Authentication

For an Aadhaar number holder, security and privacy of personal data is always a primary concern. To strengthen the security of his/her Aadhaar number and to provide control to the Aadhaar number holder, UIDAI provide a mechanism of locking and unlocking Aadhaar number (UID).

Aadhaar number holder can lock his or her Aadhaar (UID) via UIDAI website (www.myaadhaar.uidai.gov.in).

By doing this Aadhaar number holder cannot perform any sort of Authentication using UID, UID Token & VID for Biometrics, Demographic & OTP modality

If Aadhaar number holder wants to unlock UID he/she can do so by using latest VID, through UIDAI website.
After unlocking Aadhaar (UID), Aadhaar number holder can perform authentication using UID, UID Token & VID.

For Locking UID, Aadhaar number holder should have 16 digit VID number and it's a pre-requisite for locking. If Aadhaar number holder don't have VID can generate via SMS Service or UIDAI website ( www.myaadhaar.uidai.gov.in ). SMS Service. GVID space last 4 or 8 digit of UID. SMS to 1947. Ex- GVID 1234. Aadhaar number holder may visit UIDAI website ( https://resident.uidai.gov.in/aadhaar-lockunlock ), Under My Aadhaar tab, Click on Aadhaar Lock & Unlock services. Select UID Lock Radio Button and enter UID Number, Full Name, and Pin Code as in latest details and enter Security code. Click on Send OTP or select TOTP and click on submit. Your UID will be locked successfully.

For Unlocking UID Aadhaar number holder should have latest 16 digit VID and if Aadhaar number holder forgot 16-digit VID, he can retrieve latest VID through SMS services

RVID Space last 4 or 8 digit of UID. SMS to 1947. Ex- RVID 1234

To unlock UID, Aadhaar number holder may visit https://myaadhaar.uidai.gov.in/, select Unlock radio button, Enter Latest VID and security Code and click on send OTP and click on Submit. Your UID will be unlocked successfully.

Aadhaar number holder may also use Aadhaar lock or unlock service through Aadhaar app.

Locking Aadhaar adds an extra layer of security. Once locked, Aadhaar-based authentication using UID, VID or UID Token cannot be performed until it is unlocked by the Aadhaar number holder.

Aadhaar number holders who do not frequently use Aadhaar-based authentication or who wish to enhance the security of their Aadhaar may choose to lock their Aadhaar.

Aadhaar remains locked until the Aadhaar Holder chooses to unlock it using the latest VID. There is no automatic expiry of the lock.

No. Locking Aadhaar does not affect the Aadhaar number or any demographic information such as name, address, date of birth, or mobile number.

Yes. If the Aadhaar number holder had already logged into the Aadhaar App prior to locking Aadhaar, he/she can still download e-Aadhaar through the app. Locking Aadhaar only restricts Aadhaar-based authentication. Aadhaar number holders can continue to access Aadhaar services that do not require Aadhaar authentication.

No, if Aadhaar is locked, Aadhaar service cannot be accessed as Aadhaar app can be logged-in through Aadhaar Authentication.

Authentication requests using the locked Aadhaar (UID), UID Token, or VID will not be successful until the Aadhaar is unlocked.

Yes. A mobile number registered with Aadhaar is required to receive OTPs and access the Aadhaar Lock/Unlock service.

You can retrieve the latest VID using UIDAI's online services, Aadhaar application, or SMS service from your registered mobile number.

No. The Aadhaar Lock/Unlock service is provided free of cost by UIDAI.

Yes. Aadhaar number holders can lock and unlock their Aadhaar as many times as required.

Aadhaar lock only restricts Aadhaar authentication. If Aadhaar authentication is required for availing a service, the Aadhaar number holder may need to unlock Aadhaar before proceeding

Aadhaar remains unlocked until the Aadhaar Holder chooses to lock it again. Aadhaar Holder may again lock his/her Aadhaar after completing the required authentication.

Aadhaar number holders can check the status of their Aadhaar through the Aadhaar Lock/Unlock service available on the myAadhaar portal or Aadhaar app.

No. A valid 16-digit VID is required before Aadhaar can be locked.

Yes. Aadhaar Lock restricts all Aadhaar-based authentication using UID, UID Token, and VID. Biometric Lock specifically blocks the use of biometric authentication (fingerprint iris and face authentication) while allowing other authentication modes as applicable.

Once Aadhaar number holder enables Biometric Locking system their biometric remains locked till the Aadhaar Holder chose any below mentioned option: Unlock it (which is temporary )or Disable the Locking system The biometric unlock can be done by Aadhaar number holder either by visiting UIDAI website, enrolment centre, Aadhaar Seva Kendra(ASK), through Aadhaar app. Note: Registered Mobile Number is essential to avail this service. In case your mobile number is not registered with Aadhaar visit the nearest Enrolment Centre/Mobile Update End Point.

Aadhaar number holders who have registered mobile number may lock their biometrics.

1. When you suspect misuse or see suspicious Aadhaar authentication attempts.
2. When you do not currently need biometric authentication (for example, not using AePS, bank fingerprint, or other biometric‑based services).
3. As a preventive safety measure to minimise the risk of biometric‑based fraud while you continue using OTP or demographic authentication.

When biometrics are locked during Aadhaar authentication, the system typically shows an Authentication failed message with Error Code 330, which means Biometrics locked by Aadhaar holder.

No, a registered mobile number is mandatory to avail the Biometric Locking/Unlocking service. OTP-based authentication is required to enable or disable this feature. Aadhaar holders without a registered mobile number must first update it through an Aadhaar Enrolment/Update Centre or Aadhaar Seva Kendra.

The temporary unlock of biometrics is valid for a limited duration (generally 15 minutes) or for a single authentication transaction, after which the biometrics are automatically locked again. This ensures continued security of biometric data.

In case of suspected misuse of biometric data, the Aadhaar holder should immediately lock their biometrics using available channels such as the UIDAI website or Aadhaar application. Additionally, they may review authentication history and report the concern to the Unique Identification Authority of India for further assistance.

Yes, biometric locking will impact services that rely on biometric authentication such as biometric-based eKYC. However, Aadhaar holders can still use OTP-based eKYC or temporarily unlock their biometrics to complete such services.

Yes, Aadhaar holders can enable or disable the biometric locking facility multiple times as per their requirement. This flexibility allows users to manage their biometric security conveniently through services provided by the Unique Identification Authority of India.

No, biometric locking does not impact OTP-based authentication. Aadhaar holders can continue to use OTP authentication services even when their biometrics (fingerprint/iris/face) are locked.

VID can be generated only by the Aadhaar number holder. They can also replace (generate a new VID) their VID from time to time. At any given time only one VID will be valid for an Aadhaar number. UIDAI provide various options to Aadhaar number holders to generate their VID, retrieve their VID in case they forget, and replace their VID with a new number. These options will be made available via UIDAI’s website ( www.myaadhaar.uidai.gov.in ), eAadhaar download, Aadhaar mobile application, etc.

VID can also be generated by sending an SMS to the Aadhaar helpline number 1947. Aadhaar number holder will have to type “GVIDLast 4 digits of Aadhaar Number” and send it to 1947 through the registered Mobile Number.

Yes, UIDAI provide multiple ways to generate new and/or retrieve current VID. These options are made available via UIDAI’s website ( www.myaadhaar.uidai.gov.in ), eAadhaar, Aadhaar mobile application, SMS, etc.

For retrieval of VID, Aadhaar number holder may send SMS to the Aadhaar helpline number 1947. Aadhaar number holder will have to type “RVID Last 4 digits of Aadhaar Number” and send it to 1947 through the registered Mobile Number.

After the minimum validity period (currently set as 1 calender day or after midnight 12), Aadhaar number holder may requests regeneration of a new VID. In this way, new VID will be generated and the previous VID will be deactivated.

In case, if Aadhaar number holder opts for retrieval of VID, the last active VID will be sent to the Aadhaar number holder through SMS. Aadhaar number holder will have to type “RVIDLast 4 digits of Aadhaar Number” and send it to 1947 through the registered Mobile Number.

Aadhaar Authentication History is the record of your Aadhaar number used for authentication, such as biometric, OTP, or demographic verification.

An Aadhaar number holder can check Aadhaar Authentication History at:

1. UIDAI website: https://myaadhaar.uidai.gov.in/

2. Aadhaar mobile app

An Aadhaar number holder can check his/her Aadhaar Authentication history on the UIDAI website at https://myaadhaar.uidai.gov.in/ or through the Aadhaar app by entering his/her Aadhaar number/VID, providing the security code, and following the instructions given on the portal.

Note: Registered mobile number is mandatory to use this service.

Aadhaar number holder can get the following information in Aadhaar Authentication history against every Authentication done by Aadhaar number holder.

1. Auth Modality.

2. Date & Time of Authentication.

3. UIDAI Response code.

4. AUA Name

5. AUA Transaction ID (With Code)

6. Authentication Response (Success/Failure)

7. UIDAI Error code"

Aadhaar number holder can view details of all authentication records performed by any Authentication User Agency (AUA) or by the holder themselves within the last 6 months. However, a maximum of 50 records can be viewed at a time. To check additional records, the Aadhaar number holder may select a narrower date range in the calendar, and the corresponding authentication records will then be displayed.

For every failed authentication transaction record, specific error code is assigned. Please check the details of error code number against that failed authentication transaction to know the reason of failure.

If the listed authentication transaction is not performed by the Aadhaar number holder, Aadhaar number holder may contact the respective Authentication User Agency (AUA) for further details.

UIDAI Response Code is a unique code that UIDAI generates for every Aadhaar authentication transaction. It helps the service provider (AUA) and UIDAI to identify that specific transaction and can be used for any follow‑up enquiry by the Aadhaar number holder.

For every authentication transaction performed by an Aadhaar number holder, AUA generates a unique Transaction ID to identify the transaction and sends the same to UIDAI as part of the authentication request. This Transaction ID along with Response Code can be used for any further enquiry from AUA by the Aadhaar number holder.

UIDAI provides authentication facility with different modes such as demographic, biometric (fingerprint, Iris or face) or One Time Password (OTP). Auth Modality shows the mode of authentication used to perform that specific authentication transaction.

An Error Code provide the details/reason for the failure of authentication transaction. For Error Codes details, Aadhaar number holder may refer to Aadhaar Authentication API document published on UIDAI website.

Below are Error Code List -

“100” – Personal information demographic data did not match.

“200” – Personal address demographic data did not match.

“300” – Biometric data did not match.

“310” – Duplicate fingers used.

“311” – Duplicate Irises used.

“312” – FMR and FIR cannot be used in same transaction.

“313” – Single FIR record contains more than one finger.

“314” – Number of FMR/FIR should not exceed 10.

“315” – Number of IIR should not exceed 2.

“316” – Number of FID should not exceed 1.

“330” – Biometrics locked by Aadhaar holder.

“400” – Invalid OTP value.

“402” – “txn” value did not match with “txn” value used in Request OTP API.

“500” – Invalid encryption of session key.

“501” – Invalid certificate identifier in “ci” attribute of “Skey”.

“502” – Invalid encryption of PID.

“503” – Invalid encryption of Hmac.

“504” – Session key re-initiation required due to expiry or key out of sync.

“505” – Synchronized Key usage not allowed for the AUA.

“510” – Invalid Auth XML format.

“511” – Invalid PID XML format.

“512” – Invalid Aadhaar holder consent in “rc” attribute of “Auth”.

“520” – Invalid “tid” value.

“521” – Invalid “dc” code under Meta tag.

“524” – Invalid “mi” code under Meta tag.

“527” – Invalid “mc” code under Meta tag.

“530” – Invalid authenticator code.

“540” – Invalid Auth XML version.

“541” – Invalid PID XML version.

“542” – AUA not authorized for ASA. This error will be returned if AUA and ASA do not have linking in the portal.

“543” – Sub-AUA not associated with “AUA”. This error will be returned if Sub-AUA specified in “sa” attribute is not added as “Sub-AUA” in portal.

“550” – Invalid “Uses” element attributes.

“551” – Invalid “tid” value.

“553” – Registered devices currently not supported. This feature is being implemented in a phased manner.

“554” – Public devices are not allowed to be used.

“555” – rdsId is invalid and not part of certification registry.

“556” – rdsVer is invalid and not part of certification registry.

“557” – dpId is invalid and not part of certification registry.

“558” – Invalid dih. “559” – Device Certificate has expired.

“560” – DP Master Certificate has expired.

“561” – Request expired (“Pid->ts” value is older than N hours where N is a configured threshold in authentication server).

“562” – Timestamp value is future time (value specified “Pid->ts” is ahead of authentication server time beyond acceptable threshold).

“563” – Duplicate request (this error occurs when exactly same authentication request was re-sent by AUA).

“564” – HMAC Validation failed.

“565” – AUA license has expired.

“566” – Invalid non-decryptable license key.

“567” – Invalid input (this error occurs when unsupported characters were found in Indian language values, “lname” or “lav”).

“568” – Unsupported Language.

“569” – Digital signature verification failed (means that authentication request XML was modified after it was signed).

“570” – Invalid key info in digital signature (this means that certificate used for signing the authentication request is not valid – it is either expired, or does not belong to the AUA or is not created by a well-known Certification Authority).

“571” – PIN requires reset.

“572” – Invalid biometric position.

“573” – Pi usage not allowed as per license.

“574”– Pa usage not allowed as per license.

“575”– Pfa usage not allowed as per license.

“576” - FMR usage not allowed as per license.

“577” – FIR usage not allowed as per license.

“578” – IIR usage not allowed as per license.

“579” – OTP usage not allowed as per license.

“580” – PIN usage not allowed as per license.

“581” – Fuzzy matching usage not allowed as per license.

“582” – Local language usage not allowed as per license.

“586” – FID usage not allowed as per license. This feature is being implemented in a phased manner.

“587” – Name space not allowed.

“588” – Registered device not allowed as per license.

“590” – Public device not allowed as per license.

“710” – Missing “Pi” data as specified in “Uses”.

“720” – Missing “Pa” data as specified in “Uses”.

“721” – Missing “Pfa” data as specified in “Uses”.

“730” – Missing PIN data as specified in “Uses”.

“740” – Missing OTP data as specified in “Uses”.

“800” – Invalid biometric data.

“810” – Missing biometric data as specified in “Uses”.

“811” – Missing biometric data in CIDR for the given Aadhaar number.

“812” – Aadhaar holder has not done “Best Finger Detection”. Application should initiate BFD to help Aadhaar holder identify their best fingers.

“820” – Missing or empty value for “bt” attribute in “Uses” element.

“821” – Invalid value in the “bt” attribute of “Uses” element.

“822” – Invalid value in the “bs” attribute of “Bio” element within “Pid”.

“901” – No authentication data found in the request (this corresponds to a scenario wherein none of the auth data – Demo, Pv, or Bios – is present).

“902” – Invalid “dob” value in the “Pi” element (this corresponds to a scenarios wherein “dob” attribute is not of the format “YYYY” or “YYYYMM-DD”, or the age is not in valid range).

“910” – Invalid “mv” value in the “Pi” element.

“911” – Invalid “mv” value in the “Pfa” element.

“912” – Invalid “ms” value.

“913” – Both “Pa” and “Pfa” are present in the authentication request (Pa and Pfa are mutually exclusive).

“930 to 939” – Technical error that are internal to authentication server.

“940” – Unauthorized ASA channel.

“941” – Unspecified ASA channel.

“950” – OTP store related technical error.

“951” – Biometric lock related technical error.

“980” – Unsupported option.

“995” – Aadhaar suspended by competent authority.

“996” – Aadhaar cancelled (Aadhaar is no in authenticable status).

“997” – Aadhaar suspended (Aadhaar is not in authenticatable status).

“998” – Invalid Aadhaar Number.

“999” – Unknown error.

No

Yes, Aadhaar number holders can view and download/print their authentication history from the UIDAI portal for personal reference, subject to the available records within the selected date range.

6 Months

"If multiple unknown or suspicious authentication attempts are observed, the Aadhaar holder should immediately:

1. Lock your Aadhaar biometrics (or Aadhaar) from the UIDAI website or Aadhaar app so that no one can use your biometrics without your consent
2. Contact the concerned Authentication User Agency (AUA)
3. Report the issue to UIDAI at help@uidai.gov.in or helpline number-1947"

Yes

Aadhaar Authentication History is updated regularly and reflects authentication transactions shortly after they are performed, ensuring near real-time tracking of activities.

Aadhaar Authentication History is available only to Aadhaar number holders (individuals) for viewing their own authentication transactions.

Organizations can see their own AUA‑level transaction logs (for their systems), but they cannot directly view another person’s Aadhaar Authentication History

Aadhaar related data means Aadhaar number along with demographics details i.e. Name, DoB, Gender, Address and Photo, email ID or mobile number.

In order to minimize the footprints of the Aadhaar numbers and its connected data within the infrastructure of REs, each Aadhaar number is to be referred by an additional key called Reference Key. These keys will replace Aadhaar numbers in the organizations ecosystem. Mapping of reference key and Aadhaar number is to be maintained in the Aadhaar Data Vault.

A Hardware Security Module (HSM) is a tamper-resistant physical device mandated for securely generating, protecting, and managing cryptographic keys used in Aadhaar authentication and e-KYC transactions. All private keys for digital signing of authentication XML and for decrypting e-KYC data must reside only within the HSM, never outside it, to ensure high-grade security and compliance with FIPS 140-2 Level 3.

The objective of a Hardware Security Module (HSM) is to provide a dedicated, tamper-resistant environment for the secure generation, storage, and management of cryptographic keys.

Sub-AUA/Sub-KUA may use their respective AUA’s/KUA’s HSM, subject to adherence to the following stipulations:

1. The HSM configuration must ensure logical isolation for each RE.
2. Dedicated cryptographic keys for each RE shall be provisioned and maintained within the logical isolation of HSM.
3. Implementation of Identity & Access Management (IAM) to control and monitor all access to cryptographic keys and associated interfaces.
4. Multifactor authentication, Multirole-based Access Control and robust Audit Logging must be enforced to safeguard access and to provide traceability for all cryptographic operations.

REs may use their existing HSM for storing the keys used for encryption of data stored in Aadhaar data vault. However, these keys cannot be shared with any other RE, except for their authorized Sub-AUAs/KUAs. To facilitate this, the AUAs/KUAs must provide a separate logical partition within the HSM for each of its Sub-AUAs/Sub-KUAs to store the respective encryption keys including IP whitelisting. REs is responsible for ensuring the security of the partitions that store Aadhaar data vault keys.

All REs are directed to mandatorily store Aadhaar numbers along with any connected Aadhaar data (i.e. eKYC XML containing Aadhaar number and its demographic data) in ADV implemented with HSM. If the RE wants to convert the existing Database into Aadhaar Data Vault (ADV) complying to latest Circular issued by UIDAI time to time, such RE may do so. In that case, the RE must ensure that the Aadhaar numbers are only stored on this ADV and removed from other databases.

Aadhaar Data Vault is a separate secure database/vault/system for Aadhaar data (i.e. Ekyc XML containing Aadhaar number and its demographic data) received by the requesting entities (RE) for specific purposes approved under Aadhaar Act, 2 0 1 6 and associated Regulations thereunder. It is established along with HSM.

Objective of Aadhaar Data Vault is to minimize footprints of the Aadhaar numbers by encrypting it and its connected data and before securely storing it within the infrastructure of REs.

All REs storing full Aadhaar number along with any connected Aadhaar data in accordance with the Aadhaar Act, 2016 and associated regulations and any directions/guidelines issued hereafter are required to implement Aadhaar data vault.

Yes, UIDAI has issued implementation guidelines for ADV which is published under Authentication documents at uidai.gov.in on below mentioned link: (https://uidai.gov.in/en/authentication-documents)

Full Aadhaar number along with any connected Aadhaar data (i.e. eKYC XML containing Aadhaar number and its demographic data) received by the requesting entities (RE) from e-KYC response must be stored only within ADV. Aadhaar number or related data provided by Aadhaar Number Holder (ANH) in Authentication application submitted for authentication (mobile/web) is prohibited to be stored by the RE in any form.

Sub-AUAs/Sub-KUAs may implement their own ADV or use their respective AUA’s/KUA’s ADV as-a-service subject to implementation of Identity & Access Management (IAM) and ensuring logical segregation. In addition, Sub-AUAs/Sub-KUAs are fully responsible for ensuring compliance with respect to the Aadhaar Act, 2016 and associated regulations as amended thereafter.

No, AUA/KUA cannot access any data in ADV of their Sub-AUAs/Sub-KUAs.

RE needs to create an Aadhaar data vault and replace Aadhaar numbers in all existing databases with the respective reference keys even if Aadhaar number is stored encrypted in several databases within the RE.

Yes, demographic details can also be stored locally if Aadhaar and UID token are not stored/mapped with it by taking reasonable security safeguards to prevent breach of such data, which shall include, at the minimum, appropriate data security measures, including securing such data through encryption, obfuscation or masking.

Yes, UID token can be stored safely without encryption after its mapping with reference key by taking reasonable security safeguards to prevent breach of such data, which shall include, at the minimum, appropriate data security measures.

No, Aadhaar pdf (received from eKYC response) shall only be stored in encrypted manner inside ADV.

All existing global AUAs/KUAs (implemented a fully compliant ADV), CSPs providing ADV as a service hosted on GCC empaneled cloud or a technical service provider providing on- premises services of ADV can provide ADV as-a-service.

The encryption algorithm and key strength required for securing Aadhaar numbers and related data in the Aadhaar Data Vault must comply with the latest UIDAI specification, API 2.5 for Authentication and eKYC. These specifications are subject to change, and regulated entities must refer to the latest UIDAI documentation for updated requirements.

The organization may use any reference keys as long as it can be uniquely mapped to the respective Aadhaar numbers and meets the requirement of the UIDAI Circulars regarding ADV implementation, such as Aadhaar numbers should not be predictable if corresponding reference keys or set of keys are available. Organization should consider other implications of using Bank account / PAN card as reference keys which may be local to the environment.

Multiple reference keys may be generated for a single Aadhaar if there is such business case which requires to refer one Aadhaar by different reference keys in the internal ecosystem of the RE. In such cases, the R E shall ensure compliance to the other requirements specified in the UIDAI Circulars/Guidelines on the ADV, as issued by UIDAI time-to-time.

This is left to organization to choose nomenclature/convention as long as it ensures that the recovery of the original Aadhaar number must not be computationally feasible knowing only the reference key or numbers of reference keys. Hash of Aadhaar No. should not be used as reference key.

Aadhaar number may be used wherever necessary to process the transactions, however when the transaction related data or Aadhaar related data is stored, Aadhaar numbers should not be stored in any other storage than Aadhaar Data Vault.