Government QR Codes in India: From Aadhaar to Driving License to DigiLocker
Every major Indian government document now carries a QR code — Aadhaar, driving license, vehicle RC, COVID certificates, DigiLocker IDs. Here's what each QR contains, who can scan them, and what data is actually exposed.
India runs the largest QR-enabled government identity system in the world. Aadhaar, driving licenses, vehicle registration certificates, COVID vaccination certificates, GST invoices, food licenses — every major government document now carries a QR code. Most Indian citizens scan these dozens of times a year without knowing what data the QR actually contains or who has access. This guide demystifies it.
Aadhaar QR: the most-scanned QR in India
Every Aadhaar card has a QR code that encodes a digitally signed XML blob containing:
- Aadhaar reference number (last 4 digits visible)
- Name, date of birth, gender
- Address
- Photo (compressed)
- Mobile / email hash (not the actual number)
- UIDAI digital signature ensuring tamper-detection
- Optional masking on offline-eKYC variants
How to verify an Aadhaar QR
Any verifier (employer, bank, telecom KYC) can use the official mAadhaar app or UIDAI's public Aadhaar Offline e-KYC tool to scan and verify the QR. The verification checks the UIDAI signature — proving the card is genuine and the data hasn't been tampered with — without contacting UIDAI servers in real time. Privacy-preserving by design.
Driving License & Vehicle RC: Sarathi & Parivahan QRs
Driving licenses issued post-2019 in most Indian states carry QR codes encoding the holder's license details signed by the issuing RTO. Same with vehicle RC (Registration Certificate) cards.
Traffic police can verify these QRs via the mParivahan app, eliminating the need to call the RTO for verification. Major reduction in fake DL / RC fraud since 2020.
COVID vaccination certificates: the bridge to general use
CoWIN-issued vaccination certificates put QR-based government verification in the hands of every Indian citizen. The QR encodes a verifiable credential signed by the Ministry of Health.
This was the first time most Indian citizens learned that government QRs are something they could verify themselves with a free app — a huge unlock for the next wave of QR-based services.
DigiLocker: the universal QR ID wallet
DigiLocker holds digital copies of government-issued documents (PAN, Aadhaar, DL, RC, marksheets, etc.) and each one carries its own verifiable QR. Verifiers scan the QR, get a real-time validation from the issuing department.
Banks, employers, universities and government offices increasingly accept DigiLocker QR-verified documents instead of requiring physical originals. Saves ~₹500-2,000 per individual annually on attestation costs.
GSTIN + invoice QRs: the B2B compliance layer
Since 2020, B2B invoices above ₹500 crore turnover threshold require a QR code containing IRN (Invoice Reference Number) signed by GSTN. This expanded to all B2B invoices in phases, and every Indian retailer above the threshold now generates QR-coded invoices.
Buyers scan to instantly verify the invoice is registered with GSTN — preventing fake invoice fraud that historically cost the exchequer billions.
FSSAI license + restaurant QRs
FSSAI requires every restaurant to display its license. The QR on the FSSAI license certificate links to the official FSSAI portal where consumers can verify the license is valid, see its expiry date, and report violations.
This is one of the most consumer-empowering uses of government QRs in India — any diner can verify their restaurant's license in 5 seconds.
What government QRs don't do (privacy boundaries)
A common misconception: that government QRs expose more data than they actually do:
- Aadhaar QR doesn't expose your bank accounts or income
- Driving license QR doesn't expose your traffic violations or insurance status
- COVID cert QR only confirms vaccination status, not your medical history
- GSTIN QR only confirms invoice validity, not the buyer's financial details
- All verifications are cryptographically signed and tamper-evident
- Most QRs are designed for "verify but not extract" — the verifier sees only what's necessary
India's government QR ecosystem is quietly the world's most-deployed identity infrastructure built on the standard. Every citizen carries 4-5 government-issued QRs in their wallet today (DL, Aadhaar, vehicle RC, vaccination cert). Understanding what each QR contains and what it doesn't is the first step to trusting the system — and to building the next generation of consumer apps on top of it.
