Offline Aadhaar Masking: Mask the First 8 Digits Without Uploading

Masking an Aadhaar number is a two-minute job. Doing it through a cloud tool is a reportable data breach.

An HR executive is onboarding forty people. Each one has sent an Aadhaar card as a PDF. Policy says the first eight digits must be masked before anything goes into the HRMS.

So they search for a masking tool, find a free online PDF editor, and upload forty unmasked Aadhaar cards to a server they know nothing about.

That single action is the thing the policy existed to prevent. Forty complete Aadhaar numbers, each attached to a name, a photograph and a date of birth, have just been transmitted to a third party with no contract, no security assessment, and quite possibly no presence in India. The masked copies that come back do not undo it.

This is the most common way Aadhaar data leaves an Indian organisation, and it happens during the compliance step.

What the Rule Actually Says

Two separate requirements are usually collapsed into one, and it is worth keeping them apart.

Masked Aadhaar (UIDAI)

UIDAI provides a masked Aadhaar format in which the first eight digits are replaced and only the final four remain visible — rendered as XXXX XXXX 1234. It is downloadable directly from the myAadhaar portal and the mAadhaar app, and it is a valid form of the document for most verification purposes.

Separately, the Aadhaar Act and the Aadhaar (Sharing of Information) Regulations restrict what an entity may do with an Aadhaar number. Publishing, displaying or posting an Aadhaar number publicly is prohibited, and entities are directed not to retain full Aadhaar numbers where they have no authority to do so.

KYC records (RBI)

For entities regulated by the Reserve Bank of India, the KYC Master Direction addresses the situation where a customer submits Aadhaar as an officially valid document. Where the copy is retained, the Aadhaar number is to be redacted or blacked out so that it is not stored in full.

The prior question

Before masking anything, ask whether you should be holding the document at all. Many organisations collect Aadhaar as a matter of habit rather than because a law requires it, and alternatives — offline e-KYC, the Aadhaar Virtual ID, or simply a different officially valid document — often serve the same purpose without putting a full Aadhaar number in your systems. The safest Aadhaar copy is the one you never collected.

Why Uploading It Is the Expensive Mistake

India's Digital Personal Data Protection Act, 2023 changed the arithmetic here. Sending an unmasked Aadhaar card to an unassessed third-party tool is no longer just poor practice.

Under the Act, an organisation deciding the purpose and means of processing personal data is a Data Fiduciary, and it remains responsible for personal data processed on its behalf. Section 8(5) requires a Data Fiduciary to take reasonable security safeguards to prevent a personal data breach. The Schedule sets the penalty for failing to do so at up to ₹250 crore.

Alongside that sit obligations to notify the Data Protection Board and affected individuals of a breach, with its own penalty of up to ₹200 crore.

The practical questions a cloud upload creates are the ones nobody wants to answer after the fact:

• Which entity processed the document, and under what contract?
• Was the data transferred outside India, and does that comply with your obligations?
• Did the individual consent to this processor, or only to your organisation?
• If that vendor is breached, are you notifying forty employees and the Board?

All of those disappear if the file never leaves the machine it was opened on.

A Black Box Is Not Masking

The second failure is quieter and worse, because the document looks correct.

Drawing a black rectangle over the first eight digits in a standard PDF editor does not remove them. It appends a drawing instruction that paints over text which remains fully intact underneath — recoverable by selecting and copying, by running pdftotext, or by pushing the file through a converter.

An Aadhaar card that has been "masked" this way and filed into an HRMS is a full Aadhaar number sitting in your systems, wearing a mask. If that database is ever exposed, the masking bought you nothing at all.

We covered the mechanism in detail in The Black Box Flaw. The short version: only rasterization — flattening the page to an image and burning the mask into the pixels — actually destroys what is underneath.

How to Mask an Aadhaar Card Properly

1. Decide whether you need the document at all. If a masked Aadhaar from myAadhaar or an alternative OVD will do, start there.
2. Work on a machine you control. If the tool requires an upload, it has joined your processing chain. RedactLocal runs entirely inside your browser tab.
3. Cover the first eight digits only. Leave the final four visible. Include any separators inside the masked area.
4. Check the back and the QR code. An Aadhaar PDF often repeats the number elsewhere, and the QR code encodes demographic data. Mask every instance, not just the one on the front.
5. Flatten the output so the digits are destroyed rather than covered.
6. Verify before filing. Run pdftotext over the finished file, or open it and search for the first eight digits. If they appear, do not store it.
7. Delete the unmasked original once the masked copy is filed, unless you have a specific reason and lawful basis to keep it.

How RedactLocal Fits

RedactLocal is a PDF redactor that runs entirely in the browser. There is no upload endpoint, because there is no backend that accepts files.

Nothing leaves the tab

The card is read into memory by the browser's own file API, rendered locally, and exported by your browser's download mechanism. You can confirm it in ten seconds, and we would rather you did: open the tool, turn off your Wi-Fi, load the Aadhaar card and mask it. It keeps working, because there is nowhere for the file to go. No cloud tool survives that test.

Precision masking is the right tool for this job

Aadhaar masking is a partial redaction — eight digits out of twelve — and that makes it a job for a drawn box rather than an automatic sweep. You drag a rectangle over the first eight digits, leave the last four clear, and the mask lands exactly where you put it.

To be straightforward about the limits of the automatic scanner: RedactLocal's Auto-Redact does not currently include an Aadhaar pattern, and it blacks out whole matches rather than parts of them. Even with such a pattern it would mask all twelve digits, which is not what the rule asks for. Manual masking is the correct method here, not a workaround.

The mask is destroyed, then verified

On export, every page is rasterized and the mask is burned into the pixels. The new PDF is assembled from images alone, so there is no text layer left to recover. The file is then re-opened and inspected before the download appears, reporting the flattened page count alongside the number of selectable characters, text operators, font objects and annotations found. On a correct export those counts are zero.

Forty cards at a time

Onboarding is rarely one document. You can queue the whole set, work through them in turn, and export as a single archive — without any of them leaving the machine. Each mask can carry a stamp such as PII REDACTED or your own reference, burned into the black.

What This Does Not Do

One limit matters more than usual for Aadhaar work.

Most Aadhaar cards are scans or photographs. If the PDF is an image with no text layer, there is nothing for any pattern scanner to read — in RedactLocal or anywhere else. Manual masking and flattened export work normally on such files, and for a photographed card that is the only method available regardless of which tool you use. Where the file has been OCR'd by your document system, it does contain recoverable text, which is exactly the case people wrongly assume is safe because "it is only a picture."

The site loads page analytics. Loading redactlocal.org records a page view, as most websites do. It has no access to your documents, which never leave your tab's memory. We state that plainly, because a tool asking you to trust its handling of data you cannot see should be candid about the data you can.