Secure Travel Document Wallet

The exploration

Travelers photograph their passports anyway — into camera rolls, chat threads, and email drafts, the least protected places on a phone. The exploration: can a wallet hold passports, visas, and insurance documents with genuinely local-first security, while still surviving the two scenarios that make people reach for the cloud — a lost phone, and a border queue with no signal?

Threat model first

The primary threat is a lost or stolen phone, powered on. Documents live in an app-level encrypted store layered on device encryption, unlocked by biometrics with a passcode fallback that is not the device passcode. The store re-locks aggressively, and a wrong-passcode threshold wipes the app’s keys — the documents’ plaintext never existed outside the secure store, so there is nothing else to chase. Deliberately out of scope: defending against a coerced unlock. That is a legal situation, not a UX flow, and pretending software solves it would be dishonest.

Why cloud OCR is rejected

Auto-extracting passport fields is table stakes — but sending a passport photo to a cloud OCR API creates a copy whose lifetime the user cannot audit. The passport’s machine-readable zone was designed for deterministic parsing: on-device MRZ reading with checksum validation covers names, numbers, and dates with no network dependency at all. Slightly worse extraction on damaged pages is the accepted price of an architecture where the document provably never leaves the device.

Recovery and emergency access

No cloud copy means recovery must be designed, not assumed. Two mechanisms under test: a printed recovery kit (key material as QR, stored like a spare house key), and an emergency envelope — an encrypted bundle pre-shared to a trusted contact that opens only with their key plus a time delay the owner can veto. Both trade convenience for auditability; whether mainstream travelers accept that trade is the open question.

Border-crossing mode

At a checkpoint, fumbling through an app is a stress amplifier. A dedicated glance mode shows one chosen document full-screen — brightness up, screenshots blocked, everything else hidden behind a re-lock — reachable in two taps from the lock screen.

Evaluation

• Recovery-kit drill: what share of test users can restore unaided (target hypothesis: near all, or the design fails)
• On-device MRZ accuracy across a corpus of worn and low-light captures
• Time-to-document in border mode against a five-second design budget