Identifier detector
US Social Security number: format, validation and detection
Short answer
A US Social Security number has nine digits in the pattern AAA-GG-SSSS. Maskflare rejects area 000, area 666, any area starting with 9, group 00 and serial 0000. There is no check digit.
What it is
The SSN identifies people in the US for tax and benefits. Maskflare's United States pack covers it as a social security number, and the HIPAA Safe Harbor and US personal data compliance profiles include the pack.
In Maskflare this is the detector ssn, labelled "United States - Social security number", category social security number, in the United States pack.
Format and layout
- Nine digits, usually printed with hyphens: 123-45-6789.
- Area (first three digits): not 000, not 666, and not starting with 9.
- Group (middle two digits): not 00.
- Serial (last four digits): not 0000.
How the check works
No checksum exists for SSNs, so the validator can only apply the rules above. Areas starting with 9 are excluded here; numbers that start with 9 are handled by the ITIN detector.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
123-45-6789 | Valid | Matches the layout and passes the validator. |
923-45-6789 | Invalid | The invalid example changes one character, character 1 of 11: 1 becomes 9. |
In running text the valid example reads, for instance, SSN 123-45-6789. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- Because only the layout rules apply, any nine digits that satisfy them can match. A separate unformatted detector (us_ssn_unformatted) handles nine-digit runs with no hyphens, and it needs one of its own keywords before the number.
- The formatted detector accepts the hyphenated shape on its own, without a keyword.
- Part numbers and other codes with a 3-2-4 digit layout can resemble the formatted shape; the area, group and serial rules remove some of them.
How to detect it in LLM traffic
US Social Security number values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.
Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter US Social Security number candidates.
- Apply the layout rules from the section above. This identifier has no check digit to recompute, so expect more look-alikes than with a checksum-based format.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when United States is a primary country.
- Monitor first: alert (counted, forwarded unchanged) when United States is a primary country.
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
2 of the 6 compliance profiles include the United States pack, and applying them turns this detector on: HIPAA Safe Harbor and US personal data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
Why does Maskflare reject SSNs starting with 9?
The SSN validator rejects any area beginning with 9. Nine-digit numbers that start with 9 are the ITIN detector's territory, which has its own group-number rules.
Does Maskflare detect an SSN without hyphens?
Yes, through the separate us_ssn_unformatted detector, which asks for a nearby keyword such as SSN or social security before accepting nine bare digits.
Is the US Social Security number detector on by default?
It depends on the organisation's primary countries. It is part of the United States pack, which the default Protect now template turns on with the action mask when United States is a primary country.
Does a valid US Social Security number prove the person exists?
No. This identifier is validated on its layout alone, so a passing value is only well formed, not known to be real.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.