GSTIN format explained: what the 15 characters mean

The GST law describes the number in four parts. Rule 10 of the CGST Rules says a GSTIN is made of a two-character state code, the ten characters of the holder's PAN (or TAN, for those registered only to deduct or collect tax), a two-character entity code, and one check-sum character.

The example below is the GSTIN of a public-sector body, 33AAACC1206D1ZN, which our documentation already uses because it is a published identifier and not a customer's.

One thing to hold apart: the law and the GST Council's registration flyer both split the number as 2 + 10 + 2 + 1. The reading of position 13 as a registration counter and position 14 as "Z" comes from widely repeated explainers, and we could not find it stated on an official page. It fits the real GSTINs we work with, but treat it as a convention rather than a rule.

The first two digits identify the state or union territory of the registration, not of the business's head office. A company with a Pune headquarters and a Chennai warehouse would hold one GSTIN starting 27 and a separate one starting 33.

The list on the GST e-way bill portal runs 01 to 24, then 26, 27, and 29 to 38. There is no 25 and no 28. Code 26 is Dadra and Nagar Haveli and Daman and Diu, which are now one territory; code 38 is Ladakh. Two further codes are not states: 97 is "Other Territory" and 99 is "Other Country".

Not every GST portal list is equally current. The e-invoice portal's master list still shows Daman and Diu (25) and Dadra and Nagar Haveli (26) separately, so a validator built from an old list will wrongly reject a valid 26.

Characters 3 to 12 are the PAN. That is why every GSTIN of one legal entity shares the same ten characters in the middle, and why the PAN is the key for finding all of a business's registrations.

A PAN can carry more than one GSTIN: one per state, and the GST portal also permits separate registrations for separate places of business or verticals within a state, subject to its category limits. So "one PAN, one GSTIN" is not true, and a GSTIN you have been given is one of possibly several.

For registrations made only to deduct or collect tax at source, the middle ten characters are a TAN rather than a PAN, so do not assume characters 3-12 will pass a PAN format check.

The last character exists so a mistyped number can be rejected before anyone looks it up. It is a base-36 checksum in the same family as the Luhn check on a card number. Each of the first 14 characters is given a value from 0-9 then A-Z (0 to 35), multiplied by 1 or 2 alternately starting from 1, and the product's two base-36 digits are added. The check character is whatever brings the total up to a multiple of 36.

We could not find the algorithm written down on an official GST page, which only says "one check-sum character". It is documented by third parties, and our own implementation agrees with it on real GSTINs, so the code below is "widely used and verified against real numbers" rather than "published by GSTN".

What it catches: every single-character error. We checked every possible one-character substitution on 5,000 random valid numbers and none passed. What it only mostly catches: swapping two neighbouring characters. In the same test, 0.16% of swaps still produced a number with a valid check character. So a failed check means "reject and ask again"; a passed check means only "plausibly typed correctly".

const CHARS = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';

function checkChar(first14) {
  let sum = 0;
  for (let i = 0; i < 14; i++) {
    const product = CHARS.indexOf(first14[i]) * (i % 2 === 0 ? 1 : 2);
    sum += Math.floor(product / 36) + (product % 36);
  }
  return CHARS[(36 - (sum % 36)) % 36];
}

function hasValidCheckChar(gstin) {
  return /^[0-9A-Z]{15}$/.test(gstin) && checkChar(gstin.slice(0, 14)) === gstin[14];
}

hasValidCheckChar('33AAACC1206D1ZN'); // true
hasValidCheckChar('33AAACC1206D1ZM'); // false: last character mistyped
hasValidCheckChar('33AAACC1260D1ZN'); // false: two digits swapped

A number can have a correct state code, a well-formed PAN and a valid check character and still not be anyone's GSTIN. Format validation cannot say whether it was ever issued, who holds it, whether the registration is active, suspended or cancelled, or whether the name on an invoice matches the name on record.

Those facts live only with the GST network, and they can change in a day. Checking them takes one live lookup that returns the legal name, trade name, status, taxpayer type and registration date. Do the cheap local format and check-character test first to save a call on obvious typos, then look up the rest.

UN bodies, embassies and certain other notified persons get a UIN, also 15 characters but laid out differently: a 2-digit state code, a 2-digit year, a 3-character country code, a 5-digit serial and a three-letter ending ("UIN" or "ONP"). A validator that insists on a PAN in positions 3-12 will reject these, which may or may not be what you want for a given form.