Mask Your Aadhaar and PAN Before You Send Them

A landlord asks for your Aadhaar. A recruiter wants a PAN copy. A broker needs "just a photo of the card". You open WhatsApp, attach the scan, and press send — and a complete, unredacted government identity document is now sitting on someone else's phone, backed up to someone else's cloud, forwarded onward without your knowledge.

Most of the time nothing happens. The problem is that you cannot tell in advance which time is the exception, and you cannot take it back.

Masking is the normal, permitted answer

You are generally not required to hand over a full Aadhaar number for routine verification. UIDAI itself publishes a masked Aadhaar format in which the first eight digits are hidden and only the last four remain visible, alongside your name and photograph — enough for an ordinary party to confirm the document is yours, without giving away the number itself.

That is the shape to aim for whenever the request is casual: a rental agreement, a gym membership, a courier KYC, an HR file.

Where masking is acceptable is a judgement call and the rules differ by purpose. Banking and formal KYC processes have their own statutory requirements and will often need the full document through an official channel. Mask for the informal requests — not for a regulator.

Aadhaar/PAN Masking Tool does exactly this: it finds the number on the card image and covers the digits that should not travel.

The mistake that makes redaction fake

Here is the part almost nobody knows, and it matters more than everything else in this article.

Drawing a black rectangle over text in a PDF does not delete the text.

A PDF is not a picture. It is a set of drawing instructions, and a black box is simply one more instruction layered on top. The characters underneath remain in the file exactly as they were. Anyone can select the region and copy the text out, or run a one-line script to extract it. The rectangle is a curtain, not an eraser — and people have leaked entire documents this way, including organisations that should have known better.

The same is true of highlight tools, and of "hiding" content by drawing white over it.

Genuine redaction has to destroy the underlying content, not cover it. The reliable way is to flatten the page to an image and then draw over that, so there is no text left to recover. PDF Redact works this way, rasterising the page so the covered content is genuinely gone from the output.

For an image — a photo or scan of a card — a drawn box is destructive, because you are painting over pixels and there is no separate text layer underneath. Blur Part of Image and Privacy Blur for Screenshots are safe for that reason.

One caveat on blurring: a light blur or a mild pixelation can sometimes be reversed or guessed, particularly on a short string of digits where the possibilities are limited. For an identity number, use a solid block, not a gentle blur.

The metadata you forget

You have masked the number. The file may still carry more than you intended.

A photo taken on a phone can embed GPS coordinates, the device model, and the exact timestamp. If you photographed your Aadhaar at home — and you did — those coordinates are your home address, attached to a document you just sent to a stranger.

Check what a file is actually carrying with Image Metadata Viewer, and strip it before sharing. Scanned PDFs have an equivalent problem: author names, the software that produced them, and document identifiers that link every version of a file together.

Before you send anything, a short checklist

1. Do they actually need the document? The most private file is the one you never send.
2. Can it be masked? For informal requests, almost always. Aadhaar/PAN Masking Tool.
3. Is the covering destructive? Solid block on an image, or rasterised for a PDF — never a rectangle drawn over live PDF text.
4. Strip the metadata. Location especially.
5. Consider a watermark. Marking a copy "For rental verification only — 12 Sept 2026" with Image Watermark makes a forwarded copy far less useful to anyone else, and is standard practice for a reason.
6. Send it over something sane. Not a public group. Not an unlocked shared device.

Why the tool you use matters as much as the technique

There is an obvious problem with uploading your Aadhaar to a free website in order to hide your Aadhaar.

Every tool in this article runs entirely in your browser. The card image is opened, masked and saved on your own device; there is no upload endpoint anywhere in the path, because the site is a static one with no server to receive files. You can verify that yourself in about five seconds — open your browser's developer tools, switch to the Network tab, mask a card, and watch that nothing is transmitted.

That check is the point. A privacy promise you can test in your own browser is worth more than one written in a policy page.

Frequently Asked Questions

Is masked Aadhaar legally valid?

UIDAI provides masked Aadhaar as an official download format, and it is widely accepted for ordinary verification. Whether a specific institution will accept it depends on that institution and on what the verification is for — a bank performing statutory KYC has different obligations from a landlord. Ask before you assume, and never mask a document a regulator has asked for in full.

Can a blurred number be recovered?

Sometimes. Light blurs and coarse pixelation over a known-format string of digits have been reversed by researchers. A solid opaque block cannot be reversed, because the information is simply not there any more. Use a block.

My Aadhaar PDF is password protected. How do I mask it?

Open it first — Aadhaar PDF Unlocker removes the password locally once you supply it — then treat it like any other PDF and redact destructively.

Does covering the number in a PDF viewer's comment tool work?

No. Comment and highlight annotations sit above the page content and can be deleted, revealing what is underneath. That is the fake-redaction trap in a different costume.

What about a scanned document that has lots of personal detail, not just a number?

PII Detector & Redactor scans text for identity numbers, emails, phone numbers and similar patterns and redacts what it finds, which is more reliable than reading a long document yourself at midnight.

Mask first, destroy rather than cover, strip the metadata, then send. Start with Aadhaar/PAN Masking Tool, or see everything in Security & Privacy.