Regex for CUSIP (security ID)
9-character CUSIP — North American security identifier.
The CUSIP (security ID) regex is ^[0-9A-Z]{9}$ — copy it below, or open it in the explainer for a token-by-token breakdown.
The pattern
^[0-9A-Z]{9}$
Token-by-token breakdown
Every part of the pattern, left to right:
| Token | Meaning |
|---|---|
^ | start of string (or line in multiline mode) |
[0-9A-Z]{9} | exactly 9 times: any of: digits, uppercase letters |
$ | end of string (or line in multiline mode) |
About this pattern
Identifier formats like UUIDs, hashes, and version strings have well-defined structures that regex captures cleanly. The pattern verifies format; checksums and validity against a registry need additional checks.
Quick usage in different languages
This exact pattern — with the correct escaping and idioms for each language:
- JavaScript:
/^[0-9A-Z]{9}$/.test(value) - Python:
re.match(r"^[0-9A-Z]{9}$", value) - Java:
Pattern.compile("^[0-9A-Z]{9}$").matcher(value).matches() - C# / .NET:
Regex.IsMatch(value, @"^[0-9A-Z]{9}$") - Go:
regexp.MustCompile(`^[0-9A-Z]{9}$`).MatchString(value) - Ruby:
/^[0-9A-Z]{9}$/.match?(value) - PHP:
preg_match('~^[0-9A-Z]{9}$~', $value)
The explainer’s Code tab regenerates these for any pattern you paste, and the downloadable cheat sheet bundles the breakdown, all seven snippets, and the pitfalls below onto one printable page.
Common pitfalls
- Anchored to the whole string. This pattern uses ^ and $, so it requires the entire input to match. To find it inside a longer text, drop the anchors and use the global (g) flag.
- Uppercase only. Ranges like [A-Z] won't match lowercase. Add a-z (or the i flag) if lowercase input should be accepted.
- Validate beyond format. Matching the format doesn't guarantee the value is real. Confirm the cusip (security id) against a source of truth (database, API, or checksum) where it matters.
Standards & sources
This pattern is based on the following authoritative specification(s) and issuing authorities. Formats can change — always confirm against the primary source.
Related patterns
More patterns in the Codes & IDs category:
- UUID / GUID
- Semver range (npm style)
- UUID v4 specifically
- Generic API key
- Semantic version
- SSH public key
See also
Browse all 300 patterns in the library, or open this regex in the interactive explainer to see a token-by-token breakdown, test against custom input, and generate code in seven languages.