Offline Aadhaar Masking: Mask the First 8 Digits Without Uploading

Masking an Aadhaar number is a two-minute job. Doing it through a cloud tool is a reportable data breach.

An HR executive is onboarding forty people. Each one has sent an Aadhaar card as a PDF. Policy says the first eight digits must be masked before anything goes into the HRMS.

So they search for a masking tool, find a free online PDF editor, and upload forty unmasked Aadhaar cards to a server they know nothing about.

That single action is the thing the policy existed to prevent. Forty complete Aadhaar numbers, each attached to a name, a photograph and a date of birth, have just been transmitted to a third party with no contract, no security assessment, and quite possibly no presence in India. The masked copies that come back do not undo it.

This is the most common way Aadhaar data leaves an Indian organisation, and it happens during the compliance step.

What the Rule Actually Says

Two separate requirements are usually collapsed into one, and it is worth keeping them apart.

Masked Aadhaar (UIDAI)

UIDAI provides a masked Aadhaar format in which the first eight digits are replaced and only the final four remain visible — rendered as XXXX XXXX 1234. It is downloadable directly from the myAadhaar portal and the mAadhaar app, and it is a valid form of the document for most verification purposes.

Separately, the Aadhaar Act and the Aadhaar (Sharing of Information) Regulations restrict what an entity may do with an Aadhaar number. Publishing, displaying or posting an Aadhaar number publicly is prohibited, and entities are directed not to retain full Aadhaar numbers where they have no authority to do so.

KYC records (RBI)

For entities regulated by the Reserve Bank of India, the KYC Master Direction addresses the situation where a customer submits Aadhaar as an officially valid document. Where the copy is retained, the Aadhaar number is to be redacted or blacked out so that it is not stored in full.

The prior question

Before masking anything, ask whether you should be holding the document at all. Many organisations collect Aadhaar as a matter of habit rather than because a law requires it, and alternatives — offline e-KYC, the Aadhaar Virtual ID, or simply a different officially valid document — often serve the same purpose without putting a full Aadhaar number in your systems. The safest Aadhaar copy is the one you never collected.

Why Uploading It Is the Expensive Mistake

India's Digital Personal Data Protection Act, 2023 changed the arithmetic here. Sending an unmasked Aadhaar card to an unassessed third-party tool is no longer just poor practice.

Under the Act, an organisation deciding the purpose and means of processing personal data is a Data Fiduciary, and it remains responsible for personal data processed on its behalf. Section 8(5) requires a Data Fiduciary to take reasonable security safeguards to prevent a personal data breach. The Schedule sets the penalty for failing to do so at up to ₹250 crore.

Alongside that sit obligations to notify the Data Protection Board and affected individuals of a breach, with its own penalty of up to ₹200 crore.

The practical questions a cloud upload creates are the ones nobody wants to answer after the fact:

• Which entity processed the document, and under what contract?
• Was the data transferred outside India, and does that comply with your obligations?
• Did the individual consent to this processor, or only to your organisation?
• If that vendor is breached, are you notifying forty employees and the Board?

All of those disappear if the file never leaves the machine it was opened on.

A Black Box Is Not Masking

The second failure is quieter and worse, because the document looks correct.

Drawing a black rectangle over the first eight digits in a standard PDF editor does not remove them. It appends a drawing instruction that paints over text which remains fully intact underneath — recoverable by selecting and copying, by running pdftotext, or by pushing the file through a converter.

An Aadhaar card that has been "masked" this way and filed into an HRMS is a full Aadhaar number sitting in your systems, wearing a mask. If that database is ever exposed, the masking bought you nothing at all.

We covered the mechanism in detail in The Black Box Flaw. The short version: only rasterization — flattening the page to an image and burning the mask into the pixels — actually destroys what is underneath.

How to Mask an Aadhaar Card Properly

1. Decide whether you need the document at all. If a masked Aadhaar from myAadhaar or an alternative OVD will do, start there.
2. Work on a machine you control. If the tool requires an upload, it has joined your processing chain. RedactLocal runs entirely inside your browser tab.
3. Cover the first eight digits only. Leave the final four visible, and include any separators inside the masked area. In RedactLocal this is the 🇮🇳 UIDAI / RBI Aadhaar preset; elsewhere it is a rectangle you draw yourself.
4. Check the back and the QR code. An Aadhaar PDF often repeats the number elsewhere, and the QR code encodes demographic data. Mask every instance, not just the one on the front.
5. Flatten the output so the digits are destroyed rather than covered.
6. Verify before filing. Run pdftotext over the finished file, or open it and search for the first eight digits. If they appear, do not store it.
7. Delete the unmasked original once the masked copy is filed, unless you have a specific reason and lawful basis to keep it.

How RedactLocal Fits

RedactLocal is a PDF redactor that runs entirely in the browser. There is no upload endpoint, because there is no backend that accepts files.

Nothing leaves the tab

The card is read into memory by the browser's own file API, rendered locally, and exported by your browser's download mechanism. You can confirm it in ten seconds, and we would rather you did: open the tool, turn off your Wi-Fi, load the Aadhaar card and mask it. It keeps working, because there is nowhere for the file to go. No cloud tool survives that test.

The India preset masks the first eight for you

Aadhaar masking is a partial redaction — eight digits out of twelve — which is precisely why most automatic redaction tools are useless for it. A scanner that finds an identifier and blacks out the whole thing produces a fully masked number, and a fully masked number fails the KYC check it was prepared for.

RedactLocal now does the partial redaction directly. Choose 🇮🇳 UIDAI / RBI Aadhaar (Mask First 8 Digits, Keep Last 4) from the compliance preset selector in the toolbar, run Auto-Detect, and the scanner finds twelve-digit Aadhaar numbers on the page and places the box over the first eight digits only. The final four stay readable. A forty-card onboarding batch is a scan and a confirmation rather than forty hand-drawn rectangles.

Three details are worth stating precisely, because they are what separate this from a find-and-replace:

• Format does not matter. 2345 6789 0123, 2345-6789-0123 and 234567890123 are all matched, and in each case the same eight digits go under the box. The mask is positioned by measuring where the characters actually sit on the page, not by counting them.
• The pattern uses a real UIDAI rule. An Aadhaar number never begins with 0 or 1, so numbers that do are rejected outright. The scanner also refuses to take a twelve-digit bite out of a longer run of digits, which is how a sixteen-digit card number gets misread as an Aadhaar by naive tooling.
• Every hit is still reviewed before anything is drawn. The panel lists what was found, showing the covered digits as a bar and the retained four beside them, so you approve the outcome rather than the intention. Any twelve-digit number beginning 2–9 is structurally indistinguishable from an Aadhaar — an account number of the same shape will be offered as a match, and you decline it.

All of it executes in the tab. The preset changes which patterns run against text already held in your browser's memory; it contacts nothing, and it works with the network off. Manual masking remains available and remains the right method for anything the text layer cannot reach — which, for Aadhaar work specifically, is a larger category than it sounds. See below.

The mask is destroyed, then verified

On export, every page is rasterized and the mask is burned into the pixels. The new PDF is assembled from images alone, so there is no text layer left to recover. The file is then re-opened and inspected before the download appears, reporting the flattened page count alongside the number of selectable characters, text operators, font objects and annotations found. On a correct export those counts are zero.

Forty cards at a time

Onboarding is rarely one document. You can queue the whole set, work through them in turn, and export as a single archive — without any of them leaving the machine. Each mask can carry a stamp such as PII REDACTED or your own reference, burned into the black.

What This Does Not Do

One limit matters more than usual for Aadhaar work.

Most Aadhaar cards are scans or photographs. If the PDF is an image with no text layer, there is nothing for any pattern scanner to read — in RedactLocal or anywhere else. The India preset will find nothing on such a file, and finding nothing is not the same as there being nothing. Draw the box by hand and export as normal; for a photographed card that is the only method available regardless of which tool you use. Where the file has been OCR'd by your document system, it does contain recoverable text, and the preset will find it — which is exactly the case people wrongly assume is safe because "it is only a picture."

The site loads page analytics. Loading redactlocal.org records a page view, as most websites do. It has no access to your documents, which never leave your tab's memory. We state that plainly, because a tool asking you to trust its handling of data you cannot see should be candid about the data you can.