Making photo quality measurable: ISO/IEC 29794-5 and OFIQ explained
ISO/IEC 29794-5 is the international standard that defines how the quality of a face image can be measured. OFIQ (Open Source Face Image Quality) is the freely available reference software for it, developed by the German Federal Office for Information Security (BSI). It rates a photo with scores from 0 to 100 and shows what weakens it.
The problem is known to anyone who has ever collected hundreds of ID photos: a picture that looks perfectly fine on screen still gets sent back. Too dark, says an office. Another says, head a little bit tilted. For a long time “good quality” was a matter of judgment and two pairs of eyes rarely agree. Since April 2025, there has been a common yardstick for it.
What does ISO/IEC 29794-5 contain?
The standard describes how to express the quality of a single face image in numbers, in software. Basically, it asks: how similar is this photo to an ideal face image as defined by other standards, such as ISO/IEC 39794-5? It is meant for three cases: reference photos for identity documents, enrollment in biometric systems and live captures that are matched immediately.
This makes it different from the standards known from the ID world. ICAO 9303 defines the requirements for a photograph in a travel document. ISO/IEC 19794-5 defines the structure and storage of a face image. Both are described in the article ICAO 9303 vs. ISO/IEC 19794-5 and in the basics of ISO/IEC 19794-5. ISO/IEC 29794-5 picks up where they left off: it measures how good a particular photo is.
There is one thing it intentionally does not do. Nowhere does it say what score is “good enough” for a photo. Each organization sets that threshold for its own purposes. More on that below.
What is OFIQ, and why did the BSI build it?
The BSI has released an open source software library called OFIQ that implements the measurement methods of the standard. It is the official reference implementation. Anyone who wants to know how a measurement is meant can look it up in the code.
The rationale is easy to follow. For fingerprints, an open quality algorithm has been available from NFIQ since 2004; there was no equivalent for faces. At the same time all border crossings in the Schengen area, for example, have to evaluate photos in the same way, or there will be gaps and contradictions. This is solved by an open yardstick that produces the same result for everyone. OFIQ is written in C/C++ and available free on GitHub (also for mobile platforms). The BSI states that it can be used in commercial and government applications. The final report for version 1.0 was released at the end of 2024.
What does OFIQ measure?
OFIQ gives two types of scores. The overall score, technically known as the Unified Quality Score, estimates how well-suited a photo is for automated face recognition. It tells you if the image is usable, not what is wrong with it. That is what the quality components are for: according to the BSI, more than 20 of them measure individual properties such as lighting, sharpness or head pose. Some are about the capture itself (camera, lighting, surroundings), the others about the person in front of the camera (pose, expression, occlusions).
In practice, the components can be summarized as follows:
| What OFIQ looks at | What helps when taking the photo |
|---|---|
| Calm, even background | A plain wall instead of a shelf or window |
| Even lighting on both halves of the face, neither too dark nor too bright | Light from the front, no backlighting, no direct flash |
| Sharpness and unaltered image data (no compression artifacts, natural colors) | Hold the camera steady, upload the original file, turn off filters |
| Exactly one face in the picture | Stand alone in front of the camera |
| Eyes open and visible, mouth closed, neutral expression | Look into the camera, keep hair out of the face, avoid reflections on glasses |
| Nothing covers the face or mouth | Hands, mask, and hair away from the face |
| Head large enough, complete, and facing the camera | Suitable distance, look straight into the camera |
| No headgear | Remove caps or hats unless an exception applies |
How to read the scores correctly?
Each score is an integer between 0 and 100. Higher is better. 100 is the best quality. That sounds so simple, but there are three things that are easy to miss when reading them.
First, a score is not an approval. A 62 by itself is neither good nor bad; the threshold is explicitly left to the use case by the standard. Second, the overall and component ratings answer different questions. The components are more useful for feedback to the person, because instead of “Insufficient quality” you can say: “Please turn toward the light.” Third, high quality is not the same as compliant. Whether a photo meets all the requirements of an issuing authority is still decided by its own rules. What inspection offices usually reject is described in our article on biometric photos according to ICAO standards.
If you want to establish your own thresholds, it is best to begin by defining the purpose. A photo that will only be used on a visual ID card can be more forgiving than one that will be used later for automated face matching. Then it helps to look at real photos: If you measure a sample of already accepted and rejected images, you will usually see quickly where the two groups separate. Slightly uneven lighting might be acceptable, but closed eyes never are. It makes sense to make such decisions on a per-component basis rather than just looking at the overall score. Each threshold must also include a specific instruction for the person. And since scores can drift from software version to software version, you should document the version and thresholds and recheck after updates.
Why does this matter today?
Because face images are evaluated more and more by machines and not by people, and because bad pictures in big databases degrade the recognition performance of the whole system. Two examples illustrate the direction. In Germany, passport photos submitted by applicants have mostly not been scanned at passport and ID offices since May 2025; photos are now almost exclusively taken live. And the European Entry/Exit System (EES), which stores facial images and fingerprints of third-country nationals, is designed for 200 to 300 million records.
When an ID photo is more than a picture on a card, it affects companies too. If it’s the reference for face matching in access control, its quality helps to determine how reliably the door opens.
What does that mean for organizations that collect ID photos?
Above all, one thing: the cheapest place to get quality is where the photo is taken. A picture that only stands out in the card office weeks later means a second round with the person concerned, and that second round is usually the most tedious one. So any procurement of a solution should ask which quality characteristics are checked at the very point of capture and what feedback the person receives at that very point.
Enter Photo Collect. OFIQ itself is not integrated. Instead, every photo is automatically verified upon upload against more than 35 criteria based on ICAO 9303 and ISO/IEC 19794-5, i.e., directly against the requirements for lighting, sharpness, head pose, eyes and background. Those are the same factors that OFIQ measures, mostly. If something isn’t quite right, the person gets feedback immediately. Thus, only 2 to 4 percent of the pictures must be requested again, usually. The final visual check takes about one second per image. The AI models are built in-house, and the faces are analyzed but never modified. Read more in the article Quality control meets AI and on the pages about driver’s licenses and citizen portals.
Frequently asked questions
Is OFIQ a replacement for checks against ICAO 9303? No. OFIQ measures quality on a scale; ICAO 9303 defines requirements. The issuing authority still decides if a photo is acceptable.
Is OFIQ a certificate? No. OFIQ is software for traceable measurements according to ISO/IEC 29794-5. An OFIQ score is a measurement result, not a seal of approval.
Is OFIQ usable in your own products? The BSI says yes, even for commercial purposes. But before doing that, you should check the license of OFIQ, and of the components that are integrated. In the reference implementation, external algorithms are used, with their own license terms.
Does ISO/IEC 29794-5 also apply to employee ID cards? The standard targets identity documents, biometric enrollment and live matching. It is a voluntary benchmark for employee ID cards, which makes sense especially if the photo is also used for automated face matching.