SSN Validator (US Social Security Number)

Validate US Social Security Numbers (SSN) format.

Input

Output

Examples

Example 1

123-45-6789

Example 2

987654321

Example 3

078-05-1120

Social Security Number Structure

SSNs consist of nine digits formatted as XXX-XX-XXXX: Area Number (first three), Group Number (middle two), and Serial Number (last four). Originally, area numbers indicated geographic regions where the SSN was issued, but since 2011, SSA randomizes all components.

Invalid area numbers include 000, 666, and 900-999. Group numbers cannot be 00, and serial numbers cannot be 0000. These reserved ranges were never issued and indicate fake or test SSNs. Historical patterns like 987-65-4320 (used in ads) are also invalid.

Pre-2011 SSNs followed geographic patterns: 001-003 were New Hampshire, 545-573 were California, etc. Modern randomized SSNs don't follow these patterns, but many systems still validate against historical ranges, potentially rejecting legitimate recent SSNs.

Why SSN Validation is Critical

Payroll and tax systems require valid SSNs to report income to the IRS. Typos cause W-2 rejections, tax filing errors, and IRS penalties. Pre-validation prevents compliance issues and ensures employees' earnings are correctly credited to their Social Security accounts.

Background checks and employment verification depend on accurate SSNs. Invalid numbers cause database mismatches, delaying hiring processes. E-Verify specifically checks SSN validity against SSA records—format errors trigger immediate rejections.

Identity theft often involves fake SSNs with obvious patterns (123-45-6789) or reserved numbers. Format validation flags suspicious entries that warrant additional verification, helping detect fraud before it enters systems.

SSN Validation Compliance and Security

NEVER store or display full SSNs unnecessarily. Privacy laws and security best practices require truncating to last four digits (XXX-XX-1234) in most contexts. Full SSNs should only be in encrypted databases with strict access controls.

Format validation checks structure but doesn't verify if an SSN is actually issued or belongs to the person claiming it. For real verification, use SSA's Consent Based SSN Verification Service (CBSV) or E-Verify API with proper authorization.

Don't log SSNs in application logs, error messages, or analytics. Even partial SSNs combined with other data can enable identity theft. Implement redaction in logging frameworks and ensure no SSN data reaches third-party services.

Consider alternatives to SSNs: Many use cases don't legally require them. IRS requires SSNs for tax purposes, but other identification methods (employee IDs, email addresses) can serve most internal purposes, reducing liability.

Handling SSN Data Responsibly

Collect SSNs only when legally required: W-4 forms, I-9 employment verification, credit applications. Over-collection increases data breach liability. Document business necessity and implement data minimization principles.

Encrypt SSNs at rest and in transit using AES-256 or equivalent. Ensure encryption keys are stored separately from data, rotated regularly, and protected by access controls. Unencrypted SSNs in databases invite catastrophic breaches.

Implement access logging: Track who accessed SSN data, when, and why. Regular audits detect unauthorized access. Many compliance frameworks (HIPAA, PCI DSS analogs for PII) mandate access logging for sensitive identifiers like SSNs.

Have data retention policies: Delete SSNs when no longer needed (e.g., after employee separates and retention period expires). Retaining unnecessary PII increases breach exposure and violates privacy principles in regulations like GDPR and CCPA.

Loading tool…