Identity document structure, validation, and forensic analysis tools. MRZ generator/checker for French IDs, European IDs, and Passports (TD3). IBAN validator and generator. Credit card number generator, Luhn validator, and BIN reference. Checksum calculator with step-by-step breakdown.
Interactive tools for generating and validating Machine Readable Zone (MRZ) strings for French ID cards (1995 and 2021), European ID cards (TD1), and Passports (TD3). Includes IBAN validation/generation, credit card number generator/validator with BIN lookup, and a step-by-step MRZ checksum calculator. All processing is done client-side.
| Code | Format | Lines | Chars/Line | Document Type |
|---|---|---|---|---|
| TD1 | ID Card | 3 | 30 | National ID cards |
| TD2 | ID Card | 2 | 36 | Older ID cards, some visas |
| TD3 | Passport | 2 | 44 | Passports, travel documents |
All MRZ formats follow ICAO Doc 9303 standards. The checksum algorithm is shared across all formats (weighted mod 10 with weights 7, 3, 1).
MRZ checksums use a weighted modulo 10 algorithm with cycling weights 7, 3, 1.
Character values:
< (filler) = 00 to 9 = face value (0-9)A to Z = 10 to 35Steps:
| Step | Action |
|---|---|
| 1 | For each character, look up its numeric value |
| 2 | Multiply by the weight at that position (cycling 7, 3, 1, 7, 3, 1, ...) |
| 3 | Sum all products |
| 4 | Result = sum mod 10 |
Example: String AB1234
| Pos | Char | Value | Weight | Product |
|---|---|---|---|---|
| 0 | A | 10 | 7 | 70 |
| 1 | B | 11 | 3 | 33 |
| 2 | 1 | 1 | 1 | 1 |
| 3 | 2 | 2 | 7 | 14 |
| 4 | 3 | 3 | 3 | 9 |
| 5 | 4 | 4 | 1 | 4 |
Sum = 131, checksum = 131 mod 10 = 1
The 2021 French ID card uses ICAO 9303 TD1 format with 3 lines of 30 characters.
| Line | Position | Length | Field |
|---|---|---|---|
| 1 | 1-2 | 2 | Document type (ID) |
| 1 | 3-5 | 3 | Issuing country (FRA) |
| 1 | 6-14 | 9 | Document number |
| 1 | 15 | 1 | Document number checksum |
| 1 | 16-30 | 15 | Filler (<) |
| 2 | 1-6 | 6 | Birth date (YYMMDD) |
| 2 | 7 | 1 | Birth date checksum |
| 2 | 8 | 1 | Sex (M/F) |
| 2 | 9-14 | 6 | Expiry date (YYMMDD) |
| 2 | 15 | 1 | Expiry date checksum |
| 2 | 16-18 | 3 | Nationality (FRA) |
| 2 | 19-29 | 11 | Filler (<) |
| 2 | 30 | 1 | Global checksum |
| 3 | 1-30 | 30 | Name (LASTNAME<<FIRSTNAME) |
Global checksum is computed over: DocNumber + Check1 + BirthDate + Check2 + ExpiryDate + Check3
The 1995 French ID card uses a custom 2-line format with 36 characters per line.
| Line | Position | Length | Field |
|---|---|---|---|
| 1 | 1-2 | 2 | Document type (ID) |
| 1 | 3-5 | 3 | Issuing country (FRA) |
| 1 | 6-30 | 25 | Last name (padded with <) |
| 1 | 31-33 | 3 | Department of issuance |
| 1 | 34-36 | 3 | Agent code |
| 2 | 1-4 | 4 | Issue date (YYMM) |
| 2 | 5-7 | 3 | Department of issuance |
| 2 | 8-12 | 5 | Management code |
| 2 | 13 | 1 | Checksum (issue + dept + mgmt) |
| 2 | 14-27 | 14 | First name (padded with <) |
| 2 | 28-33 | 6 | Birth date (YYMMDD) |
| 2 | 34 | 1 | Birth date checksum |
| 2 | 35 | 1 | Sex (M/F) |
| 2 | 36 | 1 | Global checksum |
Global checksum is computed over: entire Line 1 + Line 2 positions 1-35
Passports use ICAO 9303 TD3 format with 2 lines of 44 characters.
| Line | Position | Length | Field |
|---|---|---|---|
| 1 | 1 | 1 | Document type (P) |
| 1 | 2 | 1 | Document subtype (typically <) |
| 1 | 3-5 | 3 | Issuing country (ISO 3166-1 alpha-3) |
| 1 | 6-44 | 39 | Name (LASTNAME<<FIRSTNAME<<...) |
| 2 | 1-9 | 9 | Passport number |
| 2 | 10 | 1 | Passport number checksum |
| 2 | 11-13 | 3 | Nationality (ISO 3166-1 alpha-3) |
| 2 | 14-19 | 6 | Birth date (YYMMDD) |
| 2 | 20 | 1 | Birth date checksum |
| 2 | 21 | 1 | Sex (M/F/<) |
| 2 | 22-27 | 6 | Expiry date (YYMMDD) |
| 2 | 28 | 1 | Expiry date checksum |
| 2 | 29-42 | 14 | Optional data (personal number, etc.) |
| 2 | 43 | 1 | Optional data checksum |
| 2 | 44 | 1 | Global checksum |
Global checksum is computed over: PassportNum + Check1 + BirthDate + Check2 + ExpiryDate + Check3 + OptionalData + Check4
An IBAN (International Bank Account Number) consists of:
| Component | Description |
|---|---|
| Country code | 2 letters (ISO 3166-1 alpha-2) |
| Check digits | 2 digits (validated via mod 97) |
| BBAN | Basic Bank Account Number (country-specific format and length) |
Validation algorithm:
| Step | Action |
|---|---|
| 1 | Move the first 4 characters to the end |
| 2 | Replace each letter with two digits (A=10, B=11, ... Z=35) |
| 3 | Compute the remainder on division by 97 |
| 4 | Valid if remainder = 1 |
| Code | Country | Length |
|---|---|---|
| FR | France | 27 |
| DE | Germany | 22 |
| ES | Spain | 24 |
| IT | Italy | 27 |
| BE | Belgium | 16 |
| NL | Netherlands | 18 |
| PT | Portugal | 25 |
| AT | Austria | 20 |
| CH | Switzerland | 21 |
| GB | United Kingdom | 22 |
| IE | Ireland | 22 |
| LU | Luxembourg | 20 |
| MC | Monaco | 27 |
| AD | Andorra | 24 |
| CZ | Czech Republic | 24 |
| PL | Poland | 28 |
| SE | Sweden | 24 |
| DK | Denmark | 18 |
| NO | Norway | 15 |
| FI | Finland | 18 |
| GR | Greece | 27 |
| HR | Croatia | 21 |
| RO | Romania | 24 |
| BG | Bulgaria | 22 |
| HU | Hungary | 28 |
| SK | Slovakia | 24 |
| SI | Slovenia | 19 |
| LT | Lithuania | 20 |
| LV | Latvia | 21 |
| EE | Estonia | 20 |
| CY | Cyprus | 28 |
| MT | Malta | 31 |
| BA | Bosnia/Herzegovina | 20 |
| RS | Serbia | 22 |
| ME | Montenegro | 22 |
| MK | North Macedonia | 19 |
| AL | Albania | 28 |
| IS | Iceland | 26 |
| LI | Liechtenstein | 21 |
| TR | Turkey | 26 |
| SA | Saudi Arabia | 24 |
| AE | UAE | 23 |
A credit/debit card number (PAN - Primary Account Number) follows the ISO/IEC 7812 standard.
| Component | Position | Description |
|---|---|---|
| MII (Major Industry Identifier) | Digit 1 | Industry sector: 1=Airlines, 3=Travel/Entertainment, 4=Banking/Financial, 5=Banking/Financial, 6=Merchandising/Banking, 7=Petroleum, 8=Healthcare, 9=Government |
| IIN/BIN (Issuer Identification Number) | Digits 1-6 (or 1-8 since 2022) | Identifies the issuing institution. BIN databases map these to issuers |
| Account Number | Digits 7-15 (varies by network) | Individual account identifier assigned by the issuer |
| Check Digit | Last digit | Computed via the Luhn algorithm for error detection |
Total PAN length varies: Visa/MC/Discover = 16, Amex = 15, Diners = 14, Maestro = 12-19.
| Network | BIN Prefix | Length | CVV Length | CVV Name |
|---|---|---|---|---|
| Visa | 4 | 16 (rarely 13) | 3 | CVV2 |
| Mastercard | 51-55, 2221-2720 | 16 | 3 | CVC2 |
| American Express | 34, 37 | 15 | 4 | CID (front of card) |
| Discover | 6011, 644-649, 65 | 16 | 3 | CID |
| UnionPay | 62 | 16-19 | 3 | CVN2 |
| JCB | 3528-3589 | 16 | 3 | CAV2 |
| Maestro | 5018, 5020, 5038, 6304, 6759, 6761-63 | 12-19 | 3 | CVC2 |
| Diners Club | 300-305, 36, 38 | 14 | 3 | CVV2 |
| Mir (Russia) | 2200-2204 | 16 | 3 | CVP2 |
| UATP (Airlines) | 1 | 15 | 0 | N/A |
| Visa Electron | 4026, 4508, 4844, 4913, 4917 | 16 | 3 | CVV2 |
The Luhn algorithm (mod 10) validates card numbers against single-digit transcription errors and most transposition errors.
Steps:
Example: 4532 0151 2345 6789
| Pos | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Digit | 4 | 5 | 3 | 2 | 0 | 1 | 5 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |
| x2? | Yes | - | Yes | - | Yes | - | Yes | - | Yes | - | Yes | - | Yes | - | Yes | - |
| Value | 8 | 5 | 6 | 2 | 0 | 1 | 1 | 1 | 4 | 3 | 8 | 5 | 3 | 7 | 7 | 9 |
Sum = 70, 70 mod 10 = 0 - VALID
To generate a valid number: fill all digits except the last, then compute the check digit as (10 - (sum mod 10)) mod 10.
The CVV (Card Verification Value) printed on the card is not derivable from the PAN alone. It is computed by the issuer using:
| Input | Description |
|---|---|
| PAN | Full Primary Account Number |
| Expiration date | MM/YY from the card |
| Service code | 3-digit code (e.g. 101 = international, chip, no restrictions) |
| CVK pair | Issuer's secret Card Verification Key (DES or 3DES key pair) |
The algorithm: concatenate PAN + expiry + service code, encrypt with the CVK using DES/3DES, and extract specific digits from the result. Without the issuer's secret key, the CVV cannot be computed or predicted from the card number.
CVV variants:
The widget generates random CVV values for testing purposes. Real CVV computation requires the issuer's cryptographic keys.
Modern payment cards contain an EMV chip (named after Europay, Mastercard, Visa) that provides stronger authentication than magnetic stripe.
| Component | Description |
|---|---|
| ICC (Integrated Circuit Card) | The chip itself, communicates via contact pads or NFC antenna |
| Application Cryptogram (AC) | Dynamic cryptographic proof generated per transaction |
| ARQC | Authorization Request Cryptogram (sent to issuer for online auth) |
| TC | Transaction Certificate (offline approval) |
| AAC | Application Authentication Cryptogram (decline) |
| CDA | Combined Dynamic Data Authentication (chip signs transaction data) |
| PIN Verification | Offline PIN checked against chip-stored encrypted PIN |
| Track Equivalent Data | Chip provides data equivalent to magnetic stripe Track 1/2 |
Contactless (NFC): Uses ISO 14443 at 13.56 MHz. The chip generates a unique cryptogram per tap, preventing replay attacks. The PAN transmitted may be a tokenized PAN (DPAN) rather than the real number.
Magnetic stripe fallback: Chip cards still carry a mag stripe for backward compatibility. The stripe contains Track 1 (alphanumeric, up to 79 chars) and Track 2 (numeric, up to 40 chars) with the PAN, expiry, and CVV1.
3-D Secure adds cardholder authentication for online (card-not-present) transactions.
| Version | Protocol | Features |
|---|---|---|
| 3DS 1.0 | Redirect to issuer page | Static password, poor UX, high cart abandonment |
| 3DS 2.0 | In-app/browser SDK | Risk-based auth, frictionless flow for low-risk, biometric support |
| 3DS 2.1+ | Enhanced data sharing | More device/browser data points, improved risk scoring |
Brand names:
Frictionless flow (3DS 2.0): The issuer's Access Control Server (ACS) analyzes risk signals (device fingerprint, transaction history, geolocation, behavioral biometrics) and can approve low-risk transactions without challenging the cardholder. High-risk transactions trigger step-up authentication (OTP, biometric, push notification).
| Source | Coverage | Access |
|---|---|---|
| binlist.net API | Basic BIN lookup (free, rate-limited) | Public API |
| bincheck.io | Extended BIN database | Free tier + paid |
| ISO 7812 Registry | Official IIN/BIN ranges | Via ISO (paid standard) |
| Visa/Mastercard BIN tables | Authoritative, complete | Issuer/acquirer access only |
| freebinchecker.com | Community-contributed data | Public web |
| bintable.com | 500k+ BIN entries | Free API + paid tiers |
Real BIN databases are proprietary and maintained by payment networks. The BIN ranges shown in the widget and this reference are educational approximations based on publicly known prefix allocations. Production payment systems use licensed BIN tables from the networks.
| Feature | Description | Detection Method |
|---|---|---|
| Hologram | Diffractive optical element, shifts color with angle | Visual tilt inspection |
| UV printing | Patterns visible only under ultraviolet light (254/365nm) | UV lamp (Wood's lamp) |
| Microprinting | Text readable only with magnification (0.2-0.5mm) | Loupe or microscope (10x+) |
| Intaglio printing | Raised ink detectable by touch (tactile) | Fingertip touch, angled light |
| OVI (Optically Variable Ink) | Color-shifting ink on denomination/elements | Tilt at 45 degrees |
| Watermark | Visible when held against light, embedded in paper | Transmitted light |
| Security thread | Embedded metallic/plastic strip, may be windowed | Transmitted light, UV |
| Laser perforation | Microholes forming patterns/numbers | Backlight inspection |
| Ghost image | Secondary smaller photo of holder | Visual inspection |
Modern passports and ID cards contain an NFC chip (ISO 14443) storing:
| Data Group | Content | Protection |
|---|---|---|
| DG1 | MRZ data (text) | BAC (Basic Access Control) |
| DG2 | Facial image (JP2/JPEG) | BAC |
| DG3 | Fingerprints (optional) | EAC (Extended Access Control) |
| DG4 | Iris image (optional) | EAC |
| DG7 | Displayed signature | BAC |
| DG14 | Security options | BAC |
| DG15 | Active Authentication public key | BAC |
| SOD | Digital signature of all DGs | PKI chain |
BAC requires optical reading of the MRZ to derive session keys. EAC requires terminal authentication with the issuing country's PKI.
When analyzing a document's MRZ for authenticity:
| Check | What to Look For |
|---|---|
| Font consistency | MRZ must use OCR-B font (ISO 1073-2) |
| Alignment | Characters must be perfectly aligned in grid |
| Check digits | All checksums must validate (use Checker tool) |
| Character spacing | Fixed pitch, no variable spacing |
| Line spacing | Consistent between all lines |
| Filler characters | Must be < not spaces or other chars |
| Country codes | Must match ISO 3166-1 alpha-3 |
| Date logic | Expiry after issue, birth date plausible |
| Document number format | Must match issuing country's numbering scheme |
| System | Coverage | Access |
|---|---|---|
| SLTD (Interpol) | Lost/stolen travel docs worldwide | Law enforcement only |
| FADO (EU) | EU document reference images | EU member state authorities |
| PRADO (Council of EU) | Public reference for EU docs | Public web access |
| EES (EU Entry/Exit System) | Border crossing records | EU border authorities |
| SIENA (Europol) | Cross-border intelligence sharing | EU law enforcement |
| iFADO | Interactive FADO for training | Restricted access |
| Vector | Risk | Mitigation |
|---|---|---|
| Scanner metadata | EXIF data embeds device info, timestamps | Strip metadata (exiftool -all=) |
| PDF metadata | Creator software, author, timestamps | Use metadata-clean export tools |
| Photo EXIF | GPS, camera model, lens, date | Strip before embedding |
| Print tracking dots | Yellow dots from color laser printers encode serial/date | Use inkjet or B&W laser |
| File hash | Document hash can be tracked across systems | Modify a single pixel/byte |
| Cloud sync | Auto-upload to iCloud/Google/OneDrive | Disable sync for sensitive dirs |
| OCR text layer | Embedded searchable text in scanned PDFs | Flatten to image-only PDF |
| Aspect | ICAO Standard | AI Detection Risk |
|---|---|---|
| Background | White/light gray, uniform | GAN artifacts in background gradient |
| Expression | Neutral, mouth closed | Inconsistent micro-expressions |
| Lighting | Even, no harsh shadows | Incorrect light direction analysis |
| Resolution | Min 600 DPI for print | Upscaling artifacts detectable |
| Head position | Centered, facing camera | Asymmetry analysis |
| Eyes | Open, looking at camera | Pupil reflection consistency |
| Glasses | Permitted (no tinted lenses) | Reflection coherence check |
| Format | 35x45mm (passport), varies for ID | Aspect ratio analysis |
AI-generated face detection tools: Microsoft FaceCheck, Sensity.ai, Hive Moderation. Key tells: ear asymmetry, hair-background blending, teeth irregularities, pupil shape inconsistency.
When building a cover identity, documents must show consistent wear and age:
| Element | Natural Aging Signs | Common Mistakes |
|---|---|---|
| Lamination | Minor edge lifting, micro-scratches | Too pristine or too damaged |
| Paper | Slight yellowing, soft edges | Uniformly white after years |
| Ink | Slight fading on exposed areas | Consistent darkness everywhere |
| Folds | Consistent fold lines from wallet carry | No folds on "old" document |
| Holograms | Minor scratching from handling | Perfect condition after years |
| Photo | Slight color shift over time | Modern photo quality on old doc |
A cover identity requires a consistent, layered set of supporting documents. Each document must cross-reference correctly.
| Layer | Documents | Cross-Reference Points |
|---|---|---|
| Primary ID | Passport, national ID card | Name, DOB, photo, nationality |
| Secondary ID | Driver's license, health card | Same name, DOB, photo |
| Address proof | Utility bills, bank statements | Consistent address, name match |
| Financial | Bank cards, tax documents | Name, address, account numbers |
| Social | Social media, email accounts | Consistent persona, timeline |
| Employment | Work contracts, pay stubs | Name, address, tax ID |
See the OPSEC Toolkit Cover Identity Builder widget for interactive persona generation.