Masking is pixels. KYC is a government office.
WhatsApp still forwards full Aadhaar cards. UIDAI-shaped guidance is to mask the first eight digits and leave the last four. This page looks for 4-4-4 digit groups and PAN-shaped strings, blacks those boxes, and emits a PNG. For a scan with no text layer it asks tesseract.js. That library load is disclosed. The number still never goes to a Privy Tools server.
Worked example: Aadhaar card photo
Drop the JPEG. Mask. You want XXXX XXXX 1234 over the number, not a grey blur you can still read. If OCR misses, the number is in a hologram — use true PDF redaction (or this canvas plus a screenshot crop) and draw.
Worked example: PAN on an offer PDF
Page 1 only here. ABCDE1234F → ABCDE****F in spirit, as a black box over the string. Rest of the pages are untouched; finish them on the redaction tool.
Questions
Do you send the Aadhaar to UIDAI?
No. There is no lookup. This blacks pixels. The checksum tool is a different page and also not KYC.
UIDAI-style mask?
Last four digits visible, first eight replaced. That is the usual published masking pattern. Confirm the circular you are following.
Uploaded?
No. OCR still downloads tesseract + traineddata from a file host on first use.
Why page 1 only on PDF?
This helper is a detect-and-flatten of the first page to PNG. Multi-page destruction is the redaction tool.
Missed a number?
Fonts, stamps, and handwriting break OCR. Draw the box yourself on the redaction page.
Is the original destroyed?
No. You download a new PNG. Delete the original yourself if that was the job.