SSN Regex Tester

SSN Regex Tester

Test and validate ssn patterns with this specialized regex tester. Includes tested patterns and real-time matching.

Recommended Ssn Pattern

``regex ^\d{3}-\d{2}-\d{4}$ `

Test Examples

Valid matches:

• 123-45-6789
• 000-00-0000
• 999-99-9999

• 123456789
• 123-456-789
• 12-345-6789

1. ^\d{9}$ 2. ^\d{3}[- ]?\d{2}[- ]?\d{4}$

How to Use

1. The pattern above is preloaded—or enter your own 2. Add test strings to validate 3. See real-time match highlights 4. Copy the pattern for your code

Regex Quick Reference

The Pattern

`regex ^(?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4}$ `

Flags: gm — m makes ^ and $ match at each line break, so the pattern can be tested against a list.

Broken Down

Tested Against Real Input

The Important Caveat

Never log an SSN you matched, and think hard about whether you need to store one at all. The negative lookaheads encode rules the SSA published; they do not confirm the number belongs to anyone.

Using It

`javascript const pattern = /^(?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4}$/gm;

// Test a single value — reset lastIndex first if the pattern is global pattern.lastIndex = 0; const isValid = pattern.test(value);

// Or find every match in a block of text const matches = [...text.matchAll(pattern)]; `

A global regex carries lastIndex between calls, so reusing one across test() calls returns alternating results. Either drop the g flag for validation or reset it each time.

Anchors, Greediness and Backtracking

Three behaviours account for most regex surprises, and this pattern shows all three.

Anchors. ^ and $ pin the match to the start and end of the input. Without them, \d{3} matches the 123 inside abc123def. With m in the flags — as here — they pin to each *line* instead, which is what lets one pattern be tested against a list.

Greediness. .* takes as much as it can and gives back only when forced; .*? takes as little as possible. On , the pattern <.*> matches the whole string and <.*?> matches just .

Backtracking. When a match fails, the engine reverses and tries other splits. Nested quantifiers like (a+)+ make that exponential, and a 30-character input can hang a server — a class of denial of service known as ReDoS. Avoid nesting quantifiers, and prefer explicit character classes over . wherever you can.

Testing It Properly

`javascript const pattern = /^(?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4}$/gm;

// A global regex keeps lastIndex between calls, so reusing one across // test() calls returns alternating true/false on the same input. pattern.lastIndex = 0;

// Named groups make the result readable const named = /(?\d{4})-(?\d{2})/; const { groups } = '2026-08'.match(named); `

Write the failing cases first. A pattern that accepts everything valid is easy; one that also rejects everything invalid is the hard half, and it is where the bugs are.

When Not to Use a Regex

Structured formats have parsers, and the parser is always more correct: new URL() for URLs, DOMParser for HTML, JSON.parse` for JSON, a date library for dates. Reach for a regex to *find* things in unstructured text, not to validate something a parser understands.