In brief: a virtual ID is a temporary 16-digit number that stands in for an Aadhaar number during authentication, so the Aadhaar number itself does not have to be shared.

On this page

What a Virtual ID is

A Virtual ID (VID) is a temporary, revocable 16-digit number that UIDAI lets an Aadhaar holder generate and use in place of their actual Aadhaar number for authentication and eKYC purposes.

Virtual ID: a phone showing a temporary virtual identity token replacing a masked identity card

Why it exists

The VID lets a person complete an Aadhaar-based verification without disclosing their permanent Aadhaar number to the requesting entity. It can be regenerated at any time via the UIDAI portal, and the previous VID stops working once a new one is generated.

Virtual ID: a refreshing token key with a cycle arrow and a lock

How a virtual ID works in verification

An Aadhaar holder can generate a virtual ID through UIDAI’s services. The virtual ID maps to their Aadhaar number, but the Aadhaar number cannot be worked out from it. The holder can use the virtual ID wherever authentication or e-KYC accepts it, and can regenerate it, which replaces the previous one.

Why businesses should support the virtual ID

Customers who prefer not to share their Aadhaar number can still complete authentication.
Your systems handle less sensitive data, which reduces your data-protection exposure.
A leaked virtual ID is less damaging than a leaked Aadhaar number, because the holder can simply regenerate it.

Designing for the virtual ID

Where your flow accepts an Aadhaar number for authentication, offer the virtual ID as an equal option, with a one-line explanation of what it is and how to generate one. Validate that the input is 16 digits, and never store the virtual ID as if it were a permanent identifier, because the holder can change it at any time.

What the virtual ID does not change

The virtual ID changes what is shared, not who is verified. Authentication still confirms the same Aadhaar holder, and the rest of your KYC process stays the same. Details are published on the UIDAI website, including how holders generate and retrieve a virtual ID.

Using it in onboarding

For businesses, accepting the 16-digit alternative means customers can complete Aadhaar-based checks without sharing their actual number, which reduces the amount of sensitive data you hold. It also lowers the risk if your systems are ever breached, because a revoked or regenerated token is far less useful to an attacker than a permanent number.

Update your forms and validation so that they accept both formats, and make it clear to customers that either is fine. Explain where they can generate one, and handle the case where a customer regenerates it between two steps of your flow, since an older token will no longer work.

Store as little as possible: keep the result of the check and the time it ran rather than the token itself, unless your process genuinely needs it. As with any identity data, collect it only with consent and restrict who can see it inside your organisation.

Customers can generate a new token whenever they want, and the previous one stops working, so build your flow to ask for the current value rather than reusing an old one. Make error messages specific: tell the customer the token may have changed and how to generate a fresh one, instead of showing a generic failure. These small details decide whether customers trust the step or abandon it, and they reduce calls to your support team.

Support teams should be trained on the same points, because customers who hit an error often call for help. A short script that explains how to generate a fresh token, and why the old one no longer works, resolves most of these calls in a minute and keeps the customer in the flow instead of losing them.

It is also worth explaining the benefit to customers in a sentence or two. Many people do not know the option exists, and once they understand that it protects their actual number, they are often happy to use it. A short line of help text next to the input field is usually enough to make that clear.

Before launch, test the flow with both the full number and the 16-digit alternative, and with a token the customer has just regenerated. Each case should end with either a clear success or a specific message explaining what to do next. Checking these paths in advance keeps support calls low and reassures privacy-conscious customers that choosing the safer option will not slow them down.