How to redact a passport or ID document (safely)
You're often asked to send a copy of your passport or driving licence to prove who you are, and you rarely need to hand over every number on it. Here's what to black out, the one part people always miss, and how to do it without uploading your ID to a stranger.
A passport or national ID is about as sensitive as a single document gets. Sent in full, a copy gives someone your photo, full name, date and place of birth, nationality, document number and expiry, everything needed to impersonate you or open accounts. When a landlord, employer, marketplace or online service asks for "a copy of your ID", it's worth covering the parts they don't actually need.
What to black out
It depends on why you're sharing it, but common candidates:
- The document number (passport number, licence number). This is the key identifier and rarely needs to be visible for a basic identity check.
- Date of birth, unless age is the thing being verified.
- The signature.
- Any secondary numbers: personal/national ID numbers, card access numbers on the back of licences.
Often the party only needs your name, photo and that the document is valid. If they've asked for something specific (proof of age, proof of nationality), leave just that and cover the rest. Some services legitimately need the full document; when they don't, don't give it.
The part everyone forgets: the machine-readable zone
At the bottom of a passport photo page (and on many ID cards) are two or three lines of monospaced characters full of chevrons: P<GBRSMITH<<JOHN<<<.... That's the machine-readable zone (MRZ), and it encodes your document number, name, nationality, date of birth, sex and expiry date, the very things you just blacked out above. Redact the document number in the main field but leave the MRZ, and you've leaked it anyway. Anyone can read the MRZ, and cover the MRZ whenever you cover the fields it duplicates.
Don't upload your ID to redact it
The same warning that applies to bank statements applies double here: plenty of "redact online" sites upload your file to their servers. Uploading a full copy of your passport to an unknown service to hide a couple of fields creates exactly the risk you're trying to avoid, a full copy of your ID now sits somewhere you don't control. Redact it on your own device instead.
A safe workflow
- Work on your device. Use a tool that does the redaction locally and doesn't upload the image.
- Cover, don't blur. Blurring an ID number or MRZ can be reversed (here's why). Use solid black and flatten the image.
- Black out the fields and their duplicates, including the MRZ and any repeated numbers.
- Add a purpose watermark if you like. Writing "for [company], [date], ID check only" across a copy makes it useless if it's ever reused elsewhere. Do this in addition to redaction, not instead of it.
- Check the result and the filename before you send.
Private Redaction blacks out anything on a photo or scan of your ID, on your device, and exports a flat image with the covered details genuinely gone. Free, nothing uploaded. Use the Chrome extension for images, or the web app for a scanned PDF.
Takeaways
- Share the minimum: usually name, photo and validity. Cover the document number, DOB and signature unless needed.
- Always cover the machine-readable zone, it repeats the data you're hiding.
- Don't blur an ID (reversible) and don't upload it to redact it. Solid black, on your device.
Related: how to black out text on a screenshot · blur vs black box