Aadhaar, PAN and UPI IDs in AI chats

Aadhaar numbers, PAN numbers and UPI IDs identify you to banks, tax offices and payment apps. They are easy to paste into an AI chat without thinking, for example while asking for help with a form or a spreadsheet. This guide explains what they identify, why they deserve care, and what Paste Guard can and cannot do about them.

What each one identifies

Aadhaar is a 12-digit number issued to a resident in India. It is usually written in three groups of four digits. It links to identity records, and many services use it to confirm who you are.

PAN (Permanent Account Number) is a ten-character code made of five letters, four digits and one letter. It identifies a taxpayer, and it appears on tax forms, bank onboarding, investment accounts and invoices.

UPI ID (also called a VPA) is a payment address such as a name, an at sign and the handle of a bank or app. Anyone who has it can send you a payment request, and it often contains your name or phone number.

Related codes show up in the same documents: IFSC codes (identify a bank branch), GSTIN (a business's tax registration number) and labelled bank account numbers.

Why not to paste them

They are hard to change. You can rotate an API key. You usually cannot get a new Aadhaar or PAN.
They combine. A name, a PAN and a phone number together are more useful to a fraudster than any one alone.
Pastes travel. Text you send to a chat service is handled under that service's own terms and retention rules, which you do not control. Check them for the tool you use.
The chat rarely needs them. To format a table, fix a formula or draft a letter, a made-up number works just as well as the real one.
Other people's data. Spreadsheets of customers, staff or applicants contain numbers that belong to someone else, and sharing them is not only your decision.

Safer habits

Use dummy values. Replace numbers with obviously fake ones before you ask for help, and swap the real ones back in locally.
Mask by position. Keep the shape (ABCDE1234F becomes XXXXX0000X) if the format matters to the question.
Paste structure, not data. Share the column headings and two invented rows instead of the whole sheet.
Strip documents. Remove the ID block from a text before pasting it.
Keep a clean copy. Work on a copy of the file that has had identifiers removed.

What Paste Guard detects

When you paste into one of the supported AI chat sites, Paste Guard checks the text on your device for:

Aadhaar numbers. Twelve digits grouped as 4-4-4 are flagged. An unbroken twelve-digit number must also pass the number's built-in check digit, which cuts false alarms.
PAN numbers, in the five-letter, four-digit, one-letter shape.
UPI IDs for a list of well-known handles.
IFSC codes, GSTIN numbers (with their check character) and bank account numbers that follow a label such as "account number" or "a/c no".
Indian mobile numbers, including the 98765 43210 style, and international numbers that start with a plus sign.

It then offers to paste a masked version, where each value becomes a numbered tag like [AADHAAR_1] or [PAN_1]. The same value gets the same tag each time in one paste, so the text still makes sense. Everything is checked locally, and there are no network requests. See What it detects for the full list.

What it cannot detect

Numbers that do not match the known shape. A PAN with a typo, or an Aadhaar split in an unusual way, may not match.
Unlabelled account numbers. A bare digit string with no label is not flagged as a bank account, because most long numbers are not accounts.
Names and addresses. It looks for identifiers with a fixed format. It does not understand names, street addresses or free text.
Images and scans. A photo of a card is not text.
Look-alikes. Occasionally an ordinary code can match a pattern. You can press Ignore on that value.

You can test it with made-up values on the scanner page. If a format is missed, please email rkhajuira12345@gmail.com with invented samples only.