This post covers the format, works through the check-digit algorithm by hand on a real public GSTIN, and gives you a 20-line Python validator with the tests I ran against it.

The 15 characters

A GSTIN is always 15 characters. Using Tata Consultancy Services' Maharashtra registration, 27AAACR4849R4ZI, as the example:

So you can read a lot from a GSTIN before you look anything up: which state it was issued in, the PAN behind it, whether the holder is a company or an individual, and that this is the PAN's fourth registration in Maharashtra.

How the check character is calculated

The method is a base-36 version of the Luhn algorithm that card numbers use:

1. Map each of the first 14 characters to a number: 0–9 stay as they are, A is 10, B is 11 … Z is 35.

2. Multiply the characters alternately by 1 and 2, starting with 1 on the first character.

3. Split each product into its quotient and remainder when divided by 36, and add the two together.

4. Add up all 14 results.

5. The check value is whatever you need to add to bring the total up to a multiple of 36: (36 − total mod 36) mod 36.

6. Convert that value back to a character with the same 0–Z table.

Here is the working for 27AAACR4849R4ZI:

The total is 198. 198 mod 36 is 18, and 36 − 18 = 18, which is I. That matches the last character of the GSTIN.

Step 3 is the part people get wrong. If you just add up the raw products (or take product % 36 without adding the quotient back), you'll get the right answer for some GSTINs and the wrong one for others. Here it matters at positions 12 and 14.

The validator

import re

CHARS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
PATTERN = re.compile(r"^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$")

def gstin_check_char(first14: str) -> str:
    total = 0
    for i, ch in enumerate(first14):
        product = CHARS.index(ch) * (2 if i % 2 else 1)  # double every 2nd char
        total += product // 36 + product % 36            # quotient + remainder
    return CHARS[(36 - total % 36) % 36]

def is_valid_gstin(gstin: str) -> bool:
    g = gstin.strip().upper()
    if not PATTERN.match(g):
        return False
    return gstin_check_char(g[:14]) == g[14]

if __name__ == "__main__":
    for g in ["24AAACR4849R4ZO", "27AAACR4849R4ZI", "27AAACR4849R4ZX"]:
        print(g, is_valid_gstin(g))

Output:

24AAACR4849R4ZO True
27AAACR4849R4ZI True
27AAACR4849R4ZX False

The regular expression checks the shape: two digits, a PAN-shaped block (five letters, four digits, one letter), an entity number from 1–9 or A–Z, a Z, then any check character. Only then does it compare the check character.

A note on the Z: the pattern here is strict about position 14 because that is the default. If your system also handles unusual registration types, loosen that part of the regex and keep the check-digit comparison.

How I tested it

I didn't want to publish a validator that only works on its own examples, so I tested it against GSTINs shown on public IndiaCos pages: three Tata Consultancy Services registrations (Gujarat 24AAACR4849R4ZO, Maharashtra 27AAACR4849R4ZI, Karnataka 29AAACR4849R4ZE) plus two other examples from the site. For each one, the tests check that:

• the real GSTIN passes, in upper and lower case;

• all 35 wrong check characters fail;

• every single-character change to the first 14 characters that still fits the format fails;

• malformed inputs fail (too short, too long, entity number 0, a letter other than Z at position 14, a digit inside the PAN's letter block).

from gstin import is_valid_gstin
valid = ["24AAACR4849R4ZO", "27AAACR4849R4ZI", "29AAACR4849R4ZE"]
for g in valid:
    assert is_valid_gstin(g) and is_valid_gstin(g.lower())
    for c in "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ":
        if c != g[14]:
            assert not is_valid_gstin(g[:14] + c)
assert not is_valid_gstin("24AAACR4849R0ZO")   # entity number can't be 0

Every single-character typo gets caught, because doubling-then-folding by 36 maps each value to a different result. Adjacent swaps nearly always get caught too. When I brute-forced every swap of two neighbouring characters, the only ones the check missed were swaps of 0 and Z, the same kind of blind spot Luhn has with 09 and 90.

What a valid check digit does not tell you

A GSTIN that passes this check is correctly formed. That's all it tells you. It doesn't tell you whether the number was ever issued, whether it's still active, or whether it belongs to the company on the invoice. For that you need to look the number up.

You can do that one at a time in a browser on the IndiaCos GSTIN format guide and the search it links to, which also decodes the state and PAN and opens the registration report. For volume, the IndiaCos API returns the same data as JSON. New accounts get ₹50 of free credit, then it costs ₹0.16 per successful call. Errors and not-found lookups are free, so you can run the local check first and skip the paid call for numbers that are malformed anyway. For legal purposes, the GST authority's own records are what count, so for anything high-stakes, confirm the status there too.

The local check costs nothing and runs in microseconds, so run it every time a GSTIN is entered.

Disclosure: Sunny Mittal works on marketing at IndiaCos. Corrections welcome.