Why your passport photo should never be uploaded

A passport photo is not an ordinary picture. It is a full-face, evenly lit, neutral-expression portrait against a plain background, taken to a published standard so that a machine can measure it. That is a precise description of your face as an identity document, and it is also a precise description of the single most useful image an identity thief can obtain. Uploading it to a website in order to have it cropped is a trade that gives away something valuable in exchange for arithmetic that your own phone could have done.

That is the whole argument for processing the photo where it already is. Everything below is the detail.

The photo is the asset, not the crop

Most people picture the risk backwards. They imagine a stolen photo being posted somewhere embarrassing. The real value of a standardised portrait is that it is machine-ready: it feeds a facial recognition system cleanly, it drops into a forged document template without retouching, and it satisfies the photo step of a remote identity check on a bank or crypto platform. The very qualities that make a passport photo compliant, which is to say frontal, sharp, uncluttered and correctly exposed, are the qualities that make it useful to someone else.

This is not a hypothetical worry that the industry invented. The Australian Passport Office says so on its own guidance for applicants: it does not recommend using an online passport photo service or a mobile app, because these "may put you in danger of identity fraud" (Australian Passport Office). It is unusual for a government to name a category of commercial service in a warning, and worth pausing on. The warning is not about cropping being difficult. It is about the upload.

There is a legal echo of the same point. Under the EU's General Data Protection Regulation, Article 9 prohibits, subject to specific conditions, the processing of "biometric data for the purpose of uniquely identifying a natural person", placing it alongside health data and religious belief in the special categories. A photo of a face is not automatically biometric data. It becomes biometric data at the moment it is processed to identify or measure a specific individual, which is exactly what a passport photo tool does when it finds a face and measures the distance between the eyes. If you are in Europe, uploading a passport photo to a face-measuring service is not the same class of act as uploading a holiday snap, and the law says so.

What "we delete your photo" leaves out

Photo sites usually answer the privacy question with a retention promise: images are deleted after some window, commonly 24 hours to 180 days. Retention promises are worth something, but they answer a different question from the one you asked.

Deletion is a statement about the future of a copy that has already been made. It does not affect what happened during the window, and the window is where everything happens: the transfer itself, the storage bucket it landed in, the automated backup that ran at 03:00, the subcontractor doing the image processing, the log line that recorded the filename, the analytics event that fired on upload. A promise to delete after 30 days cannot retract a copy taken on day two.

It also says nothing about jurisdiction. A photo uploaded from Lagos or Manila may be processed on servers in a third country under laws neither party thought about. And it says nothing about the end of the company: a retention policy is a policy, and policies do not survive an acquisition or an insolvency in any form you can rely on.

None of this requires anyone to be dishonest. It only requires the ordinary things that happen to data once a copy exists.

The alternative is not a promise, it is an absence

The way out is not a better privacy policy. It is to not make the copy.

Everything a passport photo tool needs to do can now be done inside a browser tab. Separating a person from a background and locating the eyes, nose and mouth are jobs for small vision models, and browsers can run those models on your own processor. Once they are running locally, the crop, the head-height measurement and the background replacement are ordinary image arithmetic. There is no step in that sequence that requires a server to see your face.

This is how our tool works, and the reason we can state the promise flatly rather than carefully: your photo never leaves your device. We are not asserting that we handle your image responsibly. We are asserting that we never receive it, which is a claim with no room for interpretation.

You should not take that on faith, and you do not have to. Two checks take a minute:

The network panel. Open your browser's developer tools, go to the network tab, and leave it open. Load the page and you will see the page's own code and, once, the vision model files arriving. Then choose your photo and let the tool work. An upload is not subtle: it appears as a request with a large payload going out. If nothing large goes out, nothing large went out.

Aeroplane mode. Load the page and wait for it to finish preparing. Then put the device into aeroplane mode and use the tool anyway. If the photo still gets measured and cropped with the network switched off, the processing was never happening anywhere else. This test is the more convincing of the two because it cannot be faked by a site that is merely deferring its upload.

Be precise about what this does and does not cover

Honesty about a privacy claim means naming its edges.

On-device processing covers your photo. It does not make a web page stop being a web page. The HTML, the scripts and the model files are downloaded over the network like anything else, and any analytics or advertising a site carries behaves as it does everywhere. If you want to see what a page contacts, the same network panel shows you.

It also does not remove the upload at the end. Most applications now want a digital file, and you will send it to the passport office, the visa portal or the immigration service. That transfer is the point of the exercise: the authority issuing your document needs your photograph, and it has a legal basis for holding it. What in-browser processing removes is the pointless extra copy, held by a company with no role in your application, made only so that a rectangle could be cut to size.

Two practical edges are worth knowing. On a shared computer, the image sits in the page while the tab is open, so close the tab when you are done. And a photo already sent through a messaging app has been recompressed by that app, which is a quality problem rather than a privacy one, but it is the most common reason a good photo fails a resolution check.

The short version

Ask a photo tool one question: does my image go to your server? If the answer is yes, every other assurance is a promise about how a copy of your face will be looked after by strangers. If the answer is no, there is nothing to promise, because there is nothing there.

When you are ready, the practical steps for taking the photo cover light, distance and camera settings, and the digital size requirements explain what the portal will ask for once you have it. If your application is in Australia, where the passport office's warning is unusually direct, the Australian requirements set out what the office expects.