’s the digital signature.

When your passport is issued, your country’s passport authority signs the data on the chip using its private key. The signed data, along with the corresponding public key certificate, is stored on the chip. Any authorized border control reader can verify this signature using the public key — and the signature can only have been produced by the issuing authority, not by a forger who copied or altered the data.

This is the same public-key cryptography (specifically, elliptic-curve or RSA cryptography) used to secure HTTPS connections and online banking. Breaking it computationally would require resources beyond any known actor — the security is mathematical, not just physical.

The signature verification works in a chain:

1. Your country’s Document Signing Certificate signs the chip data
2. The Document Signing Certificate is itself signed by your country’s Country Signing Certificate Authority (CSCA)
3. Countries share their CSCA public keys with each other through the ICAO Public Key Directory (PKD)

A border reader in Japan can verify a German passport by checking the signature chain against Germany’s public key in the PKD. If the chain verifies, the chip data is cryptographically guaranteed to be authentic — exactly as issued by the German passport authority.

Basic Access Control and Pace

There’s an obvious concern with a contactless chip: can anyone with an RFID reader harvest your passport data without your knowledge?

The answer is: not easily, by design.

The chip won’t respond to any reader that just walks up to it. First, the reader must successfully read the machine-readable zone (the optical scan at the bottom of the data page) and use the data there to derive a session key. Only with that session key can the reader open a communication session with the chip.

This is called Basic Access Control (BAC): the chip is locked behind the data that’s already physically printed on the page. Anyone who can read your chip already has your passport open in front of them.

Newer passports use an upgraded protocol called Password Authenticated Connection Establishment (PACE), which provides stronger cryptographic protection for the same concept. PACE sessions are more resistant to eavesdropping and harder to brute-force.

The upshot: the chip dramatically increases the security of passports against sophisticated forgery while adding no meaningful new surveillance capability beyond what a physical passport already provides.

How border control uses your passport

When you hand your passport to a border agent or approach an automated e-gate:

1. Optical scan of the MRZ: The reader extracts your biographical data and check digits, verifying they’re internally consistent.

2. Database check: Your name, passport number, nationality, and date of birth are checked against a cascade of databases in milliseconds: your country’s passport validity database, Interpol’s Stolen and Lost Travel Documents database (now containing over 100 million records), local watchlists, and the destination country’s entry/exit system.

3. Chip verification (at modern gates): The reader performs the BAC/PACE handshake, reads the chip data, and verifies the cryptographic signature against the issuing country’s public key. If the chip data doesn’t match the printed page, or the signature doesn’t verify, the document is flagged.

4. Biometric verification: At e-gates, a camera captures a live facial image and compares it to the photo stored on the chip (not the printed photo — the chip version can’t be physically altered). Some countries also scan fingerprints against chip data.

5. Risk assessment: Beyond the automated checks, customs and immigration authorities run risk-scoring models based on travel history, declared purpose of visit, and flags from intelligence sharing. What you see is a border agent; what’s happening in the background is a multi-database query and an automated risk score.

The entire process — from scan to decision — typically takes 2-10 seconds.

Why different passports have different “power”

A passport doesn’t intrinsically grant you entry to other countries. What it does is prove citizenship and identity from a recognized state.

Whether that gets you through a border without a visa is entirely a matter of bilateral and multilateral agreements. Country A grants visa-free access to citizens of Country B because of a combination of factors: diplomatic relationships, security cooperation, reciprocal treatment of A’s citizens in B, immigration risk assessments, and economic ties.

The Henley Passport Index tracks visa-free access for all 199 passport-issuing territories and updates quarterly. As of 2025, the most powerful passports (Japan, Singapore, Germany, France) grant visa-free or visa-on-arrival access to 190+ destinations. The least powerful grant access to fewer than 30.

Notably, a passport being technically well-made and secure is irrelevant to its visa-free power — what matters is the diplomatic relationships of the issuing country.

Key terms

ICAO International Civil Aviation Organization, the UN body that sets global passport standards through Document 9303.

Machine-readable zone (MRZ) The two lines of standardized text at the bottom of the data page, readable by optical scanners and encoding your biographical data.

RFID Radio-frequency identification. The wireless communication technology the passport chip uses. Requires physical proximity (a few centimeters) to read.

Public-key cryptography A mathematical system where data encrypted with a private key can only be decrypted with the corresponding public key. Used to digitally sign the passport chip data so forgery is cryptographically impossible.

Basic Access Control (BAC) / PACE Protocols that prevent the passport chip from responding to unauthorized readers — the chip will only communicate after the machine-readable zone has been optically scanned first.

ICAO PKD The ICAO Public Key Directory, where countries deposit their certificate authority public keys so other countries can verify chip signatures from each other’s passports.

e-gate An automated border control gate that scans the MRZ, reads the chip, and uses facial recognition to verify identity without a human agent.

Common misconceptions

“The chip stores your travel history.” It doesn’t. The chip stores what was put there when the passport was issued: your photo, biographical data, and a digital signature. Your travel history lives in immigration databases, not in your passport.

“All passports are biometric now.” Not quite. Most passports issued by developed countries since 2010 are biometric (with the chip and camera symbol on the cover), but older passports without chips are still valid until expiry and are accepted at most borders through manual processing. Some countries have been slower to adopt biometric issuance.

“Covering your passport with a metal case stops RFID skimming.” True but mostly unnecessary given BAC/PACE protection. A foil-lined cover does provide additional physical shielding, but the primary protection is already cryptographic — a chip reader that somehow got close enough to read your chip would still need your MRZ data to unlock it.

“Countries can share their passport databases with each other.” They can share the public keys needed to verify chip signatures (through the ICAO PKD), but the issuing country’s passport issuance records remain national databases. What border agencies share internationally is watchlist and alert data (who to flag), not the full biographical records of every citizen.