Validate a PAN number
Check an Indian Permanent Account Number against its published 10-character shape: five letters, four digits, one letter.
Last updated
Matches
- ABCDE1234F
- AAAPL1234C
Doesn’t match
- abcde1234f
- ABCD1234F
- ABCDE12345
Why it’s written this way
A PAN is always 10 characters in a fixed layout — [A-Z]{5} for the first five letters, \d{4} for the four digits in the middle, and a single trailing [A-Z] — and the anchors make sure nothing shorter or longer than that can pass.
The pattern is case-sensitive on purpose: real PAN cards are issued in uppercase, so a lowercase value typed into a form is a sign it needs re-entering, not a formatting quirk this pattern should tolerate.
Edge cases to know
- →The fourth letter of a real PAN encodes the holder type (P for individual, C for company, and so on) — this pattern accepts any letter there and doesn't check that it's a defined code.
- →Matching the format is not the same as the PAN being issued — only the Income Tax Department's own verification service can confirm that.
- →It won't accept a PAN typed with a lowercase letter or extra whitespace — normalize the input (trim, uppercase) before testing it against this pattern.
Part by part
- ^[A-Z]{5}
- Five uppercase letters. The fourth is the holder type and the fifth is the first letter of the surname, so these positions carry meaning rather than being arbitrary.
- \d{4}
- Four digits, a sequence number within the series.
- [A-Z]$
- A single trailing letter, which is a checksum character derived from the rest of the number.
Common mistakes
^[A-Za-z]{5}\d{4}[A-Za-z]$Accepting lowercase means the same PAN can be stored in several forms, so lookups and comparisons miss. Uppercase the input first, then validate against the uppercase pattern.
^[A-Z]{5}[0-9]{4}[A-Z]{1}$ without anchorsUnanchored, a valid PAN embedded in a longer string passes, so pasted text with surrounding characters is accepted and stored with them attached.
^[A-Z]{5}\d{4}[A-Z]$ treated as proof of identityThe pattern confirms only the format. A well-formed PAN that belongs to nobody looks identical to a real one, and treating the check as verification is a compliance failure rather than a coding one.
Questions
What does the fourth letter mean?
It encodes the holder type — P for an individual, C for a company, H for a Hindu undivided family, F for a firm, and several others. It is a useful sanity check when you already know what kind of entity you expect.
Does the fifth letter have to match the surname?
For individuals it is the first letter of the surname as recorded by the tax department, which is not always the surname the user gives you. Treat a mismatch as a prompt to re-check rather than a rejection.
Can I verify a PAN is genuine?
Not from the string. The final character is a checksum, but the algorithm is not published, so there is no offline validation. Only the income tax department's verification service can confirm a PAN exists and matches a name.
Is a PAN sensitive data?
Yes. It is a government identifier tied to financial records, so it should be treated like any other identity number: collected only when required, stored encrypted, masked in interfaces, and never written to logs.