Validate a GSTIN
Check a 15-character GSTIN's structure: state code, embedded PAN, entity number, the literal Z, and a checksum slot.
Last updated
Matches
- 29ABCDE1234F1Z5
- 22AAAAA0000A1Z5
Doesn’t match
- 29ABCDE1234F1Y5
- 9ABCDE1234F1Z5
- 29abcde1234f1z5
Why it’s written this way
A GSTIN packs several fields into 15 fixed positions: \d{2} for the state code, then [A-Z]{5}\d{4}[A-Z] — exactly the shape of a PAN number — embedded in the middle, followed by [1-9A-Z] for the entity number a business gets when it registers more than one GSTIN against the same PAN.
The literal Z is required at position 14 by the GST format spec; it isn't a placeholder character. The final [0-9A-Z] slot holds a checksum character that this pattern accepts the shape of but does not compute.
Edge cases to know
- →The trailing character is a checksum digit calculated from the other 14 — this pattern allows any letter or digit there, so a GSTIN with the wrong checksum still matches.
- →It doesn't verify that the embedded 10-character PAN portion is itself a real, issued PAN — that's a separate check against the same rules as the standalone PAN pattern.
- →State codes are two-digit numbers assigned by the GST Council — this pattern accepts any two digits, including ones not currently allocated to a state or union territory.
Part by part
- ^\d{2}
- The state code, two digits identifying the jurisdiction that issued the registration.
- [A-Z]{5}\d{4}[A-Z]
- The PAN of the registered entity, embedded whole — which is why a GSTIN and its holder's PAN are always consistent.
- [1-9A-Z]
- The entity number: which registration this is for that PAN within that state. Zero is excluded because numbering starts at one.
- Z
- A literal Z in the fourteenth position. It is fixed by the specification and is the quickest way to spot a mistyped GSTIN.
- [0-9A-Z]$
- The final checksum character, computed from the preceding thirteen.
Common mistakes
^[0-9A-Z]{15}$Fifteen alphanumerics accepts any string of the right length, discarding every structural rule — the embedded PAN, the fixed Z, and the state code all stop being checked.
^\d{2}[A-Z]{5}\d{4}[A-Z][1-9A-Z]Z[0-9A-Z]$^\d{2}[A-Z]{5}\d{4}[A-Z][0-9A-Z]Z[0-9A-Z]$Allowing zero as the entity number accepts a value that is never issued, since registrations within a state are numbered from one upward.
^\d{2}[A-Z]{5}\d{4}[A-Z][1-9A-Z][A-Z][0-9A-Z]$Treating the fourteenth character as any letter loses the strongest single check in the format. That position is always Z, and a different letter there means the number is wrong.
Questions
Why is there a PAN inside a GSTIN?
Because GST registration is tied to the entity's tax identity. Characters three to twelve are exactly the holder's PAN, so the two can be cross-checked against each other without any external lookup.
What does the state code tell me?
Which state or union territory issued the registration — 27 is Maharashtra, 29 Karnataka, 07 Delhi, and so on. A business registered in several states has a separate GSTIN for each, all sharing the same PAN.
Can I validate the checksum offline?
Yes, unusually for an Indian identifier. The final character is computed with a documented modulus-36 algorithm over the first fourteen, so a full offline check is possible and worth doing before any lookup.
Does a valid GSTIN mean the business is active?
No. Registrations get cancelled and suspended, and the number remains well-formed either way. The GST portal's search is the only way to confirm current status.