DigiLocker

Issued Documents and the Pull Mechanism

The core function of DigiLocker is the "Issued Documents" section. You open the app, navigate to this tab, and select a document type — say, your driving licence. The app then queries the government's central repository. If your Aadhaar is linked and the issuing authority has uploaded your document, it appears in your wallet within seconds. This pull mechanism is what sets DigiLocker apart from a simple storage app. You do not scan or photograph your documents. You pull them directly from the source. This ensures authenticity. The app displays a small badge on each pulled document indicating it is "issued" and carries a digital signature. You can share this document with a QR code, and the recipient can verify it in real time. This is the system working as intended.

The issue is that the pull mechanism depends on multiple external systems. The issuer — the transport department, the university, the tax authority — must have uploaded your document to their own system first. If they have not, the app shows a message: "No documents found." This is not a bug. It is a dependency. The app cannot pull what does not exist. This dependency is the source of many user frustrations. A user might have a physical PAN card but find it missing in the app. The fix lies not in the app, but in contacting the issuer to upload the document. The app provides a link to the issuer's portal, but the user must take the extra step. This creates a gap between expectation and reality. The app promises a digital wallet, but the wallet is only as full as the issuers make it.

Login, Authentication, and the Aadhaar Gateway

Login to DigiLocker requires a mobile number and an Aadhaar number. You enter your mobile number, receive an OTP, and then enter your Aadhaar number for verification. The app then checks the Aadhaar database to confirm your identity. This is a critical step. The Aadhaar gateway is managed by the Unique Identification Authority of India (UIDAI). If the UIDAI server is slow or unresponsive, the login fails. This is a recurring complaint. Users report being unable to log in during peak hours or during result announcements when traffic spikes. The app itself is not the bottleneck. The bottleneck is the central authentication infrastructure. The app shows a generic error message, leaving the user to guess whether the issue is with their network, their Aadhaar, or the server. This lack of granular error messaging adds to the frustration.

Once logged in, the app maintains a session. However, users report being logged out after periods of inactivity. This is a security feature, but it becomes a nuisance when you need quick access to a document. The app asks for a PIN or biometric authentication to re-enter. If you forget the PIN, you must go through the OTP and Aadhaar flow again. This creates a friction point. The app's official support page suggests clearing cache and data, or reinstalling the app for persistent login issues. This is a common troubleshooting step for many apps, but it underscores the fragility of the login process. The app's reliance on external authentication makes it vulnerable to disruptions beyond its control.

The Offline Reality and International Use

DigiLocker is designed for the Indian context. The app's description, its integration with Aadhaar, and its issuer network are all India-specific. A significant complaint from users is that the app stops working as soon as you leave India. It gives a strange error message, or simply fails to load. This is not a bug. It is a design constraint. The app's servers are likely configured to accept requests only from Indian IP addresses, or the Aadhaar gateway may block international requests. This makes the app virtually unusable for NRIs (Non-Resident Indians) who need to access their documents while abroad. The app does not have an offline mode. You cannot view previously downloaded documents without an active internet connection. This is a major limitation for a document wallet. A document wallet should provide access to documents even without connectivity. DigiLocker does not.

The app's data safety section states that data is encrypted in transit. The app does not share data with third parties. However, the app collects personal information and files and documents. The app is free, with no in-app purchases. The developer, Rajiv Ranjan Ojha, is listed as the contact, but the app is officially published by the National eGovernance Division (NeGD), Government of India. This duality can be confusing. The official website is digilocker.gov.in, which is the authoritative source. The app's support page is also on the government domain. The app's rating on Google Play is 3.8 stars with over 622,000 reviews. This indicates a large user base with a moderately positive sentiment, but the volume of complaints about login and crashes suggests significant friction.

Fake Apps and the Security Warning

The Ministry of Electronics and Information Technology (MeitY) has issued warnings about fake DigiLocker apps and websites. These fake portals mimic the official design and trick users into entering their Aadhaar and login credentials. The fraudulent website digilocker.cisceboard.org is one example. It was designed to look identical to the official portal, complete with matching logos and color schemes. MeitY confirmed that this website has no connection to DigiLocker or CISCE. The warning is a reminder that the official app is only available on the Google Play Store and Apple App Store, published by the National eGovernance Division. The app never asks for OTPs, PINs, bank details, or payments via calls, SMS, WhatsApp, or email. This is a critical security point. Users must verify the publisher name before installing. The fake apps often use names like "DigiLocker" and government-like logos to confuse people. The official app has a package ID of com.digilocker.android. Any other package ID is a fake. This is a key differentiator.

The presence of fake apps highlights the app's importance and the value of the data it holds. Aadhaar numbers, PAN cards, and driving licences are sensitive. A fraudulent app could steal this data and use it for identity theft. The government's response has been to issue public warnings and take down fake websites. However, new fake apps continue to appear. Users must remain vigilant. The app's security features, such as encryption in transit, are robust, but they do not protect against a user voluntarily entering their credentials into a fake app. The user is the weakest link. This is a common challenge for any widely used government app.