Three ways to mask an Aadhaar number, and they suit genuinely different situations. This page is about which one fits yours — including the cases where the answer is not a product at all.
| Browser tool | REST API | Manual editing | |
|---|---|---|---|
| Volume it suits | A handful a day | Dozens to millions | One or two, once |
| Where the document goes | Nowhere — stays in the browser | To the API and back; not stored | Nowhere |
| Setup | None | An afternoon | None |
| Cost | Free, then ₹399/month | By volume | Your time |
| Fits into a pipeline | No | Yes | No |
| Main risk | Doesn't scale | Needs correct error handling | Human error, and see below |
You are an individual sharing your own Aadhaar. Renting a flat, opening an account, a college admission. Use the free browser tool. Two documents a day, no account, and the file never leaves your machine — the masking runs in JavaScript on your own device, which is why it can be free and why there is nothing to trust us with.
Your team handles a few dozen documents a week. A small NBFC branch, a brokerage, an HR team collecting joining documents. The browser tool at ₹399 a month covers 150 documents and needs no engineering. Add the API when you want masking to happen without someone remembering to do it.
Documents arrive through a system. A KYC queue, a loan origination flow, a policy issuance pipeline. This is what the API is for. The argument is not throughput — a person can mask a hundred documents a day. It is that a manual step is a step someone can skip on a busy afternoon, and you will not know which afternoon that was.
You have an archive to clear. Documents collected before masking was policy. That is a bulk problem with its own shape — sizing, resumability, and what to do with documents that come back unreadable. See bulk Aadhaar masking.
Including this one. These are five tests you can run in an afternoon, and they separate tools that mask reliably from tools that mask the easy cases.
The standard UIDAI printout carries both sides of the card, and on many layouts one is rotated ninety degrees relative to the other. A detector that stops at the first number it finds masks the upright card, reports success, and leaves the rotated one fully readable. This is the single most common real-world failure, and it produces a document that looks masked.
The sixteen-digit Virtual ID printed alongside the Aadhaar number contains five overlapping twelve-digit windows. A tool that matches any twelve consecutive digits will black out part of the VID, and often the date of birth too. That is not a security problem, but it tells you the tool has no checksum validation — which means its detection is pattern-matching, and pattern-matching is what produces both false positives here and misses elsewhere.
Aadhaar numbers carry a Verhoeff check digit. An arbitrary twelve-digit string passes it roughly one time in ten, so validating against it removes almost all false positives. If a tool masks your VID, it is not doing that.
For PDF output, the decisive test:
pdftotext masked.pdf - | grep -oE '[0-9]{4}[ -]?[0-9]{4}[ -]?[0-9]{4}'
If digits come back, the tool drew a rectangle over the number and left the text underneath. The file looks redacted in every viewer and gives the number up to anyone who selects the region, copies it, or deletes the shape. This has caused real breaches in published court filings and government releases.
There are only two honest answers: refuse the document, or return it unchanged with an explicit signal saying nothing was masked. A tool that silently returns the original with no signal is the dangerous one, because your pipeline files it as done.
This API returns the original with X-Masked-Count: 0, charges nothing for it,
and the documentation says to treat that as a failure. Whatever tool you choose, find out what
its version of that signal is — and if it does not have one, that is your answer.
Every tool works on a clean 300 dpi scan. The population that matters is the one you actually hold: old photocopies, phone photographs, faxes, 150 dpi scans from a branch machine in 2014. A sample drawn across the age range of your archive tells you the real detection rate. A sample of last month's uploads tells you nothing about the archive.
pdftotext recovers the number, the
tool does not redact, it decorates.Two versions of this come up, and they have different answers.
"The document must not leave our network." Often this is a policy written before anyone checked what the alternatives do. The browser tool already satisfies it: masking runs in JavaScript on the user's own machine and no document is uploaded, so nothing crosses your boundary. That is genuinely local processing, not a claim about a server's discretion.
"We need it inside our own infrastructure, in a pipeline." A real requirement for some regulated environments, and the browser tool does not meet it because it cannot be automated. That is an on-premise deployment conversation rather than a signup, and it is one we have. Tell us the constraint — whether it comes from a regulator, an internal policy, or a customer contract — and we will tell you honestly whether we are the right fit.
Worth separating the two, because the first is far more common than the second, and it is usually already solved.
Start with the free browser tool — it costs nothing and takes a minute, and it will tell you how the software handles your documents before any of the rest of this matters.
Try it on a document Talk about volumeIt depends on volume and on whether masking has to happen without a person triggering it. For personal use, a browser-based tool that processes the document on your own device is the best fit, because nothing is uploaded at all. For a team handling dozens of documents a week, a subscription browser tool is enough. Once documents arrive through a system — a KYC queue, a loan origination flow — a REST API is the only option that removes the manual step someone can forget.
It depends entirely on where the processing happens. A tool that runs in your browser and never uploads the document is safe by construction, because there is no server holding a copy. A free tool that uploads to a server deserves scrutiny: read the retention clause, and ask what happens to the document after processing. Free is not the risk; upload plus retention is.
Five tests, all runnable in an afternoon. Feed it a two-sided UIDAI printout where one card is rotated. Check whether it wrongly masks the sixteen-digit Virtual ID, which indicates no checksum validation. Run pdftotext over PDF output and search for digits, which reveals redaction that merely draws a rectangle over recoverable text. Ask what it does when it cannot read the number. And test on your oldest hundred documents rather than your cleanest ten.
No. UIDAI does not certify, approve or empanel masking tools, so a vendor claiming certification is either mistaken about their regulatory position or hoping you will not check. MaskAadhaar is an independent private service and is not affiliated with UIDAI, the Income Tax Department or any government body.
Usually not, and it is worth separating two different requirements. If the concern is that documents must not leave your network, a browser-based tool already satisfies it: the masking runs on the user's own machine and nothing is uploaded. If the requirement is automated masking inside your own infrastructure, that is a genuine on-premise deployment and a conversation rather than a signup.
The free browser tool covers two documents a day with no account. Pro is ₹399 a month for 150 documents, shared across the browser tools and the API. API access beyond that is priced by volume and provisioned per organisation, because a KYC pipeline processing tens of thousands of documents a month is a different proposition from an individual masking a rental agreement.