Indian PAN card validator
AAAPL1234C is a valid PAN for an individual: five letters, four digits and a final letter, with P in fourth place meaning a person. Paste a PAN to check its layout and see which kind of holder its fourth letter stands for. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Pan
- AAAPL1234C
- Input
- AAAPL1234C
- Formatted
- AAAPL 1234 C
- Entity code
- P
- Entity type
- Individual
An Indian Permanent Account Number (PAN) is a ten-character alphanumeric tax identifier issued under the Income Tax Department. Every PAN follows a fixed public layout: five letters, four digits, and one final letter. The fourth character is not free decoration—it encodes the holder’s entity class, such as individual, company, Hindu Undivided Family, firm, association of persons, trust, body of individuals, local authority, artificial juridical person, or government. Forms, KYC flows, payroll imports, and onboarding scripts constantly need a quick structural check before a slower registry lookup. This Indian PAN card validator normalises spaces and hyphens, enforces the official pattern, maps the fourth character to a human-readable entity type, and returns a clear valid flag with the decoded parts.
How an Indian PAN is structured and what the fourth character means
A Permanent Account Number is always exactly ten characters when separators are removed. Positions one through three are an alphabetic series chosen by the allotting system. Position four is the entity-type letter defined by the Income Tax Department: P for an individual person, C for a company, H for a Hindu Undivided Family, F for a firm, A for an association of persons, T for a trust, B for a body of individuals, L for a local authority, J for an artificial juridical person, and G for a government body.
Position five is typically the first letter of the surname for an individual or of the entity name for non-individuals. Positions six through nine are a four-digit sequence from zero zero zero one through nine nine nine nine. Position ten is a final alphabetic character assigned with the number; unlike Aadhaar’s Verhoeff digit or a Spanish DNI modulo letter, that trailing character is not a public modular checksum you can recompute from a published table, so this tool does not invent one.
Structural validation still catches the vast majority of typos: wrong length, digits in letter slots, letters in digit slots, and an entity code outside the official set.
FAQ
What is the format of an Indian PAN?
A PAN is ten characters: five letters, four digits, and one final letter (for example AAAPL1234C). Spaces and hyphens may appear in documents but are ignored by this validator.
What does the fourth character of a PAN mean?
It is the entity-type code. P is Individual, C Company, H HUF, F Firm, A Association of Persons, T Trust, B Body of Individuals, L Local Authority, J Artificial Juridical Person, and G Government.
Does this tool contact the Income Tax Department or NSDL?
No. It only checks the public structural pattern and decodes the entity-type letter. It does not prove that a PAN is allotted, active, or linked to a person.
What does the Indian PAN card validator cost?
The browser tool is free. A valid format is not proof of tax registration or identity.
Can the tool check the last letter of a PAN?
Only that it is a letter. Unlike some identifiers, the final letter of a PAN is not a public checksum that can be recalculated from a table, so the tool checks the layout and the entity code and never invents a check.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/pan-india \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"pan":"AAAPL1234C"}'const res = await fetch("https://api.kit.forhosting.com/enc/pan-india", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"pan": "AAAPL1234C"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/pan-india",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"pan": "AAAPL1234C"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/pan-india", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"pan":"AAAPL1234C"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"pan":"AAAPL1234C"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/pan-india", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"pan": "AAAPL1234C"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.pan_india",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Completely malformed strings fail with invalid_input instead of inventing a number. Use it free in the browser or call the KIT API at the published price; both paths run the same deterministic rules with no NSDL or UTIITSL network call.
How an Indian PAN is structured and what the fourth character means
When the pattern matches and the fourth character is one of the ten known codes, valid is true and entity_type names the class. When the pattern matches but the fourth letter is not a recognised entity code, valid is false and entity_type is Unknown so callers can highlight the fourth character without treating the whole string as garbage. Completely broken input never returns a synthetic PAN; it raises invalid_input with a message that names the length or character-class problem.
Input contract, response fields, and how validation behaves
Spaces, dots, hyphens, underscores, and slashes are stripped and letters uppercased before the pattern check, so values such as AAAPL one two three four C or AAA-PL-1234-C still parse. After normalisation the engine requires the regular expression five uppercase letters, four digits, one uppercase letter. POST a JSON body with one required string field named pan. Aliases text, input, value, number, s, and id are accepted so thin clients and generic text boxes can reuse the same endpoint without renaming fields. On success the response echoes the trimmed original input, the cleaned pan string, a display formatted field with spaces around the digit block, valid true or false, entity_code as the single fourth character, entity_type as the decoded English label, series as the first three letters, name_initial as the fifth character, sequence as the four digits, check_letter as the tenth character, length ten, scheme pan_india, and entity_codes listing the official fourth-character alphabet for client-side legends. Empty strings, missing pan, pure numbers, wrong lengths, mixed illegal characters, and patterns that are not five-plus-four-plus-one raise invalid_input and are not billed. Because the path is pure parse with no clock, random source, or network, the same input always yields the same JSON on the free browser tool and on the API. Successful calls cost the published base price of $0.002 per item; the in-browser tool remains free for interactive checks. Prefer this specialised endpoint when you need the entity type decoded in the response body, not only a boolean from a generic multi-country tax-id checker.
Where PAN format checks fit KYC, payroll, and data pipelines
Onboarding and KYC forms for Indian customers often ask users to type a PAN before e-sign or bank linkage. Content sites ranking for indian pan card validator or pan format checker benefit from a live tool whose free browser path matches the paid automation path byte-for-byte. Do not treat a passing structural check as proof of identity, allotment, tax filing status, or authorisation to act on someone’s behalf—it only proves the digit-and-letter string is consistent with the public PAN layout and a recognised entity-type code. Validating the ten-character pattern and the entity-type letter at the browser or API edge blocks obvious typos before a record is written and before any downstream tax or payments service is called. Payroll and HR imports receive employee identifiers from spreadsheets where a single swapped digit would reject a whole batch; a deterministic oracle that returns pan, valid, and entity_type lets importers flag rows without calling government portals for every line. Integration tests for OCR pipelines can assert that a cleaned ten-character string either validates or is rejected with a clear invalid_input message when noise remains.
Integration use cases
Gate PAN fields on web and mobile forms
When a user submits a PAN, validate the five-four-one pattern and show entity_type so individuals and companies are labelled correctly before the form is saved.
Score rows in payroll and CRM imports
Batch-check every PAN column, quarantine rows where valid is false or invalid_input is raised, and keep entity_code for segment reports.
Build synthetic PAN fixtures for tests
Generate well-formed sample strings with known entity codes and assert that the API returns the expected entity_type and valid true in golden tests.
Technical questions
What happens if the fourth letter is not a known entity code?
If the overall pattern still matches five letters, four digits, and one letter, the response returns valid false and entity_type Unknown. Completely malformed strings fail with invalid_input.