India's Identity Stack: How Aadhaar Authenticates 1.4 Billion People

I. The Scale Nobody Talks About

The Numbers

In the fiscal year 2024-25, Aadhaar processed over 2,707 crore authentication transactions. That is 27 billion identity verifications in a single year. In March 2025 alone, the system handled 247 crore transactions—approximately 8 crore verifications per day, or roughly 92,500 authentications per second at peak load.

To put this in perspective: no other identity system on the planet operates at this scale. The US Social Security system, the EU's eIDAS framework, and China's national ID system all pale in comparison to the sheer transaction volume that UIDAI handles daily.

The Question Worth Asking

Most people experience Aadhaar as a 6-digit OTP on their phone. But behind that 6-digit number lies a distributed authentication architecture that must validate a person's identity against a database of 1.4 billion records in real time—while maintaining security, privacy compliance, and sub-second response times.

How does this actually work?

II. The Authentication Architecture

The Three-Layer Model

Aadhaar authentication is not a simple database lookup. It operates through a layered framework of regulated entities:

Authentication Flow (System Design)

When you enter an OTP for Aadhaar verification, the request flows: Your Device → AUA → ASA → CIDR → ASA → AUA → Response. The entire round-trip completes in seconds. The CIDR never exposes raw data—it returns only a Yes/No authentication response.

Verification Methods

The system supports multiple authentication modalities, each with different security and accessibility tradeoffs:

The Security Layer

In 2025, UIDAI introduced Circular No. 8, mandating stricter security controls:

• Aadhaar Data Vaults (ADV): Raw Aadhaar numbers can no longer be stored in open databases. All entities must use tamper-proof, tokenized vaults.
• Hardware Security Modules (HSM): All cryptographic operations must occur within FIPS 140-2 Level 3 certified hardware—the same standard used by military-grade systems.
• MeitY-Certified Hosting: Authentication applications cannot run on general public clouds (AWS, Azure, GCP) unless they meet specific government certification requirements.

This is a deliberate architectural choice: India's identity infrastructure runs on sovereign infrastructure, not on rented foreign cloud platforms. Whether you agree with the tradeoffs or not, the intent is clear—digital sovereignty at the identity layer.

III. DigiLocker: The Document Layer

Not a Storage Service

DigiLocker is commonly misunderstood as "Google Drive for government documents." It is not. DigiLocker is a secure document gateway that fetches documents in real-time from the issuer's repository. Your driving license is not "uploaded" to DigiLocker—it is pulled directly from the transport department's database at the moment you request it.

The Architecture

DigiLocker uses a microservices-based architecture with a decentralized data exchange model:

• OAuth 2.0: Third-party applications can only access your documents with explicit, revocable consent.
• API Setu: A secure middleware that facilitates consent-based data exchange between Issuers (government departments) and Requesters (banks, employers, universities).
• URI Resolution: Every document is assigned a unique Uniform Resource Identifier. When a verifier scans your document, the URI resolves directly to the issuer's source database—making forgery structurally impossible.
• Digital Signing: All fetched documents are digitally signed, making them legally equivalent to physical originals under the IT Act.

The Scale

As of mid-2025:

• 53.9 crore registered users (539 million)—nearly 40% of India's population
• 940+ crore documents (9.4 billion) available on the platform
• Thousands of active Issuers and Requesters across finance, education, and transport

The Aadhaar Mapping Process

When you register for DigiLocker, you enter your Aadhaar number. This triggers an authentication request to UIDAI's CIDR. Once validated via OTP, your DigiLocker account is permanently linked to your Aadhaar identity. This mapping enables automatic retrieval of all documents pre-associated with your Aadhaar across government databases—your e-Aadhaar, driving license, PAN, educational certificates, and vaccination records—all fetched from their original sources, not from copies.

IV. The OTP Problem (What Most People Actually Experience)

Why OTP Delays Happen

The most common complaint about Aadhaar verification is OTP delay. When you request an OTP and it takes 30-60 seconds instead of arriving instantly, the bottleneck is almost never UIDAI's CIDR. The delay chain typically looks like this:

The critical bottleneck is the SMS gateway-to-carrier hop. Telecom carriers process SMS messages in priority queues, and transactional OTPs compete with millions of other messages. During peak hours—morning banking sessions, month-end salary days, or exam result releases—the SMS delivery infrastructure itself becomes the constraint, not the identity verification system.

Face Authentication: Bypassing the SMS Bottleneck

This is precisely why UIDAI has been aggressively promoting face authentication. By using on-device AI/ML models to match a live facial capture against stored templates, the entire SMS delivery bottleneck is eliminated. Monthly face authentication transactions grew from 12 crore in late 2024 to over 15 crore per month by mid-2025, with single-day peaks exceeding 1.5 crore transactions.

Face authentication is not just a convenience upgrade—it is an architectural solution to a systemic infrastructure constraint.

V. What India Built (And What The World Hasn't)

The India Stack

Aadhaar and DigiLocker do not exist in isolation. They are layers of a larger architecture known as the India Stack:

No other country has built a unified, interoperable digital public infrastructure at this scale. The EU is attempting something similar with eIDAS 2.0, but it remains fragmented across member states. The United States has no equivalent whatsoever—Americans still verify identity with Social Security numbers, a system designed in 1936.

The Sovereignty Question

The India Stack is built on sovereign infrastructure. Unlike most digital systems in developing nations (which run on AWS, Azure, or GCP), India's identity and payment rails operate on government-controlled or MeitY-certified infrastructure. This is a deliberate choice: the nation's identity layer should not depend on foreign cloud providers.

This connects directly to the thesis of our earlier post, The Digital Sovereignty Manifesto. India may lag in foundational software (browser engines, operating systems, databases), but in digital public infrastructure—identity, payments, and document verification—India is arguably the most advanced nation on Earth.