Validating Social Security Numbers Through Regular Expressions

Given those rules, let’s go over a few different methods for validation using Regular Expressions that range in severity and logic.

Basic Format Checking

^]d{3}-]d{2}-]d{4}$

Or (without dashes):

^\d{9}$

This method is about as straight-forward as possible and surprisingly it will actually validate every single possible Social Security Number out there, but the problem is that many of the values that it would accept aren't even valid values. Let's look at a simple break-down of this expression:

^ # Beginning of expression
\d{3} # Exactly three digits (denoted by \d and the {3} specifies the number)
- # An explicit 'dash'
\d{2} # Exactly two digits
- # Another explicit 'dash'
\d{4} # Exactly four digits
$ # End of expression

This doesn't take into consideration any of the previously suggested rules and exceptions that were mentioned above, but it does function to ensure that the number is in the proper format.

You can see an example of this in action below:

Interactive Example through JSBin

Actual Validation

^(?!219-09-9999|078-05-1120)(?!666|000|9\d{2})d{3}-(?!00)\d{2}-(?!0{4})\d{4}$

Or (without dashes):

^(?!219099999|078051120)(?!666|000|9\d{2})\d{3}(?!00)\d{2}(?!0{4})\d{4}$

While this may not look very fun at all, it will validate any valid Social Security Number as per the constraints (and exceptions) listed by the Social Security Administration. Let’s break this one down to see what is going on:

^ # Start of expression
(?!219-09-9999|078-05-1120) # Don't allow "219-09-999" or "078-05-1120" explicitly
(?!666|000|9\d{2})\d{3} # Don't allow the SSN to begin with 666, 000 or anything between 900-999
- # Explicit dash (separating Area and Group numbers)
(?!00)\d{2} # Don't allow the Group Number to be "00"
- # Another dash (separating Group and Serial numbers)
(?!0{4})\d{4} # Don't allow last four digits to be "0000"
$ # End of expression

This should work for just about all major cases that you want to validate for when dealing with regular expressions.

You can see an example of this in action below:

Interactive Example through JSBin

Over-The-Top Validation

^(?!b(d)1+-(d)1+-(d)1+b)(?!123-45-6789|219-09-9999|078-05-1120)(?!666|000|9d{2})d{3}-(?!00)d{2}-(?!0{4})d{4}$

Or (without dashes):

^(?!b(d)1+b)(?!123456789|219099999|078051120)(?!666|000|9d{2})d{3}(?!00)d{2}(?!0{4})d{4}$

This is an expression that I wrote that would slightly elaborate a bit more on the previous example and would handle some commonly encountered “fake” values or ones that might easily be forged in an area that might require a user to enter to enter one.

Let’s break this one down:

^ # Start of expression
(?!b(\d)1+-(\d)1+-(\d)1+b) # Don't allow all matching digits for every field
(?!123-45-6789|219-09-9999|078-05-1120) # Don't allow "123-45-6789", "219-09-9999" or "078-05-1120"
(?!666|000|9\d{2})\d{3} # Don't allow the SSN to begin with 666, 000 or anything between 900-999
- # A dash (separating Area and Group numbers)
(?!00)\d{2} # Don't allow the Group Number to be "00"
- # Another dash (separating Group and Serial numbers)
(?!0{4})\d{4} # Don't allow last four digits to be "0000"
$ # End of expression

This expression will not allow a Social Security Number that:

• Contains all zeroes in any specific group (e.g. 000-##-####, ###-00-####, or ###-##-0000)
• Begins with ‘666’
• Begins with any value from ‘900-999′
• Is equal to ‘078-05-1120′ (due to the Woolworth’s Wallet Fiasco)
• Is equal to ‘219-09-9999′ (as it appeared in an advertisement for the Social Security Administration)
  
  And,
  
  
• Contains all matching values (e.g. 000-00-0000, 111-11-1111, 222-22-2222, etc.)
• Contains all incrementing values (e.g. 123-45-6789)

It's important to keep in mind that although this expression will help foil possible fraudulent attempts, it is a bit over-the-top and will actually consider some valid values (like 123-45-6789) to be invalid. Use your best judgement to determine if this is a viable option for you and your business needs.

You can see this expression in action below:

Interactive Example through JSBin

Using the Social Security Administration’s Validation Service

If you truly need a reliable method of handling Social Security Number validation, the Social Security Administration offers a service that will properly validate a number for you, however it may not always be free or very quick. You can visit the following page for more information on using the services they provide:

Validating a Social Security Number using the Social Security Number Verification Service.

Additional Examples

You can find an interactive page with the three examples that were mentioned in this post below through JSBin:

Example using Basic, Actual and Over-the-Top Validation for Social Security Numbers.

You can also access a .NET-specific version of these examples (both with implementations in C# and Javascript) from the following repository on GitHub:

Download all of these Examples for Javascript and C# from GitHub.