Your files never leave your device. All processing happens locally in your browser.
How do I mask my Aadhaar or PAN before sharing it?
Use the Aadhaar / PAN Masking Tool two ways, entirely in your browser. IMAGE mode: drop or paste a photo/scan of the card, then drag a rectangle (or paint with a brush) over the sensitive parts — the first 8 digits of the Aadhaar number, the QR code, DOB, address and signature — and a solid BLACK BOX (or heavy pixelate) is baked destructively into the pixels; download or copy the masked PNG. TEXT mode: paste a number and get the correctly masked form — an Aadhaar becomes “XXXX XXXX 9012” (first 8 hidden, last 4 kept, the UIDAI rule) and a PAN has its middle hidden — with a validity check (Aadhaar Verhoeff checksum, PAN AAAAA9999A format). Nothing is uploaded; your ID never leaves the page. The tool masks only the regions you pick, so verify the export before sharing.
Image mode: black-box or pixelate the regions you select, baked into the pixels
Text mode: Aadhaar → XXXX XXXX 9012 (UIDAI rule), PAN middle masked
Validity check: Aadhaar Verhoeff check digit, PAN AAAAA9999A + holder-type letter
100% client-side — your card image and number never leave your browser
What is
Masked Aadhaar / PAN
A masked Aadhaar is a privacy-preserving form of the 12-digit UIDAI number in which the first eight digits are replaced with X and only the last four remain visible (for example XXXX XXXX 9012); UIDAI recommends sharing it with any private party that only needs to confirm identity. Masking a PAN — the 10-character Income-Tax ID in the shape AAAAA9999A — has no single official standard, so a common approach hides the middle and keeps a couple of characters. On a card image, masking means covering the sensitive regions with an irreversible black box baked into the pixels. This tool does both locally: it validates the Aadhaar with the Verhoeff check digit and the PAN by format, produces the masked text, and lets you redact a card photo on a canvas — but it does not auto-detect the regions, so you select them.
No. The card image and the number you type are processed entirely in your browser and are never uploaded, logged or stored on a server.
The tool is 100% client-side. In image mode your card is drawn to a local canvas, every black-box or pixelate edit rewrites the pixels in memory, and the masked PNG is built and downloaded or copied in-browser. In text mode the number is validated and masked with pure in-browser math — the UIDAI Verhoeff scheme for Aadhaar and the AAAAA9999A pattern for PAN. There is no upload, no server, no CDN and no telemetry; nothing is persisted, so closing the tab erases it. Because your ID never leaves your machine, it is safe in a way an online masking service — which would receive your document — can never be. The only optional network use anywhere on the site is consent-gated ads, which never see your ID.
Hide the first 8 digits and keep only the last 4 — XXXX XXXX 9012 — which is exactly what UIDAI’s official masked Aadhaar does.
UIDAI’s masked Aadhaar replaces the first eight digits with X and shows only the last four, so you can prove identity without exposing the full number. This tool’s text mode produces that form automatically after checking the number is 12 digits, starts with 2–9 (UIDAI never issues an Aadhaar starting with 0 or 1) and passes the Verhoeff check digit. On a card image, cover those first eight digits — and the QR code, which encodes your details — with a solid black box. Note that masked Aadhaar is not accepted everywhere: banks, Aadhaar–PAN linking, DBT/EPF and some KYC still require the full number by law.
Yes. A solid black box overwrites the pixels and cannot be reversed; blur and light pixelation are averaging transforms that can be partially recovered.
For a card image, always prefer the black box for the number itself. Security researchers have de-pixelated short text and passwords (Depix, Unredacter) and machine-learning models have recovered blurred faces and plates, so a light blur or a few large mosaic blocks over an Aadhaar / PAN number is not safe. A black box replaces the region with one opaque colour, leaving nothing to reverse, and this tool bakes it destructively into the pixels so the exported PNG holds only the redacted data. Whatever you use, zoom in and verify the exported PNG before sharing, and remember the reverse side of the card, reflections and glare.
No. It does not OCR or auto-detect anything — you draw the rectangles or paint the areas yourself, so you must check nothing sensitive is left visible.
This is an honest, manual redaction editor, not an AI detector. It trusts your aim: it will not warn you if part of the number peeks out, and it does not scan the image for secrets. So before you export, check for anything left visible — the QR code, a reflection or glare, faint text under a semi-transparent box, and especially the reverse side of the card, which many people forget. The text-mode validity check confirms format and checksum only (a number can pass and still not belong to a real person). Treat the tool as a privacy aid that keeps everything on your device, not a guarantee; you remain responsible for what you share.
Detailed Explanation
📖How It Works
What the Aadhaar / PAN Masking Tool Does
This tool masks India’s two most-shared IDs — Aadhaar and PAN — entirely in your browser, two ways. In IMAGE mode you drop, choose or paste a photo/scan of the card; it is drawn to a <canvas> at true resolution and you drag a rectangle or paint with a brush over the sensitive regions (the Aadhaar number’s first eight digits, the QR code, date of birth, address, signature, optionally the photo). A pure engine bakes a solid BLACK BOX — or a heavy pixelate — DESTRUCTIVELY into the pixels, then you download or copy the masked PNG. Guidance chips remind you what to cover, and undo/redo, revert and zoom keep it precise. In TEXT mode you paste a number and get the correctly masked form: an Aadhaar becomes “XXXX XXXX 9012” (first eight digits hidden, last four kept — the UIDAI rule) and a PAN has its middle hidden, each with a validity read-out. It is a manual redaction aid, not an auto-detector.
Image mode: black-box or pixelate the regions you select, baked into the pixels
Text mode: Aadhaar → XXXX XXXX 9012 (UIDAI rule); PAN middle masked
Guidance chips for what to cover; rectangle + brush, undo/redo/revert, zoom
Export masked PNG (download + copy) or copy the masked number
100% client-side — the card image and number never leave the browser
⚙️Methodology
How Validation Works (Verhoeff + PAN Format)
Text mode validates before it masks, using a pure engine (aadhaarMaskEngine.ts). An Aadhaar must be exactly 12 digits, must start with 2–9 (UIDAI never issues an Aadhaar beginning with 0 or 1), and must pass the UIDAI Verhoeff check digit — a dihedral-group (D5) checksum computed right-to-left over the multiplication and permutation tables, which catches every single-digit error and most adjacent transpositions. When all three hold, the masked form hides the first eight digits and shows the last four (XXXX XXXX 9012). A PAN must match AAAAA9999A (five letters, four digits, one letter); the 4th character is decoded as the holder/entity type (P = Individual, C = Company, H = HUF, F = Firm/LLP, A = AOP, T = Trust, B = BOI, L = Local Authority, J = Artificial Juridical Person, G = Government), and the mask keeps only the first two and last two characters, hiding the unique four-digit serial. The check confirms structure and checksum only — not that a number is issued to a real person.
Aadhaar: 12 digits, first digit 2–9, Verhoeff dihedral-group check digit
Verhoeff catches all single-digit errors and most transpositions
PAN: AAAAA9999A with a valid holder-type letter as the 4th character
Masked Aadhaar keeps the last 4; masked PAN keeps first 2 + last 2
Validation proves format/checksum, not real-world issuance
🔧Technical Details
Destructive Canvas Redaction
Image redaction reuses the same audited engine as the Privacy Blur tool (blurEngine.ts): every operation rewrites the underlying ImageData in place, so the hidden information is genuinely gone from the buffer that gets exported rather than merely painted on top. A black box fills the selected rectangle or brush disc with one opaque colour; pixelate averages each origin-aligned mosaic block to a single colour; both are irreversible for the black box and strong for a heavy mosaic. The card is loaded via an offscreen canvas and getImageData, edits are applied to a base ImageData with a bounded undo/redo history (deep copies, 24 steps), and only the dirty rectangle is repainted for speed. Export calls canvas.toBlob(’image/png’) and downloads it or writes it to the clipboard as a ClipboardItem — and because the pixels are re-encoded through the canvas, the original file’s EXIF metadata (camera, GPS, timestamps) is dropped. Text masking is pure string math with no canvas needed.
blurEngine.ts rewrites ImageData in place — the data underneath is overwritten
Black box = one opaque colour (irreversible); pixelate = block averaging
Bounded undo/redo (deep copies, 24 steps); only the dirty rect repaints
Export via canvas.toBlob PNG; re-encoding drops original EXIF metadata
Copy writes a ClipboardItem; text masking needs no canvas
⚠️Limitations
Honest Limitations
The tool masks only the regions YOU select — it does not OCR or auto-detect the number, so it will not warn you if something sensitive is left visible. Before you export, check the QR code (it encodes your details), reflections and glare, faint text under a semi-transparent box, and especially the REVERSE side of the card, which is easy to forget. Prefer the solid black box over blur or light pixelation: averaging transforms can be partially REVERSED (Depix, Unredacter for short text; ML de-blurring for faces and plates), so a weak effect over a number is not safe — and always zoom in and verify the exported PNG at full resolution. The masked forms are not accepted everywhere: banks, Aadhaar–PAN linking, DBT/EPF claims and some KYC still legally require the full number. Finally, the validity check confirms format and the Verhoeff/PAN structure only; a number can pass and still not belong to a real person, and this tool cannot and does not verify identity with UIDAI or the Income-Tax department. It is a privacy aid, not a guarantee — you remain responsible for what you share.
No auto-detection — you select the regions; nothing is scanned for you
Check the QR code, reflections, and the reverse side before sharing
Blur/light pixelation can be reversed — prefer the black box; verify the PNG
Masked Aadhaar is not accepted for bank/PAN-link/DBT/EPF and some KYC
Validity = format/checksum only, not proof of real issuance
🔒Privacy & Security
Private by Design
Everything happens on your device. In image mode the card is drawn to a local canvas, each black-box or pixelate edit rewrites the pixels in memory, and the masked PNG is built and downloaded or copied in-browser; in text mode the number you type is validated and masked with pure in-browser math (the UIDAI Verhoeff scheme for Aadhaar, the AAAAA9999A pattern for PAN). There is no upload, no server, no CDN and no telemetry anywhere in the path, and nothing is persisted — closing the tab erases it, and the tool works offline once cached. Because your Aadhaar or PAN never leaves your machine, this is safe in a way an online masking service — which would receive your document — can never be: a leaked ID photocopy has been misused for fraudulent SIMs and unauthorised access, which is exactly why UIDAI recommends sharing a masked Aadhaar. The only optional network use anywhere on the site is consent-gated ads, which never see your ID.
Image and text masking run locally; no upload, server, CDN or telemetry
Nothing persisted — closing the tab erases it; works offline once cached
Safe for a real ID, unlike an online masking service that receives your file
Verhoeff/PAN checks and PNG export are all in-browser
Only optional network use is consent-gated ads that never see your ID
Ways to share an Aadhaar / PAN more safely
Approach
What it does
Trade-off
This tool
Mask it (this tool)
Black-box the card image or mask the number locally
You select the regions; not accepted everywhere
Yes
UIDAI masked e-Aadhaar
Official PDF with the first 8 digits hidden
Only Aadhaar; needs a UIDAI download + OTP
Complements it
Blur / light pixelate
Softens the number instead of covering it
Can be partially reversed — unsafe for the number
Black box preferred
Online masking service
Masks on a server
Uploads your raw ID to a third party
No — never uploaded
A black box baked into the pixels is irreversible; blur is not. Masked Aadhaar is not accepted where the full number is legally required. Everything here runs locally in the browser. As of July 2026.
