Aadhaar masking,
answered.

Aadhaar masking hides the first 8 digits of the 12-digit Aadhaar number on a copy of the card, so only the last 4 stay visible. The copy can still be matched to a person or record, without exposing the full number.

For many organisations it is expected. RBI's KYC Master Direction asks regulated entities to ensure the Aadhaar number on a submitted copy is redacted or blacked out where Aadhaar authentication isn't required, and India's DPDP Act, 2023 expects reasonable safeguards for personal data. What applies to you is for your compliance team to decide; this isn't legal advice.

It finds the Aadhaar card in a photo or scan and covers the first 8 digits of the Aadhaar number and the QR code. The last 4 digits stay visible, and the rest of the image is left exactly as it was.

That's the format of a masked Aadhaar: the last four digits are enough to match the card to a person or record, without exposing the full number.

The QR code on an Aadhaar card can carry the holder's personal details. Covering only the printed number would leave those details readable by any QR scanner.

Pricing depends on your volume and how you deploy it: on your own servers, inside DocVault, or (planned) as a hosted API. Talk to our sales team. The free trial lets you see the API flow on your own card first.

No. Maskly is an independent tool and is not affiliated with UIDAI.

Yes. Inside DocVault, bulk jobs run over whole folders of stored files, mask every stored version, and report each skipped file (for example, under legal hold) with the reason. For other systems, your applications can send stored documents to the Maskly API on your own servers.

Yes. It runs as a container on ordinary CPUs; no GPU is needed. Plan on at least 8 GB of memory. Talk to us about setup

Yes. It's built into DocVault document management, where it can mask files automatically in chosen folders, at upload, in a workflow, or in bulk.

Masking helps you keep less personal data, which supports data-protection obligations. It doesn't on its own make an organisation compliant, and it isn't legal advice; your compliance team should decide how to use it.

JPG, PNG, PDF and TIFF, including multi-page PDFs and TIFFs, on your own servers and inside DocVault. File size and resolution caps are set for your deployment.

Every request carries an API key, and the rules you set for your deployment are applied to it: key expiry, images per key, requests per client in a time window, and file size caps. Keys are tied to the client that requested them, and only a one-way hash of each key is stored.

The same flow your systems would use: get a key, send an image, follow its status, and collect the masked result, with access rules applied the way they would be in your deployment. The trial's own rules are set for a public page; yours are set to your needs.

A card is masked in seconds, and Maskly runs on ordinary CPU servers with no GPU. It has been tested on an Intel Core i7 machine (4 cores, 8 threads, 32 GB of memory) and a 2-vCPU, 8 GB cloud server. For your volume, we size the servers with you and confirm the numbers on your own documents before go-live. Performance and sizing

No Aadhaar number was found, so nothing was masked, and the page says so. A sharp, well-lit photo of the whole card usually helps. A card that's already masked is also left as it is.

No, by design. Each masked result is released once, to the request that made it, and then erased, so no copy lingers on the service. Uncollected results are erased automatically after the retention time you set.

No. An image is held in memory only until its masked result is collected, or until the retention time runs out, then erased. It's never written to disk or a database.

No: not the full number, not the last four digits, and not anything else read from the card. We don't store your file name either.

The time of each request, its source IP address, the file's type and size and a one-way fingerprint of it, and whether masking succeeded. That's enough for an audit trail and to stop misuse, and nothing about what's on the card.

Yes. Run Maskly on your own servers, or use it inside DocVault on your own infrastructure, and images never leave your network.

It works on ordinary phone photos and scans, including rotated and tilted ones. Like any automated system, it can miss a card in a very blurry, dark, glare-covered or heavily cropped photo. For documents that matter, look at the result before relying on it.

Both horizontal and vertical number layouts are handled.

A second-pass check is on the roadmap. It would flag any masked image where a full number might still be readable. See the roadmap

Yes. Send an image, check its status, and collect the masked copy once. The online trial runs on it. Hosted API accounts, sized to your volume, are planned. Talk to our sales team

Yes on your own servers and inside DocVault, where PDFs work and bulk jobs mask whole folders. Through our hosted API, both are planned.