How to recover your DigiLocker account

Open the sign-in screen before you do anything else and read what it is refusing. DigiLocker's sign-in accepts several different identifiers, and its Forgot Security PIN flow offers four of them — mobile number, Aadhaar, PAN and driving licence. If any one of those four is accepted and moves you to an OTP screen, your account exists and is findable; the only question left is where the OTP lands. If none of them is recognised, you are looking at a different problem — usually an account created on a number you have forgotten, or no account at all.

Case one is the simplest: you know your username or mobile number, the phone works, and you have forgotten the PIN. This is a five-minute fix and nothing else on this page applies to you.

Case two is a forgotten username. This is far less serious than it feels, because the username is not the only way in — the same four identifiers used for a PIN reset also work as sign-in identifiers, so a person who has forgotten the username but still holds the registered mobile is not locked out at all.

Case three is the changed mobile number. The account is intact, the PIN may even be remembered, but the OTP is going to a number that now belongs to somebody else or to nobody. This is where the Aadhaar route becomes the whole answer, and it works only if Aadhaar itself carries a number you can reach.

Case four is an account that was never Aadhaar-linked. Some older accounts, and accounts created purely to hold self-uploaded files, sit on a mobile number and a username with no Aadhaar behind them. There is no Aadhaar fallback for these, which is the single strongest argument for linking Aadhaar to any DigiLocker account you actually depend on.

Case five, and the one that stops most people, is a mismatch: the mobile in DigiLocker and the mobile in Aadhaar are different, and neither is a number you still hold. UIDAI is explicit that a mobile number must be registered against your Aadhaar to use its online services at all, so the Aadhaar fallback fails for exactly the same reason the primary route failed. Nothing online will move until Aadhaar's own mobile number is corrected, in person.

Diagnose honestly before you act. Write down which mobile numbers you have used in the last decade, which of them are still live, and which one you believe is on Aadhaar. If you are not sure about the last of those, UIDAI runs a verify-email-and-mobile service on myAadhaar that tells you whether a given number is the one on record without revealing the number itself — which is exactly the check that decides whether your recovery is a five-minute job or a Seva Kendra visit.

Go to the DigiLocker sign-in page and choose Forgot Security PIN. The screen asks you to pick how you want to identify yourself, and offers four ID types: mobile number, Aadhaar, PAN and driving licence. Pick the one whose linked mobile number you can still reach, which is not always the obvious one.

Choosing mobile number sends the OTP to that number directly. Choosing Aadhaar sends it to the mobile registered against your Aadhaar, which may be a different number altogether. Choosing PAN or driving licence identifies the account by a document already linked to it, and the OTP still goes to the number DigiLocker holds. The choice of identifier does not change where the code lands so much as it changes which account record DigiLocker looks you up in — so if one route says no such account, try the next before concluding anything.

Enter the OTP promptly. Government OTP screens are unforgiving about timing and about typing the code into the wrong field on a page that has already refreshed. If the code does not arrive within a minute, do not request five more in succession — repeated requests on Indian government portals frequently trigger a temporary block that costs you the next thirty minutes. Wait, then request once more.

Set the new PIN to something you have not used on any other government portal, and write it somewhere durable. The PIN is not merely a password: it gates the document-sharing and e-signing actions inside DigiLocker as well as sign-in, so an account with a PIN you cannot remember is functionally inaccessible even while you are logged in on a phone that still has a session.

If the reset completes but sign-in still fails, the likeliest cause is that you have two accounts. Duplicate DigiLocker accounts are common — one created years ago against an old number, another created later at a bank or an RTO counter — and the reset you just completed applied to the one you do not use. Repeat the reset using a different identifier, in particular Aadhaar, and see whether you land somewhere unfamiliar.

One thing the PIN reset cannot do is move your OTP to a new number. It authenticates you against a number already on record. If no number on record is reachable, the PIN reset will keep failing at the OTP step no matter how many identifiers you try, and you have a mobile problem rather than a PIN problem.

Start by testing whether you need it. DigiLocker will sign you in on identifiers other than the username — the same mobile, Aadhaar, PAN and driving licence set the recovery screens use — so a person who has simply forgotten a username chosen years ago is very often not locked out and does not need to recover anything.

If you do want the username itself, the sign-in screen carries a username recovery option alongside the PIN reset, and it works the same way: identify yourself, receive an OTP on the registered mobile, and the username is displayed. It is the same dependency as everything else on this page, which is why the recovery of a username is never the hard part.

The username matters more than it looks in one situation: when a third party has told you to sign in with a specific DigiLocker ID. Banks, insurers and some employers ask candidates to share documents from a named DigiLocker account, and if you have two accounts the one they mean may not be the one you use daily. Recovering the username tells you which account they were looking at.

Do not create a fresh account to get around a forgotten username. A new account starts with an empty issued-documents list until each issuer's push has been re-triggered, and the older account continues to exist against your Aadhaar in the background. Two live accounts on one identity is the state that produces the confusing half-failures described above.

Where you have genuinely lost both the username and every number attached to it, the username is no longer the problem to solve. Go straight to the mobile-number sections below; once the number is fixed, the username surfaces on its own.

This is the case the plan-your-recovery work above exists to identify, and it splits in two. Either the handset is lost but the number is still yours, or the number itself has gone — surrendered, ported away, or lapsed and recycled to a new subscriber.

If the number is still yours and only the handset is missing, the fix is not a DigiLocker fix at all. Get a duplicate SIM from your operator on the same number, which restores OTP delivery everywhere at once, and only then return to the DigiLocker reset. Doing it in that order saves you from the far messier route below, and it also stops the far more urgent problem of a live SIM in a stranger's hands receiving banking OTPs.

If the number has actually gone, try the Aadhaar identifier on the reset screen. DigiLocker will send the OTP to the mobile registered against your Aadhaar rather than the one on the DigiLocker account, and for most people those are different numbers of different vintages. It is common for the Aadhaar-linked number to be a working one even when the DigiLocker one is dead, simply because Aadhaar was updated at a bank or a passport appointment at some point and DigiLocker never was.

If the Aadhaar OTP arrives, you are through, and the first thing to do inside the account is change the registered mobile number to the one you actually use. Do that immediately, while you are signed in, rather than promising yourself you will do it later. The window in which you can fix this cheaply is the window in which you are logged in.

If the Aadhaar OTP does not arrive, stop trying. UIDAI states plainly that a mobile number must be registered to your Aadhaar for its online services to work, and there is no online way to change that number. Every further attempt on DigiLocker will fail at the same step for the same reason. The next section is now your only route.

One nuance worth flagging: a recycled number is worse than a dead one. Indian mobile numbers are returned to the pool and reissued after a quarantine period, so an OTP sent to a number you gave up two years ago may be arriving on a stranger's phone rather than disappearing. If you are in that position, treat the DigiLocker recovery as urgent rather than administrative, and change the number on every account that still holds it once you are back in.

At this point the DigiLocker problem has become an Aadhaar problem, and it is solved at an Aadhaar Seva Kendra or an authorised enrolment centre. UIDAI's own FAQ on the question is one sentence long: you can update your mobile number by visiting an Aadhaar Enrolment Centre. There is no online route, no document upload, and no exception — the update is authenticated by your fingerprints at the counter, which is precisely what stops anybody else attaching their number to your Aadhaar.

Find a centre on the Bhuvan Aadhaar portal, which lets you search by proximity, PIN code or state and filter by the service you need, including demographic and biometric updates. Bhuvan itself carries a disclaimer that the centre database is indicative and that location validation is in progress, so ring ahead or check the centre on UIDAI's own listing before travelling any distance.

Appointments at UIDAI-run Aadhaar Seva Kendras are booked free of charge online, and — importantly for anybody in this situation — UIDAI states that booking does not require an Aadhaar-registered mobile number. Each person may hold up to two appointments a month, and the centres operate from 9:30 a.m. to 5:30 p.m. Walk-ins are accepted at many centres but the queues at busy ones are long enough to lose a working day.

The fee is prescribed and small. UIDAI lists a demographic update — which is what a mobile number change is — at ₹75 when done on its own, and free when it is carried out together with a biometric update. A biometric update on its own is listed at ₹125, with age-based exemptions, and a download with colour printing at ₹40. Enrolment is free. A centre asking for materially more than the published fee is overcharging, and that is reportable to UIDAI on 1947.

Take the original of a document establishing identity even though a mobile update does not formally require one, because centres in practice ask, and take your Aadhaar number or a printed e-Aadhaar. The update is not instant: the new number becomes usable for OTP once the update processes, and you can track that through the update-status service on myAadhaar or by calling 1947.

Once the Aadhaar-linked number is live, go back to DigiLocker and run the Forgot Security PIN flow using Aadhaar as the identifier. The OTP now reaches you, the PIN resets, and the account opens. Before you close the tab, change the mobile number held on the DigiLocker account itself so that the two records agree — otherwise you have fixed the fallback and left the primary route broken, which is the same trap in a new position.

Which documents then reappear in your issued list depends partly on your state. DigiLocker's issuers include central bodies and a long list of state transport departments, school and university boards, revenue departments and municipal bodies, and onboarding is uneven — a driving licence issued in one state may pull through instantly while a state-board marksheet from another has to be fetched manually or does not exist as an issued record at all. Check the issuer list for your own state rather than assuming a neighbour's experience applies.

DigiLocker holds two categories of thing and they behave completely differently in a lockout. Issued documents are electronic records pushed into your account by the department that issued them, keyed to your Aadhaar number in that department's own database. Uploaded documents are files you put there yourself. The distinction is set out on DigiLocker's own pages and it is the single most useful thing to understand about the service.

Issued documents are not really stored for you. What sits in your account is a pointer to the issuer's record, which is why the same document reappears intact after any recovery, and why nothing you do to your DigiLocker account can destroy your driving licence or your marksheet. Losing access to DigiLocker is losing access to a window, not to the room behind it.

The legal position follows from that. Rule 9A of the Digital Locker Rules made under the Information Technology Act — inserted by amendment in 2017, the parent rules having been notified as G.S.R. 711(E) — provides for issuers to issue and requesters to accept certificates or documents shared from a DigiLocker account at par with physical documents. That is why a licence produced from DigiLocker at a roadside check, or a marksheet shared with an employer from the issued section, is not a photograph of a document but the document.

Uploaded documents get none of that. They are unverified scans and carry no more authority than the paper they were copied from; commentary on the rules is consistent that the parity provision attaches to issued records rather than to whatever a subscriber has uploaded. They are also the only part of the account that is genuinely at risk, because there is no issuer to regenerate them.

The practical consequence for anybody planning a recovery is to stop worrying about the issued documents and to think carefully about the uploaded ones. The uploaded section is capped at one gigabyte per account with a ten-megabyte ceiling per file, which is small enough that most people's uploads are a handful of PDFs — a rent agreement, an old offer letter, a scanned affidavit — that exist nowhere else in scanned form. Those are what a permanently abandoned account costs you.

It also changes what you should do with a duplicate account. If you discover during recovery that you have two DigiLocker accounts, the issued documents on the abandoned one are of no value — they will pull into whichever account is Aadhaar-linked. The uploaded files on it are the only reason to bother recovering it at all.

Finally, the parity rule cuts both ways when somebody refuses your document. A clerk who insists on a physical original is entitled to check that what you are showing is an issued record and not an upload, but is on weak ground refusing an issued, digitally signed record outright. Showing the document from the issued section, with the issuer's name and the digital signature visible, rather than as a downloaded PDF on your gallery, is what makes that argument for you.

There is a genuine residue of cases the reset screens cannot solve — an account whose Aadhaar seeding has broken, a mobile number that updates in Aadhaar but never propagates, an issued document that will not fetch after recovery, a duplicate account that cannot be merged. For those, DigiLocker runs a support desk reachable through the support portal linked from digilocker.gov.in, and that is the correct first escalation rather than a phone call to any department.

Write the ticket the way a case officer needs to read it. State the account identifier you are using, the exact screen and error text, the mobile number currently on Aadhaar, the date of any Aadhaar update and its update request number, and what you have already tried. Attach a masked Aadhaar rather than a full copy where an identity proof is asked for. A ticket that says my DigiLocker is not opening will be answered with the same reset instructions you have already failed at.

Keep the ticket reference. Every subsequent step on the ladder asks for it, and a grievance filed without evidence that you first approached the service provider is routinely bounced straight back down.

If the support desk does not resolve it, DigiLocker sits under the Ministry of Electronics and Information Technology, so the grievance route is CPGRAMS — the Centralised Public Grievance Redress and Monitoring System, available to any citizen around the clock and connected to every central ministry and state department. You register, receive a unique registration number, and can track the grievance and its outcome against that number.

CPGRAMS also carries an appeal. If the reply you receive resolves nothing, the portal lets you rate the resolution poorly and file an appeal, which is tracked against the same registration number. It excludes some categories entirely — RTI matters, subjudice cases, religious matters and internal service disputes — but a citizen locked out of a government document wallet is squarely within its scope.

Where the underlying blockage is on the Aadhaar side rather than the DigiLocker side, escalate to UIDAI instead: the helpline is 1947, the email is [email protected], and UIDAI runs its own grievance filing and status-check facility on myAadhaar as well as regional offices. Sending an Aadhaar mobile-update complaint to DigiLocker's support desk simply loses you a fortnight.

Do not pay anybody to do this. There is no paid fast track into a DigiLocker account, the Aadhaar Seva Kendra fees are published and small, and CPGRAMS filing is free — the portal notes that any charge collected is a Common Service Centre's own fee and not a government one. Operators who advertise DigiLocker unlocking or Aadhaar mobile update without visit are, without exception, either useless or a data-harvesting front.

A DigiLocker lockout caused by a changed mobile number is almost never a DigiLocker-only lockout. The same number is the OTP endpoint for the income tax e-Filing portal, the EPFO member portal, bank net banking, UPI, insurance portals and every state service that authenticates through Aadhaar OTP. Discovering the problem at DigiLocker is discovering it at the shallow end.

Fix them in dependency order. Aadhaar's registered mobile comes first, because Aadhaar OTP is the fallback that unlocks several of the others. DigiLocker next, because a working DigiLocker gives you clean, issuer-signed copies of PAN, licence and marksheets to attach to the applications that follow. Bank and UPI after that, and the tax and provident-fund portals last, since those have their own additional identifiers.

The income tax e-Filing portal is worth attention because a stale number there surfaces only at filing season, when the queue is longest. Its helpdesk runs on 1800 103 0025 and 1800 419 0025 from 08:00 to 20:00 on weekdays, with separate lines for the Tax Information Network and for the annual information statement. Sorting out the contact details on the tax profile in a quiet month is far cheaper than doing it in the last week of July.

While you are inside myAadhaar to fix the number, use the security services you are already authenticated for. UIDAI offers biometric locking and unlocking, Aadhaar number locking, a temporary sixteen-digit Virtual ID to quote instead of the Aadhaar number, and an authentication history covering the last fifty authentication transactions. That history is the fastest way to see whether anybody has been authenticating in your name while you were locked out.

If the lockout began with a lost or stolen phone rather than a voluntary number change, the sequence is different and more urgent: get the SIM blocked and reissued first, then work through the accounts. A live SIM in someone else's hands and a DigiLocker account holding a full set of identity documents is a combination that supports account takeover elsewhere, not merely inconvenience.

Where money has already moved, the DigiLocker recovery is no longer the priority. The national cyber crime helpline is 1930 and the report is filed on the National Cyber Crime Reporting Portal; the first hour matters more than anything else on this page, and the document recovery can wait until that is lodged.

Once you are back in, spend five minutes making the next lockout impossible. Confirm the mobile on DigiLocker and the mobile on Aadhaar are the same live number, add an email address to the DigiLocker profile, make sure Aadhaar is linked to the account so the fallback exists, and download the two or three uploaded files that exist nowhere else. That is the whole of the maintenance, and it is the difference between a five-minute reset and a trip to a Seva Kendra next time.