CUSIP validator
How the CUSIP format works
- Format
- 9-character alphanumeric security identifier (8-character base + 1 check digit)
- Example
- 037833100
Things to watch for
- A valid checksum only confirms the code is well-formed — it doesn't confirm the security is actually registered or still trading; check CUSIP Global Services (or a broker) for that
- CUSIPs identify securities issued in the US and Canada; for a security registered elsewhere, look up the national identifier embedded in that country's ISIN instead
- For a US security, its ISIN is typically just 'US' + the 9-character CUSIP (which already ends in its own check digit) + one more ISIN check digit
^[0-9A-Z*@#]{8}[0-9]$A CUSIP (Committee on Uniform Securities Identification Procedures number) is the 9-character code that pins down one specific security — a stock, bond, or other instrument — issued in the United States or Canada. Clearing houses, custodians, and back-office systems key trades and settlement instructions off the CUSIP rather than the ticker, because tickers get reassigned to new companies over time while a CUSIP stays fixed to one security for its life.
Of the 9 characters, the first 6 identify the issuer, the next 2 identify the specific issue — a particular bond series, share class, or maturity — and the 9th is a check digit. CUSIP Global Services, the official registrar, assigns and maintains them.
How this validator works
This tool recomputes the 9th check digit from the first 8 characters using a Luhn-style weighted mod-10 formula: each character converts to a numeric value (0-9 for digits, 10-35 for A-Z, with three extended values reserved for the rare *, @, and # characters used in some private-placement CUSIPs), the value at every even position is doubled, and the digits of each result are summed. If that sum-derived digit doesn’t match the 9th character, the CUSIP is invalid. The whole check runs in your browser — nothing you type leaves your device.
What a pass doesn’t tell you
A pass confirms the code is well-formed and internally consistent — nothing about whether the security was ever actually issued, is still trading, or belongs to the company you expect. A retired CUSIP from a company that was acquired years ago still passes this checksum, since format and check-digit math can’t detect a delisting or merger. To confirm a security is live and current, check it against CUSIP Global Services or a broker’s own reference data.
Content last reviewed 2026-07-23.
CUSIP FAQ
How is a CUSIP different from an ISIN?
A CUSIP is the national identifier for securities issued in the US or Canada, and it's complete at 9 characters. An ISIN is the broader, global wrapper defined by ISO 6166: for a US security, the ISIN is typically 'US' plus the 9-character CUSIP plus one further ISIN check digit — so the CUSIP is usually embedded inside the ISIN, not a separate lookup.
What do the '*', '@', and '#' characters in some CUSIPs mean?
They're extended values (36, 37, and 38) used in the check-digit math for certain private-placement and fixed-income CUSIPs that fall outside the standard 0-9 and A-Z range. They're uncommon in everyday equity CUSIPs but valid, and this tool accounts for them automatically.
Does a valid CUSIP mean the security is currently tradable?
No. A passing result only confirms the code is correctly formatted and its check digit is mathematically consistent — it doesn't confirm the security is still registered, listed, or trading. Securities get delisted, merged, or restructured, and their old CUSIPs remain formally 'valid' by this test long after. For a live status check, use CUSIP Global Services or a broker's market data.