Scanning your passport online: how to do it safely

A passport scan is the crown-jewel document: whoever holds it can impersonate a lot of you. That's no reason to fear making one — flights get booked, visas get filed — it's a reason to control where the copy exists.

Rule 1: the scan must not create a server copy

Use a tool that processes on your device. With ToPDF, the passport photo and PDF exist only in your browser tab and where you save them — verifiably (run the airplane-mode test). With upload-based converters you're extending trust to an unknown server the moment you pick the photo.

Rule 2: share narrow, through official channels

• Send to the embassy portal / airline form / HR system directly — not “to be forwarded”.
• Ask whether they need the full data page or accept redacted elements; requirements differ.
• Never post any part of a passport publicly, including “celebration” photos of visas — the MRZ lines alone are gold to fraudsters.

Rule 3: clean up the trail

1. Keep one master copy where you decided (see travel backups).
2. Delete the photo from the camera roll if it isn't the master, and the PDF from Downloads once filed.
3. Purge stray chat/email attachments after the process concludes.

Frequently asked questions

Is it safer to photocopy at a shop than scan at home?

The shop’s copier has a hard drive and an operator; your on-device scan has neither. Home scanning with a local tool is the smaller exposure.

Are the MRZ lines really that sensitive?

Yes — they encode your identity in machine-checkable form and many systems key off them. Treat any image containing the MRZ as the full document.