Social Security Number (SSN) Validation Regular Expression

A valid U.S. Social Security Number follows the format XXX-XX-XXXX where each X is a digit. However, not all combinations are valid. The Social Security Administration has specific rules about which numbers can be assigned, making proper validation more complex than just checking the format. SSNs are a specialized type of number pattern.

Security Best Practices

Never store SSNs in plain text - always use encryption
Minimize SSN collection and storage - only when legally required
Use tokenization or masking when displaying SSNs (e.g., XXX-XX-1234)
Implement proper access controls and audit logging
Follow SSA randomization guidelines for understanding valid ranges
Consider using SSN only for verification, not as a primary identifier

Recommended Solution

^(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}$

Explanation

^ - Start of the string.
(?!000|666|9\d{2}) - Negative lookahead to reject invalid area numbers:
- 000 - Never assigned
- 666 - Never assigned (historically reserved)
- 9\\d2 - Numbers 900-999 are not assigned
\d{3} - Three digits for the area number (first part).
- - Required hyphen separator.
(?!00) - Negative lookahead to reject group number 00.
\d{2} - Two digits for the group number (middle part).
- - Required hyphen separator.
(?!0000) - Negative lookahead to reject serial number 0000.
\d{4} - Four digits for the serial number (last part).
$ - End of the string.

Note: This pattern enforces the standard XXX-XX-XXXX format with hyphens and rejects commonly known invalid patterns. For production use with legacy data or systems that accept SSNs without hyphens, you may need to normalize the input first.

Implementation

const ssnRegex = /^(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}$/;
const isValidSSN = (ssn) => ssnRegex.test(ssn);

import re

def is_valid_ssn(ssn):
  ssnRegex = r"^(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}$"
  return re.match(ssnRegex, ssn) is not None

use regex::Regex;

fn is_valid_ssn(ssn: &str) -> bool {
  let ssnRegex = Regex::new("^(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}$")
    .expect("Could not parse SSN validation regex");
  ssnRegex.is_match(ssn)
}

package main

import (
  "fmt"
  "regexp"
)

func isValidSSN(ssn string) bool {
  ssnRegex := "^(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}$"
  re := regexp.MustCompile(ssnRegex)
  return re.MatchString(ssn)
}

import Foundation

func isValidSSN(_ ssn: String) -> Bool {
  let ssnRegex = "^(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}$"
  return NSPredicate(format: "SELF MATCHES %@", ssnRegex).evaluate(with: ssn)
}

using System;
using System.Text.RegularExpressions;

class Application {
  static bool IsValidSSN(string ssn) {
    string ssnRegex = "^(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}$";
    return Regex.IsMatch(ssn, ssnRegex);
  }
}

import java.util.regex.*;

public class Application {
  public static boolean isValidSSN(String ssn) {
    String ssnRegex = "^(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}$";
    Pattern pattern = Pattern.compile(ssnRegex);
    Matcher matcher = pattern.matcher(ssn);
    return matcher.matches();
  }
}

<?php
function isValidSSN($ssn) {
  $ssnRegex = "^(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}$";
  return preg_match("/" . $ssnRegex . "/", $ssn);
}
?>

Test Cases

Social Security Number	Valid
123-45-6789
234-56-7890
456-78-9012
987-65-4321
800-12-3456
000-12-3456
666-12-3456
900-12-3456
999-12-3456
123-00-4567
123-45-0000
12-34-5678
1234-56-789
123456789
123-456-789

abc-de-fghi
123-45-67890
123.45.6789

Basic Validation

For a quick format check without enforcing SSA rules, you can use a basic regular expression that only validates the XXX-XX-XXXX structure. This is useful when you need to accept the format but will validate the actual number against SSA databases separately.

^\d{3}-\d{2}-\d{4}$

Explanation

^ - Start of the string.
\d{3} - Exactly three digits for the area number.
- - Required hyphen separator.
\d{2} - Exactly two digits for the group number.
- - Required hyphen separator.
\d{4} - Exactly four digits for the serial number.
$ - End of the string.

Implementation

const basicSSNRegex = /^\d{3}-\d{2}-\d{4}$/;
const isValidSSN = (ssn) => basicSSNRegex.test(ssn);

import re

basic_ssn_regex = r'^\d{3}-\d{2}-\d{4}$'

def is_valid_ssn(ssn):
    return bool(re.match(basic_ssn_regex, ssn))

use regex::Regex;

fn is_valid_ssn(ssn: &str) -> bool {
    let re = Regex::new(r"^\d{3}-\d{2}-\d{4}$").unwrap();
    re.is_match(ssn)
}

package main

import (
    "fmt"
    "regexp"
)

func isValidSSN(ssn string) bool {
    re := regexp.MustCompile(`^\d{3}-\d{2}-\d{4}$`)
    return re.MatchString(ssn)
}

import Foundation

func isValidSSN(_ ssn: String) -> Bool {
    let regex = try! NSRegularExpression(pattern: "^\d{3}-\d{2}-\d{4}$")
    return regex.firstMatch(in: ssn, range: NSRange(location: 0, length: ssn.utf16.count)) != nil
}

using System;
using System.Text.RegularExpressions;

class Program {
    static bool IsValidSSN(string ssn) {
        return Regex.IsMatch(ssn, @"^\d{3}-\d{2}-\d{4}$");
    }
}

import java.util.regex.*;

public class SSNValidator {
    public static boolean isValidSSN(String ssn) {
        return Pattern.matches("^\d{3}-\d{2}-\d{4}$", ssn);
    }
}

<?php
function isValidSSN($ssn) {
    return preg_match("/^\d{3}-\d{2}-\d{4}$/", $ssn);
}

Test Cases

Social Security Number	Valid
123-45-6789
234-56-7890
000-12-3456
666-12-3456
900-12-3456
999-12-3456
123-00-4567
123-45-0000
12-34-5678
1234-56-789
123456789
123-456-789

abc-de-fghi
123-45-67890
123.45.6789

Additional Considerations

SSN Randomization: Since June 25, 2011, the SSA has assigned SSNs randomly, making it harder to predict valid ranges. The patterns above cover the most common invalid cases.
International Variations: This validation is specific to U.S. Social Security Numbers. Other countries have different national identification systems (e.g., Canada's SIN, UK's NINO).
Format Flexibility: Some systems accept SSNs without hyphens. Consider normalizing input by removing non-digit characters before validation.
ITIN vs SSN: Individual Taxpayer Identification Numbers (ITINs) follow a different format and should not be validated with these patterns.