What a UPI ID looks like

The two halves

arunsharma@okaxis
└─── local ───┘└ handle ┘

The local part identifies you within the issuer. It might be your name, your phone number, or something the app generated. The handle names the bank that issued the address.

Together they form a globally unique address on the UPI network. When someone pays arunsharma@okaxis, UPI routes the request to Axis Bank, which resolves it to the underlying account and returns the verified account-holder name to the payer’s app.

“VPA” — Virtual Payment Address — is the same thing under its technical name. NPCI documentation says VPA; apps say UPI ID.

What the handle does and does not tell you

This is the part that misleads people, so it is worth stating plainly: the handle names the bank that issued the address, not necessarily the bank holding the money.

When Google Pay gives you a UPI ID, it does so through a sponsor bank — @okaxis means Axis Bank sponsored it. But the account behind it might be at Kotak, or SBI, or anywhere. Seeing @okicici tells you the person probably uses Google Pay. It tells you very little about where they bank.

The only trustworthy identity signal is the verified name your UPI app shows on the confirmation screen, which comes from the actual bank record. Full handle directory →

What characters are allowed

In the local part, banks generally accept:

• letters a–z (case-insensitive — Arun@okaxis and arun@okaxis are the same address)
• digits 0–9
• dot ., hyphen - and underscore _

Spaces, +, and most other symbols are rejected. Individual banks apply their own extra rules on length and on which characters may start or end the string, so a name accepted by one bank may be refused by another.

The handle is not yours to choose — it is fixed by whichever bank or app issues the ID.

The bank-account form

There is a second addressing form in the specification, used when there is no UPI ID at all:

123456789012@HDFC0001234.ifsc.npci
└── account ──┘└─ IFSC ──┘└ suffix ┘

This addresses a bank account directly by account number and IFSC. It is legitimate and part of the spec, but PhonePe and Paytm refuse to pay it because there is no verified payee name attached. More on bank-account addressing →

Examples you will actually see

Is it safe to share?

Yes. A UPI ID is designed to be published — that is its entire purpose. It can only receive. Nobody can pull money out of your account with it, and no amount of knowing your UPI ID lets anyone authorise a debit.

What must never be shared is your UPI PIN. Entering a PIN always sends money. If anyone tells you to enter your PIN or scan a QR code in order to receive money, you are being defrauded — the mechanics are here.

The one real consideration is that a UPI ID built from your phone number publishes your phone number. If that bothers you, create a name-based one instead. How to do that →