Two IDs, two different checks, zero government lookups
PAN and GSTIN get pasted into every invoice, every vendor form, every “just send the GST number on WhatsApp.” A single swapped character is how a GSTR and a purchase book stop talking to each other. I wanted a typo gate that does not pretend to be the Income Tax Department or the GST portal. This tab does not call NSDL, does not call GSTN, and is not KYC. A pass means the string looks like the identifier it claims to be. It does not mean anyone issued it, that it is active, or that it belongs to the person in the email signature.
PAN is shape only — ABCDE1234F, not a person
A PAN is ten characters: five letters, four digits, one letter. The placeholder I use everywhere on this site is ABCDE1234F. Paste it. The strip should say the format matches. That is deliberate. I am not going to invent a “real” PAN for a fictional taxpayer so a scraper can treat this page as a directory. On an issued PAN, the fourth letter encodes the holder type — P for an individual, C company, H HUF, F firm, and a short list of others. ABCDE1234F has a D in that slot, which is not that vocabulary. The regex still passes, because this tool does not enforce the Income Tax Department’s fourth-letter list. That is the point: format is not issuance.
Worked example: PAN typos the regex should catch
ABCDE1234 — nine characters, last letter missing — invalid. ABCDE12345 — last character is a digit — invalid. ABCD11234F — a digit landed in the five-letter block — invalid. Spaces and lowercase get normalised; abcde1234f is treated as the placeholder shape. If payroll’s Excel column ate a letter, this is the thirty-second check before you file.
GSTIN is fifteen characters with a check digit
Read a GSTIN left to right. Two digits for the state code, then the ten-character PAN, then an entity character (same PAN can have more than one GSTIN in a state), then a Z by default, then a check character computed from the first fourteen. Example shape, built on the same placeholder PAN: 29ABCDE1234F1ZW. 29 is the Karnataka state code in the usual numbering; ABCDE1234F is not someone’s PAN; 1 is an entity slot; Z is the default; W is the check character that belongs to that fourteen-character prefix. Paste it and you should see a checksum pass. You should not see a taxpayer. I computed W from the same formula the script uses. GSTN did not tell me anything. There is no GSTN API on this page.
Worked example: GSTIN checksum fail versus format fail
Change only the last character: 29ABCDE1234F1Z5. The first fourteen still look like a GSTIN. The check character is wrong (it should be W). That is a checksum fail — classic mistype when copying from a stamp or a low-contrast PDF. Now break the pattern: drop to fourteen characters, or put something other than Z in the fourteenth slot. Format fail, checksum not even reached. State code 27 (Maharashtra) with the same placeholder core is a different fifteen-character string and a different check character. Do not “fix” a vendor GSTIN by swapping state codes because the city on the letterhead changed. Ask for the GSTIN from the GST portal login they control.
Where the real lookup lives
Confirming a PAN belongs to a name is an Income Tax / NSDL process. Confirming a GSTIN is registered, active, or cancelled is a GST portal process. Those sites exist. This one does not wrap them. Wrapping them would mean sending the identifier to someone else’s servers, which is the opposite of why the checksum tools on this site exist. Same philosophy as the Aadhaar checksum page: catch the typo, refuse the KYC cosplay. If you need legal certainty, use the government surface that actually holds the register.
Does a green PAN mean NSDL issued it?
No. This page only checks the ten-character shape (five letters, four digits, one letter). Issuance is an Income Tax / NSDL question, not this tab.
Does a green GSTIN mean the GST portal knows this taxpayer?
No. Format plus a check character on the first fourteen. Active / cancelled / suspended status lives on gst.gov.in, which this page does not call.
Why can a placeholder like ABCDE1234F pass PAN?
It matches AAAAA9999A. The fourth letter on a real PAN encodes entity type (P person, C company, H HUF, …). This regex does not enforce that vocabulary.
What is inside a 15-character GSTIN?
Two-digit state code, ten-character PAN, an entity character, a default Z, then a check character. Example shape: 29ABCDE1234F1ZW — still not a registered GSTIN.
Is this KYC?
No. Same idea as the Aadhaar checksum tool: catch typos before a form. Do not onboard a vendor because a checksum passed.
Does the value leave this browser?
No. Uppercasing and spaces are stripped in the tab. Watch the compute log; there is no NSDL or GSTN hop.