Ask around and you will find that most people in India keep their ID documents in the same few places: a WhatsApp chat with themselves, the phone gallery, an email to their own address, or a notes app. It works until the day it does not. A phone gets lost, a chat backup lands on a shared computer, or a photo of a PAN card is sent to the wrong group. This guide covers where ID copies leak, what a safer setup looks like, and how to keep track of renewals so a passport or driving licence never expires by surprise.
This is general guidance, not legal advice. For official verification, always follow what the office or service asks for.
Why ID copies are worth protecting
An Aadhaar number, PAN, passport number and date of birth together are enough to attempt a lot of fraud: SIM swaps, loan applications in your name, fake KYC on a payment wallet. None of these numbers can be changed easily once they leak. That makes the copies you keep on your phone more sensitive than most of what is on it.
The goal is simple: keep a usable copy for yourself and your family, share only what is needed, and make sure that anyone who gets hold of your phone, your cloud account or a backup cannot read your documents.
Where ID documents usually leak
The phone gallery. Photos are synced to cloud photo services by default, show up in “memories” and suggestions, and are handed to any app that asks for photo access. Anyone who unlocks your phone can scroll to them.
WhatsApp “message yourself” chats. Convenient, but chat backups go to Google Drive or iCloud, and on many setups those backups are not end-to-end encrypted. Linked devices such as an office laptop show the same chat.
Email to yourself. Your inbox is protected only by your email password. Attachments stay there for years, and a single phishing login exposes all of them.
Notes apps and loose PDFs. Notes are usually readable by the note service, and PDFs in a Downloads folder are readable by any file manager.
Photocopies left behind. Self-attested copies handed over for a SIM card, a gym or a rental often end up in a drawer you will never see again.
A safer setup in five steps
1. Use the masked Aadhaar where you can
UIDAI lets you download a masked Aadhaar, which shows only the last four digits of the number. Many places that ask for “an Aadhaar copy” only need proof of identity and address, not the full number. Keep both versions, and share the masked one by default.
2. Keep official copies in DigiLocker
DigiLocker is the government’s document wallet. Documents fetched there come directly from the issuer, such as your driving licence from the transport department or marksheets from your board, and many government offices accept them as valid. Treat DigiLocker as your source of official copies.
3. Keep everything else in an encrypted vault
DigiLocker does not cover everything: scans of old documents, insurance papers, property papers, a photo of your RC, a note with your passport file number, the date your PUC expires. Keep these in a vault that encrypts them on your device before anything is uploaded, so the company running the service cannot read them. Read what zero-knowledge encryption means for how this works.
4. Record the details, not only the photo
A photo is hard to search. Write down the document number, name as printed, date of issue and date of expiry next to the scan. When a form asks for your passport number at midnight, you want to copy it, not zoom into a photo.
5. Track expiry dates
Passports, driving licences, vehicle insurance, PUC certificates and RC renewals all expire. Missing one can mean a fine, a cancelled trip or a lapsed policy. Set reminders well before the date, not on the day.
| Document | What usually expires | Good time to start renewing |
|---|---|---|
| Passport | Validity of the booklet | 6 to 9 months before (many countries need 6 months left) |
| Driving licence | Validity of the licence | 1 to 2 months before |
| Vehicle insurance | Policy end date | 1 month before |
| PUC certificate | Certificate validity | 1 to 2 weeks before |
| RC (private vehicles) | Registration validity | 2 months before |
Sharing ID copies without losing control
When someone genuinely needs a copy, a few habits help:
- Share the minimum. Masked Aadhaar instead of the full one, a single page instead of the whole passport.
- Write the purpose on the copy. “For SIM verification only, 22 Oct 2026” across the image makes it harder to reuse.
- Prefer links that expire over files that live forever in someone’s chat.
- Delete what you sent from your own chats and Downloads folder once it has been received.
How OnlyWallet handles ID documents
OnlyWallet is a free personal vault built for exactly this. Here is what it does, and where its limits are.
- Templates for Indian documents. Aadhaar, PAN card, passport, voter ID, driving licence, RC, vehicle insurance, PUC, FASTag, marksheets and more, each with the right fields. The Aadhaar template checks the 12-digit number, and the PAN template knows the PAN format.
- Encrypted on your device. Every field you enter, such as your Aadhaar or passport number, is encrypted with a key that only your master password unlocks. Our servers store ciphertext.
- Files in your own Google Drive. Scans and photos are encrypted with their own key before upload and saved in an “OnlyWallet Vault” folder in your Drive, with opaque file names. Neither Google nor we can see what the files are.
- Read on the device. “Upload document” and “Fill from document” read a PDF or photo on your device and suggest the fields they found. You check every field before saving. Nothing is sent to a server for reading.
- Expiry reminders. The passport template reminds you 270, 180, 90 and 30 days before expiry, and on the day. The driving licence and RC remind you 60, 30, 7 and 1 day before.
- Share by link. You can share a single document as an encrypted link that can be view-only, view-once or full access, and that expires within at most 31 days.
Two honest limits. First, some details stay readable on our servers so reminders and lists work: for example the item title (unless you turn on “Mark title private”), the category and the expiry date. Second, if you forget your master password and lose your 24-word recovery phrase, nobody can recover your vault, including us. The security page lists exactly what is and is not encrypted.
For a tour of the document features, see the digital document wallet page.
A quick checklist
- Download your masked Aadhaar and use it by default.
- Link DigiLocker for official copies.
- Move ID photos out of your gallery, chats and email into an encrypted vault, then delete the originals.
- Record document numbers and expiry dates next to each scan.
- Turn on expiry reminders.
- Write down your recovery phrase on paper and keep it somewhere safe at home.
Try it free
OnlyWallet is free in your browser today, with Android and iPhone apps coming soon. Open the web app, sign in with Google, create a master password and add your first document in a few minutes. See every platform on the download page.