In many Indian homes, official papers have never been treated as ordinary paper. School certificates are wrapped in plastic. Degrees are placed in a bank locker. Vehicle papers live in the glove compartment, accompanied by photocopies made for the next office that may ask for them. What families fear most is losing proof.
DigiLocker addresses that older problem in a distinctly modern way. It gives a citizen access to records that can be traced to the authority that issued them. A driving licence fetched from the transport database, or a marksheet delivered through the National Academic Depository, is an issuer-backed digital record with a verifiable origin, unlike a photograph saved on a phone.
India formally launched DigiLocker on 1 July 2015. Among the public-document services reviewed here, that predates Poland’s mObywatel app in 2017, Ukraine’s Diia app in 2020 and Italy’s first public release of Documenti su IO in December 2024. A PIB release dated 8 September 2026 reported more than 735.3 million DigiLocker registered users. These are registrations, not a count of regular users. The US services and EU framework reviewed below serve different functions and are compared within that stated scope.
More than a place to keep scans
A cloud drive can store a PDF of a certificate. It cannot, by itself, tell a university, insurer or government office whether that PDF came from the issuing authority or was altered after it was uploaded. DigiLocker separates two things that are easily confused.
The first is an issued document. An authorised organisation makes the record available through the DigiLocker ecosystem, normally as a link to the original repository. The second is a file uploaded by the user. That may be useful as a personal copy, but uploading it does not convert it into an issuer-verified record.
The law recognises the difference. Rule 9A of the Information Technology (Preservation and Retention of Information by Intermediaries Providing Digital Locker Facilities) Rules, 2016 provides that documents issued and shared through DigiLocker may be accepted at par with the corresponding physical documents. The National Academic Depository explains the same principle for digital academic awards. The issuer remains the custodian of the record; a verifier can check it with the holder’s consent.
This makes DigiLocker part document wallet, part exchange network and part trust infrastructure. Its practical value appears when the receiving institution accepts the digital record and verifies it at source. If a counter still insists on a stamped photocopy, the technology has reached the phone but not the final desk.
That wider question informs my proposed National Digital Trust Infrastructure for verified records and citizen-controlled access across services.
The scale is large, but the numbers need labels
The latest official figures available at this article’s 26 September 2026 research cut-off put DigiLocker above 73.53 crore registered users, or 735.3 million, and 936.03 crore issued documents, roughly 9.36 billion. A separate government statement reported 2,822 onboarded issuers. These figures establish extraordinary reach and institutional breadth.
They cannot tell us how many registrants use the platform regularly. A Rajya Sabha answer using a 31 July 2026 cut-off recorded 72.43 crore registered users, 72.86 crore document-access transactions during the preceding three years, and 5,437 document types or services on the platform, including 661 from the Union government and 4,776 from states.
The access figure is meaningful, but it is not a monthly-active-user count. Dividing it by the current registration total would also misdescribe a typical user: registrations grew during those three years, some people used the service repeatedly, and others may have opened an account without returning. The evidence supports a narrower conclusion. DigiLocker has population-scale enrolment and a wide catalogue; the published data cited here do not show how regularly the median registrant uses it.
Sources: PIB release 2307925 (8 September 2026), “The Foundation of India’s FinTech Success”, “Digital Identity and Documents”, for registrations and issued documents; PIB release 2295635 (6 August 2026), DigiLocker bullet under “Services delivery through Digital Public Infrastructure”, for 2,822 onboarded issuers; and PIB release 2298116 (12 August 2026), the first two data paragraphs, for the 31 July 2026 registration, access-transaction and catalogue figures from the Rajya Sabha reply of 7 August. These reports use different dates and measures; none supplies a monthly-active-user count.
Better public reporting would include monthly and annual active users, successful document fetches by category, failure rates, consented sharing events, account-recovery outcomes and rural-urban usage. None of this diminishes the achievement. It would show where the system is indispensable and where a large registration number is masking friction.
How India reached national scale
DigiLocker was launched on 1 July 2015 under Digital India. Its growth did not begin from an empty field. The first Aadhaar number had been issued in September 2010, and Direct Benefit Transfer began in January 2013. Both systems expanded substantially after 2014. UPI followed in 2016. These dates matter because public infrastructure is usually cumulative: one administration may begin a layer, another may extend it, and institutions must keep it working long after a launch event.
Sustained political backing from the Modi government helped DigiLocker move from an initiative to national infrastructure. The operating achievement belongs to a wider system: the Ministry of Electronics and Information Technology, the National e-Governance Division and Digital India Corporation, Union and state departments, education boards, universities, transport authorities, regulators and thousands of participating issuers.
Academic records show how that network effect works. DigiLocker became the operational platform for the National Academic Depository, which was designated the sole national depository in 2020. A student can receive an issuer-backed marksheet or degree, share it with a consenting verifier and, where supported, use the e-Sanad connection for electronic verification, attestation or apostille. The value lies less in the app icon than in the agreements, data connections and legal recognition behind it.
Aadhaar is important to this architecture, but its role should not be overstated. DigiLocker’s official FAQ says an account can be created with a mobile number or an Aadhaar number. Aadhaar linking, and access to the mobile number associated with Aadhaar, remains important for Aadhaar-based identity matching and for retrieving records in flows that depend on it. That distinction is especially relevant for people whose phone number, name or date of birth differs across databases.
Where it changes an ordinary day
The clearest test of digital government is a small moment that used to consume half a day. A motorist can present an eligible digital driving licence or registration certificate. A student can retrieve a board certificate years after an examination. An insurer or financial institution can verify a document with permission instead of relying on an emailed scan. A pensioner can keep an electronic pension payment order in the same account.
These routine transactions reveal the value of the system. The burden of paper falls most heavily on people who have the least time and money to make repeated visits: a worker who loses a day’s wage, a student living away from the issuing board, an elderly person asked for another copy, or a family rebuilding records after a flood or fire.
DigiLocker also changes the verifier’s side of the exchange. When a record can be checked against its issuer, the receiving organisation spends less time inspecting stamps and photocopies. Fraud becomes harder, although never impossible. Applications can be pre-filled, errors can be discovered earlier and a citizen need not surrender more information than the transaction requires.
The last promise still needs work. A good digital wallet should support selective disclosure: proving that a person is over a required age without revealing a full date of birth, for example. It should also make every request intelligible before consent is given. “Share” is not meaningful consent if the screen does not identify the requester, the fields requested, the purpose and the retention period.
India moved earlier and reached further
A dedicated public-document wallet can be assessed by its issuer network, access to authentic records, recognised uses and user control. This comparison reviews DigiLocker, mObywatel, Diia and Italy’s Documenti su IO, alongside the EU Digital Identity framework and the US services specified below. Their launch dates and official adoption measures are reported separately through the 26 September 2026 research cutoff.
DigiLocker launched in July 2015. Poland made mObywatel available in 2017. Ukraine presented the Diia mobile app in 2020. Italy opened the first release of its IT-Wallet documents to all adult citizens and residents in December 2024. The European Union’s common framework requires member states to offer interoperable wallets by the end of 2026. This sequence places India years ahead of several systems now described as European digital-wallet successes.
The official measures show substantial reach, but use different definitions and dates. A PIB release dated 8 September 2026 reported more than 735.3 million DigiLocker registrations and 9.3603 billion issued documents. Poland reported 12 million mObywatel users on 26 May 2026, and the same release said 12 million people had activated mDowód. Italy reported more than 10 million IT-Wallet activations and 17.3 million loaded documents on 17 February 2026. Ukraine’s ministry reported more than 24 million Diia app users on 25 May 2026; an official Diia release dated 15 July 2026 listed 34 digital document types. These figures describe registrations, reported users, activations, document stocks and document types. They do not establish a common active user ranking or a worldwide first or largest claim.
Comparison sources: PIB (8 September 2026); Poland’s Ministry of Digital Affairs (26 May 2026); Italy’s Department for Digital Transformation (17 February 2026); Ukraine’s Ministry of Digital Transformation (25 May 2026) and Diia (15 July 2026); GSA (3 August 2026); and NIST’s mobile driving-licence guidance. Comparison corrected on 7 October 2026 to distinguish the named systems, report dates and measures. These sources do not establish a common active-user ranking, a worldwide first or largest claim, or the absence of every possible US equivalent. The 26 September 2026 research cutoff is unchanged.
The US systems examined in this comparison were Login.gov and the state mobile driving-licence services described by NIST, with California DMV Wallet as a concrete example. GSA describes Login.gov as a common sign-in and identity-verification service for participating agencies. NIST describes mDLs as digital driving or identity credentials, including uses for identity and age verification. Within these reviewed systems, the sources did not identify a service combining DigiLocker’s multi-issuer access to government, education and other official documents. That is a conclusion about the named systems reviewed here, not an inventory of every US public or private service.
Scale creates obligations as well as convenience
A system holding links to identity, education, transport, insurance and financial records should be judged by a higher standard than an ordinary consumer app. DigiLocker describes consent-based sharing, multifactor authentication, digitally signed issued documents, encryption, activity logs, redundancy and regular audits by CERT-In-empanelled agencies. Those are necessary controls. Public confidence also depends on knowing how the controls perform.
The security record should be stated plainly. In 2020, two researchers separately reported an authentication flaw that could potentially have allowed an attacker who knew an account identifier to bypass normal checks. INCIBE-CERT reported that the flaw was fixed; DigiLocker’s public position was that user information had not been compromised. The episode does not establish a continuing weakness. It shows why clear disclosure, rapid remediation and a public record of significant incidents belong in the governance model.
India’s data-protection regime is also moving through a phased transition. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Some provisions took effect immediately; the consent-manager rule was scheduled one year later, while many core operational obligations were scheduled for eighteen months after notification, in May 2027. At the research cut-off, it would therefore be inaccurate to write as though the entire framework were already in force.
For DigiLocker, the practical questions are direct. What data is stored centrally and what remains with the issuer? How long are access logs retained? Can a citizen see, withdraw and contest permissions easily? What happens when the source database is wrong? How quickly is access restored after a phone number changes? Which remedies remain available to a person who cannot use Aadhaar-linked authentication?
Digital exclusion deserves equal attention. Smartphone access and connectivity have improved, but they are not universal. Language, disability, low digital confidence, inconsistent names and dates across databases, and dependence on a lost or reassigned phone number can turn a convenient service into another locked door. Common Service Centres and assisted channels remain important, as does the continued acceptance of physical documents. Digital access should add a route, not erase the route needed by someone who cannot use it.
What the next phase should deliver
The next phase should be measured by reliability and citizen control, not registrations alone. Government can make that standard visible through a small set of recurring disclosures:
- active-use and successful-fetch measures that are clearly defined;
- service availability, latency and document-retrieval failure rates;
- the number and age of unresolved corrections sent to issuers;
- security-audit coverage and summaries of material incidents;
- consent, revocation and account-recovery performance;
- accessibility testing across languages, disabilities and assisted channels; and
- the proportion of frontline institutions that accept eligible digital records without demanding paper again.
These disclosures would help administrators improve the system and would make international comparisons less rhetorical. They would also separate three questions that are too often blended together: how many people registered, how many could retrieve a record, and how many completed the task for which the record was needed.
DigiLocker’s most important achievement is the agreement among public institutions to issue and recognise records through a common national network. That network reduces the distance between a citizen and the proof the state already holds about them.
DigiLocker’s contribution is visible in its 2015 launch, the breadth of its issuer network and the substantial registration and document totals reported by the Government. These measures establish the reach of the reviewed platform, without establishing a comparable active-user ranking across countries. The harder test now is whether the system can become more transparent, more secure, easier to correct and genuinely usable for the person whose records or circumstances do not fit neatly into a database. If it can, DigiLocker will be more than an impressive platform. It will be an example of digital government that earns trust each time it is used.
Source note added on 7 October 2026: DigiLocker registration, document and issuer totals now have exact dated PIB locators. Registered users, accessible or issued documents, and issuer counts remain distinct measures.
