PAN and Aadhaar Format Rules Explained (and Why Format Isn't Proof)

If you handle Indian identity documents, you have probably seen a PAN or an Aadhaar number and wondered whether it is real. Format validation is a fast, useful first filter — but it is easy to misunderstand what it actually proves. This article explains the rules and, just as importantly, their limits.

The structure of a PAN

A Permanent Account Number (PAN) is a ten-character alphanumeric code issued by the Income Tax Department. It follows a fixed pattern: five letters, four digits, and a final letter. The characters are not random — several positions carry meaning.

• The first three characters are a sequence of letters from AAA to ZZZ.
• The fourth character indicates the holder type, such as 'P' for an individual person.
• The fifth character is the first letter of the holder's surname or entity name.
• The next four characters are digits, followed by a single check letter.

A well-formed PAN respects all of these constraints. A string that is the wrong length, mixes the letter and digit blocks, or uses an invalid holder-type character can be rejected immediately as malformed.

The structure of an Aadhaar number

An Aadhaar number is a twelve-digit number. Crucially, the final digit is a checksum computed from the preceding digits using the Verhoeff algorithm. That means not every twelve-digit string is a valid Aadhaar — the digits must satisfy the checksum.

What a checksum does

A checksum is a small piece of redundancy that lets software detect typos and simple fabrications. If someone changes one digit or swaps two adjacent digits, the Verhoeff check usually fails. This is the same family of technique used in credit-card numbers. It catches accidental errors well and blocks the laziest fakes.

A checksum answers 'could this number be valid?' It never answers 'was this number issued to this specific person?'

Format validation versus real verification

Here is the point that trips people up. Passing a format and checksum test means a number is plausible. It does not mean the number exists in any government database, nor that it belongs to the person presenting it. Real verification requires an authorised, consent-based check against official systems — something only permitted entities can perform, under strict rules.

VerifyDocs deliberately performs format validation only. We do not connect to government databases, and we never claim that a well-formed number is 'verified'. Treating a format check as identity verification is both technically wrong and, depending on context, legally risky.

How to use format checks responsibly

1. Use format validation to catch obvious data-entry errors and malformed inputs early.
2. Never store more identity data than you actually need.
3. For genuine verification, route the request through an authorised KYC provider with proper consent.
4. Tell users clearly when you are only checking format, not identity.

Used this way, a format checker is a helpful hygiene tool: it improves data quality and blocks careless mistakes, while staying firmly on the right side of privacy and compliance expectations.