ForHosting KIT · OCR & Data Extraction

Read a passport's MRZ

The two or three lines of monospaced text at the bottom of every passport photo page were designed to be read by a scanner, not a person, and this endpoint does exactly that. Send an image of the MRZ and it returns the decoded fields plus whether each checksum validated, which is what separates a real passport read from a guess.

● BetaPer request + per image$0.010

Run — $0.010 + $0.0575/image How it works & API

Use it from WebAPIEmailApp soonTelegram soon

Run it online

Run this on our servers with your account. Free tools run in your browser; this one bills your KIT balance per the price above.

A format older than the smartphone camera reading it

The machine-readable zone was standardized decades ago so that airports and border posts could swipe a passport instead of typing it, and every compliant travel document still carries it: two lines of 44 characters, or three lines of 30 on older ID-style formats, packed with a fixed layout of name, document number, nationality, birth date, sex, expiry date and check digits. This endpoint speaks that layout directly.

What the response actually tells you

Beyond the decoded fields, the MRZ format embeds a checksum digit after several of them, so the response includes whether each of those checks passed. That is a meaningful signal: a passport photo taken at an angle or with a worn document can still yield readable characters that fail the checksum, and knowing that distinction lets your system decide whether to trust the read or ask for a clearer photo.

Why teams reach for MRZ instead of full-page OCR

Reading the MRZ line is faster and more reliable than trying to parse the visual inspection zone above it, because the MRZ uses a fixed character set and fixed column positions by design, while the printed name and photo area vary by issuing country. For travel, immigration and fraud-screening tools that only need the core identity fields, the MRZ is the more dependable target.

Calling the endpoint

A single call to POST /ocr/mrz with the passport image returns a task_id right away; the job runs asynchronously and delivers its result through a signed webhook or a signed link that stays valid for 24 hours. Three internal retries happen automatically on a troublesome image before you ever see a failure, and a failed task carries no charge.

Fitting it into a check-in or verification flow

Because it is billed per completed task rather than per subscription tier, this endpoint fits naturally into airline check-in kiosks, hotel front desks and immigration pre-clearance tools that process one traveler at a time but need the read to happen the moment the passport is presented, not minutes later.

What you can do with it

Airline self-service check-in

A kiosk photographs the passport data page and reads the MRZ to pre-fill the passenger's name, document number and expiry on the boarding pass request.

Hotel guest registration

Front desk software scans a foreign guest's passport MRZ instead of asking staff to retype a name with unfamiliar characters.

Visa and immigration pre-screening

A travel agency validates that a client's passport expiry date clears the destination country's six-month rule before booking, straight from the MRZ.

Fraud triage for onboarding

A verification service flags accounts where the MRZ checksum fails, routing them to manual review instead of accepting a possibly altered document.

FAQ

What is a passport MRZ reader API used for?

It decodes the machine-readable zone at the bottom of a passport photo page into document number, name, nationality, birth date and expiry, with checksum validation on each field.

Is there a free tier?

There's no free tier — free tiers get abused and slow everyone down. Access runs on a prepaid ForHosting KIT balance: top up from $10.00 (it never expires) and each request is charged at its published price, so a call with no balance returns HTTP 402. No subscription, no tokens, no invented credits, and a failed task is never charged.

How much does it cost?

$0.010 per request plus $0.0575 per image, charged only when the task completes successfully.

Does it work on ID cards too, or only passports?

It targets the MRZ format found on passport photo pages; many ID cards use a similar three-line MRZ and will decode correctly if the format matches.

How do I know the read is trustworthy?

Each MRZ field with a check digit is validated as part of the response, so you can see whether the checksum passed rather than just receiving raw decoded text.

How do I get the result back?

Call POST /ocr/mrz to get a task_id immediately, then receive the parsed output by webhook or fetch it from a signed link valid for 24 hours.

What if the MRZ is smudged or partially covered?

The system retries up to three times internally; if the zone still can't be read reliably, you get a clear error and are not billed.

Can I read many passports in one batch?

Yes, submit each MRZ image as its own asynchronous task and collect results as they complete, which suits high-volume check-in or border scenarios.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/ocr/mrz

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/ocr/mrz \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"image":"https://ejemplo.com/imagen.jpg"}'

const res = await fetch("https://api.kit.forhosting.com/ocr/mrz", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "image": "https://ejemplo.com/imagen.jpg"
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/ocr/mrz",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "image": "https://ejemplo.com/imagen.jpg"
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/ocr/mrz", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"image":"https://ejemplo.com/imagen.jpg"}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"image":"https://ejemplo.com/imagen.jpg"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/ocr/mrz", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "image": "https://ejemplo.com/imagen.jpg"
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "ocr.mrz",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.010

Per image$0.0575

Published price — no tokens, no invented credits. A failed task is never charged.

Limits

`max_mb`	25
`max_pages`	10

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.
`422`	`task_failed`	The task failed after 3 retries. You are never charged for it.

Read the full KIT documentation →