Aadhaar Secure QR Code Verifier
Scan an Aadhaar’s QR code: UIDAI’s signature checked, the signed photo and details shown.
The QR code on the Aadhaar
Hold the large QR code flat and close, so it fills most of the frame, in good light and without glare. The camera picture stays on this device.
Result
Signature check
—
What UIDAI signed
Compare with the card
Type what the card or letter says: each line is compared with the details in the QR code as you type. A genuine QR code stuck onto a card with someone else’s details shows up here.
Check a mobile number or e-mail
The code holds the registered mobile number and e-mail only as fingerprints (SHA-256 hashes). Type one to see whether it is the one registered with UIDAI when the code was made.
What the old QR code says (not signed)
The copied result has the verdict, the name and the last four digits only: no photo, address or date of birth. A valid signature proves that UIDAI issued these details; it does not prove that the person in front of you is that person (compare the photo), and it cannot show whether the Aadhaar was deactivated later. UIDAI’s Check Aadhaar Status service checks the number for that.
The UIDAI keys this checker uses 7 public keys
UIDAI signs each Secure QR code with a 2048-bit RSA key (SHA-256) and publishes the public keys that check those signatures. The checker tries each of them, so a code made years ago still checks against the key that signed it.
| Certificate | SHA-256 fingerprint (start) |
|---|---|
| UIDAI offline verification key (DS Unique Identification Authority of India 06) | E030 4B9E 61EE 3640 |
| UIDAI offline verification key (DS Unique Identification Authority of India 05) | 0057 3C69 2CF0 4FBE |
| UIDAI offline verification key (DS UNIQUE IDENTIFICATION AUTHORITY OF INDIA 05) | E0F0 F869 D32E FC7E |
| UIDAI offline verification key (DS UNIQUE IDENTIFICATION AUTHORITY OF INDIA 04) | E0F5 596D 2C48 E19F |
| UIDAI offline verification key (DS UNIQUE IDENTIFICATION AUTHORITY OF INDIA 03) | 3557 5C63 C721 06E8 |
| UIDAI Secure QR key (DS UNIQUE IDENTIFICATION AUTHORITY OF INDIA 7) | 49E2 9853 2243 CE28 |
| UIDAI Secure QR key (DS UNIQUE IDENTIFICATION AUTHORITY OF INDIA 4) | FCF3 1A3F 8921 1615 |
The certificates are on UIDAI’s Data and Downloads page.
For general information only, not legal advice. Templates are generic starting points — have a qualified lawyer review anything you rely on.
About the Aadhaar Secure QR Code Verifier
This Aadhaar QR code verifier reads the Secure QR code printed on Aadhaar letters, the e-Aadhaar PDF and the PVC card, and checks UIDAI’s digital signature on it with the public keys UIDAI publishes. When the signature matches, the name, date of birth, gender, address and photo it shows are exactly what UIDAI issued — so a card whose printed details or photo were edited, or a QR code someone made up, stands out at once.
Choose a photo or screenshot of the QR code or the e-Aadhaar PDF, scan it with the camera, or paste the number a QR scanner app shows. Everything happens on your device: the picture, PDF and number never leave the browser, and nothing is stored. The checker follows UIDAI’s published Secure QR specification; UIDAI’s own readers are the Aadhaar app, the Aadhaar QR Scanner app and its Windows QR code reader.
How to use it
- Tick the consent box: check an Aadhaar only if it is your own or its holder has agreed (for a child, a parent or guardian).
- Choose a sharp photo or screenshot of the large QR code, or the e-Aadhaar PDF (its password is the first four letters of the name in capitals and the year of birth), use the camera, or paste the number a QR scanner app shows.
- Read the verdict: Signed by UIDAI, Not signed by UIDAI, or Old QR code without a signature.
- Compare the signed photo and details with the card and the person, type the card’s name, date of birth and last four digits to compare them line by line, and check a mobile number or e-mail against the code.
- Press Copy the result for a short record (the verdict, the name and the last four digits only), or Check another.
Examples
The e-Aadhaar PDF, opened with its password
Signed by UIDAI: the name, date of birth, gender, address and photo as UIDAI issued them, the last four digits of the Aadhaar number and when the QR code was made.
A photo of a card whose printed name was changed, with the original QR code
Signed by UIDAI, but typing the printed name shows “Different: the code says …” — the card was altered.
A QR code that holds a made-up name and photo
Not signed by UIDAI: the signature matches none of UIDAI’s keys, so the details are only what the code claims.
Common uses
- Landlords and housing societies checking a tenant’s Aadhaar.
- Employers and households checking the Aadhaar of new staff.
- Shops, hotels and offices checking an Aadhaar shown as proof of identity.
- Checking that your own e-Aadhaar or PVC card prints a QR code that reads.
What the Secure QR code holds
UIDAI’s Secure QR code holds the last four digits of the Aadhaar number with the date and time the code was made (the reference ID), the name, date of birth, gender, care-of name and address, a small photo, and the registered mobile number and e-mail — older codes as fingerprints (SHA-256 hashes), newer versioned codes as the last four digits of the mobile number. It never holds the full Aadhaar number, fingerprints or iris data. Everything in it is signed by UIDAI with a 2048-bit RSA key.
The older QR code of Aadhaar letters printed before the Secure QR code held the details as plain text, with the full Aadhaar number, and no signature: anyone can make one, so it proves nothing. The checker shows its contents with the number masked and says so.
How the check works
The QR code holds one long number. The checker turns it back into bytes, decompresses them, reads the fields in the order of UIDAI’s specification, and checks the 256-byte signature at the end against each of UIDAI’s published public keys (SHA-256 with RSA). One changed letter, digit or pixel anywhere in the code breaks the signature. To check a mobile number or e-mail, it hashes what you type the way the specification describes — SHA-256, repeated as many times as the last digit of the Aadhaar number (once for 0 or 1) — and compares it with the fingerprint in the code.
What a valid signature does not prove
- That the person in front of you is the holder. Compare the signed photo with their face.
- That the printed card matches. A genuine QR code can be copied onto a card with someone else’s name, number or photo; compare the printed details with the signed ones.
- That the Aadhaar is still active. UIDAI’s Check Aadhaar Status service on myAadhaar checks the Aadhaar number for that.
- That the details are current. They are the ones registered when the QR code was made; the holder may have updated the address since. The time the code was made is shown with the details.
Consent and the law
Section 8A of the Aadhaar Act, 2016 governs offline verification. Anyone who verifies a person’s Aadhaar offline must first obtain their consent (a parent’s or guardian’s for a child), tell them what information is shared, what it will be used for and the alternatives to giving it, and use the details only for that verification. They must not collect, use or store the Aadhaar number or biometric information. Using the information against section 8A(2) is punishable under section 40 with imprisonment of up to three years, or a fine of up to ₹10,000 (up to ₹1 lakh for a company), or both.
The e-Aadhaar PDF password
UIDAI protects the e-Aadhaar PDF with a password: the first four letters of the name in capital letters and the year of birth. SURESH KUMAR born in 1990 opens it with SURE1990, SAI KUMAR with SAIK1990, and RIA (a name of three letters) with RIA1990. The PDF is opened on your device; the password is not stored.
Limitations
- Not legal advice and not a UIDAI service: it follows UIDAI’s published Secure QR specification and public keys. UIDAI’s own readers are the Aadhaar app, the Aadhaar QR Scanner app and its Windows QR code reader.
- It reads the Secure QR code (and the old unsigned code of Aadhaar letters); not the Paperless Offline e-KYC file or other codes of the Aadhaar app.
- It cannot tell whether the Aadhaar was deactivated later, or whether the person is its holder: compare the photo, and use UIDAI’s Check Aadhaar Status service.
- A blurred, folded or very small QR code may not read: try the e-Aadhaar PDF or a sharper, closer photo.
- If UIDAI starts signing with a new key, codes signed with it read as not signed until the checker has that key.
Privacy
The photo, PDF, camera picture and number are read in your browser and never uploaded; nothing is stored, and the photo in the code cannot be downloaded. The copied result holds only the verdict, the name and the last four digits.
Frequently asked questions
How do I check if an Aadhaar card is real or fake?
Scan its Secure QR code here (or with UIDAI’s Aadhaar QR Scanner app). If UIDAI’s signature matches, compare the signed photo, name, date of birth and last four digits with the card and the person: a mismatch means the card was altered. If the signature does not match, the QR code was edited or made up.
What is the password of the e-Aadhaar PDF?
The first four letters of the name in capital letters followed by the year of birth: SURESH KUMAR born in 1990 → SURE1990; SAI KUMAR → SAIK1990; RIA → RIA1990.
Can I check someone’s Aadhaar without their consent?
No. Section 8A of the Aadhaar Act requires anyone verifying an Aadhaar offline to obtain the holder’s consent first (a parent’s or guardian’s for a child), to use the details only for that verification, and not to collect or store the Aadhaar number.
What does “Not signed by UIDAI” mean?
The QR code reads like a Secure QR code, but its signature matches none of UIDAI’s public keys: its details were changed after UIDAI signed them, or it was made by someone other than UIDAI. Do not rely on it. A damaged code usually fails to read at all.
Is the full Aadhaar number in the QR code?
Not in the Secure QR code: it holds only the last four digits, with the date and time the code was made. The older, unsigned QR code of early Aadhaar letters held the full number; this checker masks it.