Pattern

Regex for GSTIN

15-character Goods and Services Tax Identification Number.

The pattern

^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$

Try in explainer →

What it matches

27AAPFU0939F1ZV
22BOSPC9911H1Z5
29ABCDE1234F1Z5

What it doesn't match

27aapfu0939f1zv
27AAPFU0939F1Z
ABCDE12345F1ZV

Notes & gotchas

Format: 2-digit state code + 10-char PAN + 1-digit entity number + Z (fixed) + 1 check digit. State codes range 01–37 (with some unused). Issued by GST authorities after registration.

Code in your language

Use the explainer's Code tab to generate ready-to-paste snippets in JavaScript, Python, Java, .NET, Go, Ruby, and PHP for this pattern.

Open in explainer →

About this pattern

India-specific identifiers are governed by various authorities (UIDAI for Aadhaar, Income Tax Dept for PAN, RBI for IFSC, GSTN for GSTIN, etc.). Regex confirms format; for definitive validation, integrate with the issuing authority's verification API.

Quick usage in different languages

Once you've validated a candidate value matches this pattern, you'll typically use it inside your application code. Each language has its own regex syntax:

JavaScript: new RegExp(pattern).test(value)
Python: re.match(pattern, value) with raw strings: r"pattern"
Java: Pattern.compile(pattern).matcher(value).matches()
C# / .NET: Regex.IsMatch(value, pattern)
Go: regexp.MustCompile(pattern).MatchString(value) — Go uses RE2 so some advanced features aren't available
Ruby: value =~ /pattern/ or pattern.match?(value)
PHP: preg_match('/pattern/', $value)

The explainer's Code tab generates these for any pattern you paste — including the right escaping and idioms for each language.

Common pitfalls

Anchors matter. If the pattern uses ^ and $ it expects the entire input to match. To find this pattern inside a longer text, remove the anchors and use the /g flag.
Case sensitivity. Letter ranges like [A-Z] only match uppercase. Use the i flag or [A-Za-z] for case-insensitive matching.
Escape user input. If you're building a regex from a string variable, escape regex metacharacters first to avoid bugs or injection.
Performance. For this specific pattern the risk is low, but be cautious of nested quantifiers when adapting it — they can cause exponential backtracking on adversarial input.