HivisionIDPhotos turns a normal photo of a person into a standard ID photo. It finds the face, cuts the person out from the background, straightens and crops to the size you choose, fills in a plain background colour, and can lay several copies out on a 6-inch or A4 sheet for printing. A Gradio web page on your own machine does all of it with a few clicks.
It is on the list because it is small and private: about 10,000 lines of Python, with matting models of around 25 MB that run on a CPU in a fraction of a second. Nothing has to leave your computer, which matters for a photo of your face going onto an official document. There is also a REST API and Docker image for building it into something else.
About 21,700 stars, Apache-2.0, at v1.3.1 when scanned. The limits: the README is mostly in Chinese with English, Japanese and Korean translations, code changes have been rare since mid-2025, and you still need to check the output against your country's photo rules.
- Repository: github.com/Zeyi-Lin/HivisionIDPhotos
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 21.7K. Forks: 2,523. Last push: Jul 3, 2026.
- Scan: safe, Oct 26, 2026, commit 5c191e2
Who it is for
Anyone who needs passport, visa or ID photos and would rather not upload a face photo to a website, and developers adding ID photo generation to an app.
Getting started
1. Get the code and install the requirements
git clone https://github.com/Zeyi-Lin/HivisionIDPhotos.git && cd HivisionIDPhotos && pip install -r requirements.txt -r requirements-app.txt2. Download the matting models
python scripts/download_model.py --models all3. Start the local web interface
python app.pyPython 3.10 in a virtual environment is what the project tests on. The default MODNet plus MTCNN combination runs on any CPU; the more accurate birefnet-v1-lite model wants about 6 GB of memory, or a GPU.
Safety scan
We cloned Zeyi-Lin/HivisionIDPhotos at commit 5c191e2 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no committed binaries and no bare-IP URLs in about 10,000 lines.
- The one installer script, .devcontainer/start.sh, uses sudo and edits a shell profile, but only inside the development container; it is not part of a normal install.
- The only external API in the code is api-cn.faceplusplus.com, for the optional Face++ online face detector. The default detectors, MTCNN and RetinaFace, run locally. Model weights download from the project's GitHub releases and Hugging Face.
- No lockfile, so the scanner did not look up known advisories for the Python dependencies.
- One workflow, none using pull_request_target; its 4 third-party actions are not pinned to a commit. Licence present; no security policy, contributing guide or Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 installer script (one edits your shell profile; one can call sudo) |
| Committed binaries | None. |
| CI workflows | 1 workflow. None use pull_request_target. 4 of 4 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 5 distinct hosts referenced from source; most often github.com, www.apache.org, api-cn.faceplusplus.com, gist.github.com. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (1)
- .devcontainer/start.sh, 11 lines, uses sudo, edits your shell profile
By the numbers
| Stars | 21.7K |
|---|---|
| Forks | 2,523 |
| Contributors | 24 |
| Commits | 446 |
| Open issues | 100 |
| Open pull requests | 6 |
| Releases | 17 |
| Latest release | v1.3.1 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 3 years |
| Last push | Jul 3, 2026 |
| Tracked files | 90 |
| Lines of code | 10.1K |
| Checkout size | 15 MB |
Lines by language: Python 6,844, Markdown 3,066, JSON 148, YAML 68, Shell 11.
Questions
Is HivisionIDPhotos free?
Yes. It is open source under Apache-2.0 and free to use, including commercially. The optional rmbg-1.4 and Face++ components have their own terms.
Does HivisionIDPhotos upload my photo?
No, not with the defaults. Matting and face detection run on your computer. Only if you choose the Face++ detector and enter its API key does an image go to that service.
Which ID photo sizes does it support?
It ships with common presets such as one-inch, two-inch and US passport sizes, and accepts custom sizes in pixels or millimetres, plus custom background colours by hex code. Always check the rules of the office you are submitting to.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.