Guide

Validating Indian IDs with regex

Aadhaar, PAN, GSTIN, UPI ID, IFSC, MICR — Indian software almost always validates one or more of these. This guide gives the right regex for each, explains what regex can't check (and how to validate the rest), and links to ready-to-use code.

Aadhaar number

The Unique Identification Authority of India (UIDAI) issues 12-digit Aadhaar numbers. Per UIDAI specs, the first digit cannot be 0 or 1.

^[2-9]\d{11}$

This matches the shape but allows roughly 8 × 10^11 = 800 billion possibilities. Only a tiny fraction are real Aadhaars. The real test is the Verhoeff checksum on the digits — a documented algorithm UIDAI uses to verify validity.

For display, Aadhaar is commonly formatted with spaces:

^[2-9]\d{3}\s\d{4}\s\d{4}$

And for privacy, masked Aadhaar shows only the last 4 digits:

^X{4}\s?X{4}\s?\d{4}$

See our Aadhaar pattern page for spaced, masked, and VID variants.

PAN (Permanent Account Number)

PAN is the 10-character income tax identifier issued by the Income Tax Department.

^[A-Z]{5}[0-9]{4}[A-Z]$

The 4th character encodes the entity type:

P — Individual person
C — Company
H — Hindu Undivided Family (HUF)
F — Firm
A — Association of Persons (AOP)
T — Trust
B — Body of Individuals (BOI)
L — Local authority
J — Judicial person (artificial)
G — Government

To require an individual PAN specifically:

^[A-Z]{3}P[A-Z][0-9]{4}[A-Z]$

The 5th character is the first letter of the holder's surname (for individuals) or entity name. Doesn't get checked by regex; it's just shape.

GSTIN

15-character Goods and Services Tax Identification Number.

^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$

Format breakdown:

Positions 1-2: 2-digit state code (01-37 with some unused)
Positions 3-12: 10-character PAN of the entity
Position 13: Entity number (1-9, A-Z)
Position 14: Z (fixed, reserved)
Position 15: Check digit (numeric or letter)

Like Aadhaar and PAN, the last character is a checksum — regex alone doesn't validate it. Run the documented mod-36 algorithm for that.

UPI ID (VPA)

Virtual Payment Address used by UPI apps.

^[a-zA-Z0-9.\-_]{2,256}@[a-zA-Z][a-zA-Z]{2,64}$

The local part allows alphanumerics, dots, hyphens, underscores. The PSP (Payment Service Provider) is letters-only and at least 3 characters. Common PSPs:

@oksbi, @okicici, @okhdfcbank, @okaxis — Google Pay (PSP-prefixed)
@paytm — Paytm
@ybl — PhonePe
@apl — Amazon Pay
@upi — generic
@axl — Axis

IFSC code

11-character bank branch identifier required for NEFT, RTGS, and IMPS transfers.

^[A-Z]{4}0[A-Z0-9]{6}$

Positions 1-4: Bank code (SBIN, HDFC, ICIC, etc.)
Position 5: 0 (fixed, reserved for future)
Positions 6-11: Branch identifier (alphanumeric)

The bank code is always 4 letters. If you want to validate against a specific bank, replace the bank code:

^SBIN0[A-Z0-9]{6}$    // SBI only
^HDFC0[A-Z0-9]{6}$    // HDFC only

MICR code

9-digit Magnetic Ink Character Recognition code at the bottom of cheques.

^\d{9}$

Structure (not validated by the regex):

Digits 1-3: City code (matches the PIN code's first 3 digits)
Digits 4-6: Bank code
Digits 7-9: Branch code

Indian mobile number

10 digits starting with 6, 7, 8, or 9 per current TRAI rules.

^[6-9]\d{9}$

With optional +91 country code:

^(\+91[\-\s]?|0)?[6-9]\d{9}$

PIN code

6-digit India Post pincode, cannot start with 0.

^[1-9]\d{5}$

First digit identifies the postal region: 1-2 = North, 3-4 = West, 5-6 = South, 7-8 = East, 9 = Army Postal Service.

Vehicle registration

Standard Indian vehicle plate: state code + RTO number + series letters + number.

^[A-Z]{2}[\s\-]?\d{1,2}[\s\-]?[A-Z]{1,3}[\s\-]?\d{4}$

Examples: MH12AB1234 (Maharashtra), DL01C5678 (Delhi), KA-05-MJ-9999 (Karnataka).

New Bharat (BH) series plates have a different format:

^\d{2}[\s\-]?BH[\s\-]?\d{4}[\s\-]?[A-Z]{2}$

What regex can't validate

For all the above, regex is necessary but rarely sufficient:

Aadhaar/PAN/GSTIN have checksums — verify with the documented algorithm.
IFSC: shape is checkable; whether the branch actually exists requires the RBI master directory.
UPI ID: shape is checkable; whether it's a real account requires hitting the UPI API.
Mobile number: shape is checkable; whether it's an active SIM requires a telco lookup.

For production validation, use regex as the first filter and a real check (API or checksum algorithm) for the final verdict.

All 104 India patterns

The full collection — including TAN, HSN, SAC, voter ID, passport, driving licence, CIN, DIN, LLPIN, EPF UAN, ESI, FSSAI, state-specific vehicle plates, ABHA Health ID, PRAN, and more — is in the pattern library. Each has a dedicated page with examples, gotchas, and copy-ready code.