I audit my visa database against the airlines' own data every month. Here is how it works

Mustapha Larhrouch — Fri, 23 Oct 2026 15:15:17 +0000

If you hold a Moroccan, Nigerian or Indian passport, "where can I go without a visa?" is not a fun quiz. It decides whether a trip happens at all. The usual answer is a passport ranking site with a big headline number. I built Wandava to give that answer per passport, and I learned quickly that the hard part is not the website. It is knowing whether each of the roughly 39,000 passport-to-destination rules is still true.

This post is about how I keep that data honest: where it comes from, how I check it, and what the checks found.

Starting point: a good open dataset that ages

The base is the open Passport Index dataset (MIT licence): one row per passport and destination, with values like "visa free", "visa on arrival", "e-visa" or "visa required". It is the best free starting point I found. But visa rules change every week, and a dataset that was right in June is wrong somewhere by October.

How wrong? In my first check, on 24 September 2026, the Moroccan passport agreed with the airline-based reference (more on that below) on 154 of 198 destinations. Some differences were labels, but several were real. The worst: Thailand. On 15 September, Thailand cut its visa exemption for 21 nationalities, Morocco included. The dataset still said "visa-free, 60 days", and my site was recommending Thailand as one of the easiest trips for Moroccans. That was the moment I stopped treating the dataset as truth.

Corrections live in a separate file, each with a source

I never edit the base data. Every correction is a record in its own file, applied at build time:

{
  "id": "th-2026-30d",
  "destination": "TH",
  "passports": ["AU", "AT", "BH", "..."],
  "set": { "type": "visa-free", "days": 30 },
  "validFrom": "2026-09-15",
  "source": {
    "url": "https://www.tatnews.org/2026/09/thailand-introduces-new-30-day-and-15-day-visa-exemption-rules-from-15-september/",
    "publisher": "Tourism Authority of Thailand, citing the Royal Gazette of 31 Aug 2026",
    "checked": "2026-09-24"
  },
  "status": "verified"
}

Three rules keep this honest:

No source, no correction. The source must be the destination's own government (immigration service, foreign ministry, official gazette, embassy) or, when that is unreachable, an authoritative secondary source that is named as such.
validFrom separates real changes from stale data. Thailand changed on a known date, so the record switches on by itself. A correction of old data has no date.
The page shows it. Every corrected row on a passport page now displays the publisher and the date I read it. If I can't show where a rule comes from, I don't publish it.

Today there are 188 such corrections, touching about 5,000 cells.

The audit: comparing against what airlines check

Airlines check passengers against IATA Timatic, which is not free. Wikipedia's "Visa requirements for X citizens" tables cite Timatic for most rows, so they are a usable proxy. A script fetches each table, parses it, and compares it with my published data, passport by passport:

agree: same entry type (and same stay length, when both give one);
we say easier / we say harder: a real difference to investigate;
dismissed: a difference I already checked against an official source, which showed my value is right (recorded with that source, re-checked after six months);
labelling: both labels are defensible (an "optional eVisa or visa on arrival" filed as visa on arrival, for example).

The script never changes data. It writes a report per passport and a summary grouped by destination, because one official check usually settles a row for many passports at once.

The latest full run (22 October 2026) compared 38,611 rules across 199 passports. 36,888 (95.5%) either match Timatic or were confirmed against an official source. 1,723 are still open. For Morocco it is 192 of 198, with 6 open, and each of those 6 is open for a reason I can name (more below).

What the audits found

A few cases show why "check the official source" is not a formality.

Georgia. Morocco is on Georgia's published list of countries eligible for the e-visa. Wikipedia said visa required. I kept "e-visa" at first, because the official list said so. Then I asked the e-visa application form itself, for every citizenship: it rejects Moroccans and tells them to apply at an embassy. The published list was out of date, and Wikipedia was right. 42 passports changed to visa required.

Saint Vincent and the Grenadines. The dataset gives most visa-free passports 90 days. The foreign ministry's own page says visitors get "visa free access for a maximum stay of 1 month", except CARICOM, OECS and British passports. One record fixed it for every passport.

Andorra and San Marino. Neither issues visas, so they look visa-free. But you can only reach them through France, Spain or Italy, so a Moroccan needs a Schengen visa to get there. My data says that, and the difference with Wikipedia is now recorded as checked.

What stays open. Israel's online visa may or may not be open to Moroccans: press reports disagree and the official portal only renders in a browser. Namibia's portal sits behind a bot check and its official list is a scanned PDF. Solomon Islands' government site blocks scripts. Venezuela's portal needs an account. Those rules stay as they are, and stay on the open list, until an official source can be read. I don't change a rule on the word of a blog or a visa agency.

Why sites disagree on the "number"

The same passport gets very different totals on different sites, and people read that as one of them being wrong. Usually they count different things:

visa-free only: for Morocco, 40;
no step before you travel (visa-free + visa on arrival): 63;
no embassy at all (adds online eTAs and eVisas): 100.

There is also a definition fight inside "eVisa". Some countries let you apply online, but only through a local sponsor or with a full set of supporting documents (the UAE tourist visa, Australia's visitor visa for many nationalities). Wandava counts those as embassy-style visas, not eVisas. Passport pages now lead with the visa-free number and show how the rest adds up, so nobody mistakes 100 for "visa-free".

The site is static, on purpose

Wandava is a static Nuxt site with no backend and no database. All of this runs at build time:

npm run data merges the base dataset, the corrections, the visa-holder rules, official eVisa portals and airport-transit lists into one JSON file per passport and per destination;
the audit script writes data/audits/latest.json, which the build publishes into each passport file, so the accuracy line on a page always matches the last audit;
npm run generate prerenders about 1,200 pages in English and French.

A static site makes freshness visible: each page shows the check date of its data, the sitemap's lastmod follows the data date, and a deploy pings IndexNow with the pages whose data changed.

Open data

Everything above is published as JSON with a field reference: one file per passport, per destination, the visa-holder rules, the official portals, and the audit summary. The full method, with an accuracy table for 12 passports, is on the methodology page.

If you spot a rule that is out of date, I would like to hear about it, ideally with a link to the official source. That is how the open list gets shorter.

DEV Community: Mustapha Larhrouch