Detection reference · Personal data · Updated 2026-11-03

UK National Insurance numbers

A National Insurance number follows rules about which letters can appear where. Redaxa applies them, which removes most false matches and also skips the specimen HMRC prints in its guidance.

At a glance

Reported as	UK National Insurance number
Category	Personal data
Severity	high: direct financial exposure or a strong identifier, such as a card or national number
Replaced with	`[NI NUMBER]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 228

What it looks like

Two letters, six digits (spaces allowed between pairs) and a final letter A, B, C or D. Neither prefix letter can be D, F, I, Q, U or V; the second cannot be O; the prefixes BG, GB, KN, NK, NT, TN and ZZ are never issued.

Example

You paste

Employee NI number: JZ 49 07 31 B

Redaxa returns

Employee NI number: [NI NUMBER]

Reported as	UK National Insurance number
Severity	high: direct financial exposure or a strong identifier, such as a card or national number
Replaced with	`[NI NUMBER]`

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

hr/payroll.csv: UK National Insurance number, listed for review (severity high). Potential sensitive data. Context and authorization must be reviewed; this is not a confirmed vulnerability.
Same value in tests/fixtures/payroll.csv: Test or example value, counted but not listed. Real-looking keys in test files are still reported.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

NI QQ 12 34 56 C: not flagged. The QQ prefix is never issued; this is the example HMRC uses.
NI AB 12 34 56 C: not flagged. 123456 is a placeholder digit run.
NI GB 49 07 31 B: not flagged. GB is one of the prefixes never allocated.

What to do

Remove the number. National Insurance numbers are used to identify people to HMRC and DWP; the person it belongs to should be told if it was exposed.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Sources

Redaxa engine: scanner.ts line 228. Every output on this page was produced by that code when the page was built.
HMRC National Insurance Manual NIM39110: What a NINO looks like