Regex for GST Number Validation in India — GSTIN Format Explained

The GST Identification Number (GSTIN) is a 15-character code assigned to every business registered under India's Goods and Services Tax regime. Because a GSTIN literally embeds a PAN inside it, its format is more structured — and more useful to validate with regex — than most Indian identifiers. This guide walks through the GSTIN structure, gives you a working regex, and shows JavaScript and SQL examples for validating GSTIN fields in invoicing or billing software.

Understanding the GSTIN format

A GSTIN breaks down into five parts:

• Characters 1-2 — a 2-digit state code (01 for Jammu & Kashmir through 38 for Ladakh, per the GST Council's list).
• Characters 3-12 — the 10-character PAN of the registered business (AAAAA9999A format).
• Character 13 — entity number, representing the count of registrations for that PAN within the state (1-9, then A-Z).
• Character 14 — always the letter Z, reserved by default.
• Character 15 — a checksum character, either a digit or a letter.

An example valid GSTIN is 27AAPFU0939F1ZV.

The GSTIN regex pattern

^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z]{1}[1-9A-Z]{1}Z[0-9A-Z]{1}$

This encodes all five segments in order: state code, PAN letters, PAN digits, PAN check letter, entity code, fixed Z, and final checksum character.

JavaScript example

function isValidGSTIN(gstin) {
  const gstinRegex = /^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z]{1}[1-9A-Z]{1}Z[0-9A-Z]{1}$/;
  const normalized = gstin.trim().toUpperCase();
  return gstinRegex.test(normalized);
}

console.log(isValidGSTIN("27aapfu0939f1zv")); // true
console.log(isValidGSTIN("27AAPFU0939F1XV")); // false - 14th char must be Z
console.log(isValidGSTIN("7AAPFU0939F1ZV"));  // false - state code needs 2 digits

Validating GSTIN in PostgreSQL

If you store GSTINs in a customer or vendor table, you can add a CHECK constraint so invalid values are rejected at the database level:

ALTER TABLE vendors
ADD CONSTRAINT valid_gstin
CHECK (gstin ~ '^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z]{1}[1-9A-Z]{1}Z[0-9A-Z]{1}$');

Limitations of regex validation

• Regex cannot verify the checksum digit is mathematically correct — that requires implementing the GSTIN checksum algorithm separately.
• Regex cannot confirm the state code prefix maps to a real, currently valid GST state code.
• Regex cannot tell you whether the GSTIN is active, cancelled, or suspended — only the official GST Portal search or a verification API can confirm registration status.

Use regex as a fast first-pass filter in your form, then confirm anything transaction-critical against the GST Portal.

Frequently Asked Questions