Aadhaar Secure QR

What is it?

The Aadhaar Secure QR API parses the UIDAI-issued QR code printed on every Aadhaar letter / e-Aadhaar PDF and returns the demographic fields (name, DOB, gender, address, masked mobile, masked email, photo) as structured JSON. The QR carries a UIDAI RSA-2048 digital signature — so we can also prove the data was actually issued by UIDAI and has not been tampered with.

No Aadhaar number is ever exposed — the QR only contains the last 4 digits.

What can I do with this product?

• Reception / help-desk demographic capture — staff scans the printed Aadhaar, the form auto-fills.
• Address auto-fill on signup / onboarding forms when the user voluntarily uploads their own Aadhaar.
• Tamper detection — verify a scanned or photographed Aadhaar wasn't edited (signature check).
• Bulk back-office workflows — re-process pre-uploaded Aadhaar copies offline, no consent UI needed.
• Offline / air-gapped verification — pure parsing, no network call to UIDAI at request time.

How is this different from OVSE and DigiLocker?

All three return demographics, but they solve different problems:

Use Secure QR when you need fast, low-friction extraction of demographics with tamper-detection — and you accept that the data is whatever was on the printed Aadhaar at issuance time.

Use OVSE or DigiLocker when you need to prove the holder is currently consenting and physically present — account opening, loan origination, anything regulated.

Request modes

You can submit the QR in either of two ways:

1. Image upload — Base64-encoded PNG/JPEG of the Aadhaar QR. We decode the QR for you.
2. Decimal payload — the raw decimal string that some QR scanners return directly. Skips image decode (faster).

Photo quality

The photo embedded in the QR is a heavily compressed JPEG2000 thumbnail (~700-1000 bytes of source data) decoded server-side to PNG. This is by UIDAI's design — the entire QR has to fit on a printed Aadhaar letter. The photo is suitable for visual help-desk identification, NOT face-recognition or biometric matching. For a high-resolution photo, use the Aadhaar OVSE or DigiLocker API.

Benefits

• Zero end-user friction — no app install, no OTP, no consent screen
• Works offline — no live UIDAI dependency at request time
• Tamper detection — optional RSA signature verification catches edited QRs
• No Aadhaar number exposed — only last 4 digits are recoverable
• Single API call — one POST, one JSON response with everything
• Drop-in for form auto-fill — perfect for reception desks, onboarding flows, and bulk back-office processing

Note on signature verification

When you pass verify_signature: true, we attempt to verify the UIDAI RSA-2048 signature using every UIDAI public certificate we have on file. UIDAI periodically rotates their signing certificate (2017 → 2020 → 2023 → …) and does not always publish the new public key at predictable URLs. If the QR was signed by a cert we don't yet have, verified returns false — not because the QR is forged, but because we cannot prove authenticity without UIDAI's current public key. Treat verified: true as a strong positive signal; treat verified: false as inconclusive (could be tampered, could just be a cert-rotation gap). The demographic fields and photo are still extracted in either case.