★ India · regex

Regex for PAN Card Number

A Permanent Account Number has the form AAAPA9999A. The fourth letter is the holder type (P individual, C company, H HUF, F firm, A AOP, B BOI, G government, J artificial juridical person, L local authority, T trust), the fifth is the initial of the surname or entity name, and the last letter is a check character this pattern doesn't compute.

Runs in your browser
No signup

Try the pan card number pattern

Read it in plain English (best-effort)

^start of a line
[A-Z]one character from: A–Z
{3}exactly 3 of the previous
[ABCFGHJLPT]one character from: 'A', 'B', 'C', 'F', 'G', 'H', …
[A-Z]one character from: A–Z
[0-9]one character from: 0–9
{4}exactly 4 of the previous
[A-Z]one character from: A–Z
$end of a line

Test text

One sample per line works well with the m flag on anchored patterns.

Waiting for a pattern

The pattern, piece by piece

/^[A-Z]{3}[ABCFGHJLPT][A-Z][0-9]{4}[A-Z]$/

Pattern explanation
Part	What it does
`^[A-Z]{3}`	an alphabetic series, AAA to ZZZ
`[ABCFGHJLPT]`	the holder type, e.g. P for individual, C for company
`[A-Z]`	initial of the surname or entity name
`[0-9]{4}`	a sequential number
`[A-Z]$`	an alphabetic check character

What it accepts and rejects

Every sample below is checked automatically in JavaScript and Python. The tester above is preloaded with all of them, one per line.

Should match
Should match
`ABCPE1234F`	✓
`AAACB1234C`	✓
`ZZZFZ9999Z`	✓
`BNZPM2501F`	✓
`AAAHA1234A`	✓
`AAATB1234X`	✓

Should not match
Should not match
`ABCDE1234F`	✗
`abcpe1234f`	✗
`ABCP1234F`	✗
`ABCPE12345`	✗
`ABCPE1234`	✗
`1BCPE1234F`	✗

Copy it into your code

RE2-safeNo lookarounds or backreferences, so the same pattern works in Go's RE2 engine and in Rust's regex crate.

Language

const panCardRe = /^[A-Z]{3}[ABCFGHJLPT][A-Z][0-9]{4}[A-Z]$/;

export function isValidPanCard(value) {
  return panCardRe.test(value.trim());
}

When not to use regex for this

The format can't tell you the PAN is real or belongs to the person. For KYC, verify through an authorised PAN verification service, and uppercase input before validating.

Questions engineers actually ask

Why does ABCDE1234F fail?

It's the example everyone uses, but D isn't a valid holder-type letter, so a real PAN can't have it in fourth position.

Does it validate the check letter?

No. The last character is a check letter whose algorithm isn't published, so only an official verification can confirm it.

What is catastrophic backtracking?

Some patterns, usually nested quantifiers like (a+)+, make a backtracking engine try an exponential number of paths on input that almost matches. The tester stops any run after 300ms, so a bad pattern can't freeze your tab. In production, that same pattern can take down a server (a ReDoS attack).