NearSeal

2026-08-22

Should you encrypt the passport and ID scans sitting in your Downloads folder?

Most people can't say how many copies of their own passport or ID are sitting in places they control. There's the scan emailed to a visa agency years ago, still in the Sent folder. The photo of a driver's license taken for an apartment application. The "just in case" copy in a cloud drive's travel folder, the one sent to yourself in a chat app, the one in Downloads from the last time a bank asked for it. Each of those is a complete, reusable identity credential sitting in plain form — and there's a functioning market for exactly that file. When researchers at Comparitech surveyed dark-web marketplaces, the average price of a digital passport scan was $14.71 — cheap because supply is plentiful — and bundling it with a selfie or a proof-of-address document pushed the average to $61.27, because that combination is enough to pass many remote identity checks. This post is about why those scattered copies are a bigger deal than a leaked password, and why they're also one of the easiest things to actually fix.

A leaked ID scan is worse than a leaked password

A password that leaks gets rotated in about a minute. An identity document doesn't work that way, and the clearest demonstration was the 2022 Optus breach in Australia: personal details of up to about 10 million current and former customers were exposed, around 2.8 million of them including driver's licence and/or passport numbers. What followed showed what "rotating" an identity document actually costs: state governments stood up free licence-replacement programs, and the telco agreed to cover passport replacements for affected customers — a physical document reissue, per person, at national scale, because numbers printed on those documents had been copied once. And that breach leaked document numbers. A scan is strictly worse: it's not a string that references your document, it's the visual artifact many remote verification processes accept as your document — which is exactly why the bundled-scan price on those marketplaces quadruples.

Even companies that must collect IDs keep losing them

You could conclude the fix is never sharing an ID scan, but plenty of sharing isn't optional — KYC rules mean an exchange or bank is legally required to collect it. That obligation doesn't make the collector safe. In May 2025, Coinbase disclosed that criminals had bribed overseas support contractors to pull customer data out of its own support tools — including government-ID images: driver's licenses and passports — for roughly 69,461 people per the company's filing with Maine's attorney general, followed by a $20 million extortion demand Coinbase refused to pay. No password was cracked and no server was hacked in the usual sense; people who were paid to look at the data simply copied it. The Marriott/Starwood breach adds the detail that matters most for this post: of the passport numbers attackers reached over four years inside the reservation system, 5.25 million were stored unencrypted and were exposed, while 20.3 million were stored encrypted — and Marriott said there was no evidence the attackers got the master key needed to read those. Same breach, same attackers, same years of access: the encrypted copies survived it and the plain ones didn't. (The FTC later took enforcement action over the security failures across Marriott's breaches.) You can't choose how a hotel chain stores your passport number. You can choose it for every copy you hold.

Two kinds of copies of your ID Copies you control Downloads folder, Sent mail, chats to yourself, cloud drive, old USB sticks → encrypt these at rest: a breach or lost device then exposes only ciphertext Copies you've handed over Telecom carrier, hotel front desk, exchange KYC, rental application → your encryption can't reach: share less, ask if a full scan is actually required, and delete your plaintext leftovers Only the left column is yours to fix — and it's the easy one
Encrypting your own copies doesn't shrink any company's honeypot — but it's the one column entirely under your control, and it's exactly where stray plaintext copies accumulate for years.

The copies you control are the easy win

Here's the property that makes ID scans nearly ideal candidates for file-level encryption: they're needed rarely and stored long. A tax spreadsheet gets opened every year; a passport scan might be touched twice a decade, but it sits in your Downloads folder, your mail archive, and your cloud drive the entire time — through every lost laptop, every phone theft, every cloud account phished in between. So do the inventory once. Search your email for attachments you sent ("passport," "license," your own name plus "ID"), check Downloads, check the chat threads with yourself, check the travel folder in your cloud drive. Then collapse all of it to one rule: the plaintext scan exists on your screen only at the moment someone legitimately needs it, and what sits on disk — anywhere on disk — is ciphertext. Encrypt the scan once with a strong passphrase, put the encrypted file wherever is convenient (cloud included: ciphertext is safe to sync precisely because it's unreadable without the passphrase), and delete the plaintext strays. When the next visa form or landlord asks for a copy, decrypt locally, send what's needed, and let the plaintext copy go again.

What encrypting your copies doesn't fix

Honesty requires the other column: the copy you hand to a KYC process or a hotel is out of your hands, in their systems, under their retention policy — Coinbase's customers had no encryption decision to make about the images in Coinbase's support tools. Encrypting your archive does nothing about that, which is why the second lever is sharing less in the first place: asking whether a full scan is required or a sighting/partial detail will do, and not letting "send me your ID" become a reflex you comply with over email to anyone who asks. And one mechanical mistake defeats the whole scheme: sending an encrypted file and its passphrase in the same email thread. If you must transmit an encrypted copy, the passphrase travels by a different channel — a phone call, a text message, in person — so that one intercepted mailbox never yields both pieces.

Where NearSeal fits

NearSeal runs entirely in your browser: the scan and the passphrase never leave your device, there's no account and no upload step — which matters more than usual when the file in question is the document that proves who you are. It encrypts with AES-256-GCM, deriving the key from your passphrase with PBKDF2-SHA256 at 220 iterations. For a file you might not open for five or ten years, the opt-in age-encryption.org format is worth considering: an age file opens in the standalone age or rage CLI and any other age-compatible tool, with no assumption that this website still exists when you finally need the scan back. One caveat carries extra weight at that timescale: there is no recovery. Nobody — including NearSeal — holds a copy of your passphrase, so a forgotten passphrase means a lost file. For a document this durable, store the passphrase somewhere equally durable and separate: a password manager, or paper in the same drawer as the physical passport it protects a copy of. The physical document already lives behind a lock; its digital copies have spent years not doing so. That's the gap worth closing this week.