UK National Insurance numbers

How the number is built and checked

A National Insurance number is two letters, six digits and a final letter that is always A, B, C or D, usually printed as AB 12 34 56 C. The suffix once said when contribution cards were due back (March, June, September or December); it is still part of the number. ^[1]

D, F, I, Q, U and V are never used as the first or second letter, O is never the second, and the prefixes BG, GB, KN, NK, NT, TN and ZZ are not used. TN numbers were temporary placeholders that employers may no longer use. ^[1]

There is no check digit: a typo produces another well-formed number. So nullcipher masks one only after National Insurance, NI number, NI no or NINO within 40 characters.

HMRC's own example, QQ 12 34 56 A, starts with a Q that is never issued — which is why it is safe to print, and why nullcipher leaves it alone. ^[1]

How nullcipher recognises it

Two letters, six digits and a final A, B, C or D, with or without spaces (AB 12 34 56 C). As HMRC's manual sets out, D, F, I, Q, U and V are never the first or second letter, O is never the second, and the prefixes BG, GB, KN, NK, NT, TN and ZZ are not used — so HMRC's own specimen QQ 12 34 56 A is not a real number. There is no check digit, so it is only masked with a context word — National Insurance, NI number, NI no, NINO — within 40 characters before it.

This is the rule text of the “UK National Insurance number” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

NI number AB 12 34 56 C

nullcipher replaces it with [NINO_1]. Constructed for illustration. HMRC's specimen QQ 12 34 56 A would not work here: the Q prefix is never issued, so nullcipher correctly does not treat it as a real number.

Why it matters in an AI chat

Your National Insurance number stays the same for life. GOV.UK asks you not to share it with anyone who does not need it, to prevent identity fraud; the organisations that do need it include HMRC, your employer, the DWP and your pension provider.

Payroll exports, onboarding checklists and HR tickets carry it next to name, date of birth and address — the set someone needs to pose as you to an employer or a benefits office.

Masked, the AI still sees [NINO_1] as one person and can help with the payroll question without seeing the number.

If it already leaked

1. Watch for the signs HMRC lists: sign-in codes you did not ask for, a password you did not change, changes to your tax record you did not make, and letters or payments from HMRC you did not expect. ^[3]
2. If someone has used your details to get into your HMRC online account, report it straight away: from the security console in your account if you can still sign in, otherwise with HMRC's online form. Change the password if you still have access. HMRC aims to phone or email you within 10 working days. ^[3]
3. The number itself does not change, so keep sharing it only with the organisations that need it. ^[2]
4. If it only went into an AI chat and there is no sign of misuse, delete the conversation — how, for each major assistant, is on the page listing every type. The number itself stays the same, so the steps above are about noticing and blocking misuse, not about replacing it.

Sources

1. NIM39110 — National Insurance Numbers (NINOs): Format and Security: What a NINO looks like — HMRC National Insurance Manual — checked 2026-09-23.
2. National Insurance: your National Insurance number — GOV.UK — checked 2026-09-23.
3. Report suspicious activity happening in your HMRC online account — GOV.UK — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 30 secret types and how to delete a chat you already sent.