How to Validate a Social Security Number with JavaScript

The following is an excerpt from Javascript Cookbook. Sometimes you need to validate whether a text string is a valid U.S.-based Social Security number (the identifier the tax people use to find us, here in the States).

---

Use the String match method and a regular expression to validate that a string is a Social Security number:

var ssn = document.getElementById("pattern").value;
var pattern = /^\d{3}-\d{2}-\d{4}$/;
if (ssn.match(pattern))
  alert("OK");
else
  alert("Not OK");

A U.S.-based Social Security number is a combination of nine numbers, typically in a sequence of three numbers, two numbers, and four numbers, with or without dashes in between.

The numbers in a Social Security number can be matched with the digit special character (\d). To look for a set number of digits, you can use the curly brackets surrounding the number of expected digits. In the example, the first three digits are matched with:

\d{3}

The second two sets of numbers can be defined using the same criteria. Since there’s only one dash between the sequences of digits, it can be given without any special character. However, if there’s a possibility the string will have a Social Security number without the dashes, you’d want to change the regular expression pattern to:

var pattern = /^\d{3}-?\d{2}-?\d{4}$/;

The question mark special character (?) matches zero or exactly one of the preceding character—in this case, the dash (-). With this change, the following would match:

444-55-3333

As would the following:

555335555

But not the following, which has too many dashes:

555---60--4444

One other characteristic to check is whether the string consists of the Social Security number, and only the Social Security number. The beginning-of-input special character (^) is used to indicate that the Social Security number begins at the beginning of the string, and the end-of-line special character ($) is used to indicate that the line terminates at the end of the Social Security number.

Since we’re only interested in verifying that the string is a validly formatted Social Security number, we’re using the String object’s match method. We could also have used the RegExp test method, but six of one, half dozen of the other; both approaches are acceptable.

There are other approaches to validating a Social Security number that are more complex, based on the principle that Social Security numbers can be given with spaces instead of dashes. That’s why most websites asking for a Social Security number provide three different input fields, in order to eliminate the variations. Regular expressions should not be used in place of good form design.

In addition, there is no way to actually validate that the number given is an actual Social Security number, unless you have more information about the person, and a database with all Social Security numbers. All you’re doing with the regular expression is verifying the format of the number.

One site that provides some of the more complex Social Security number regular expressions, in addition to many other interesting regular expression “recipes,” is the Regular Expression Library.