What the UPI ID Format Validator does
A UPI ID - properly a virtual payment address - is something@handle, and this page checks both halves against the published format: which characters are allowed before the @, what a handle may look like after it, and whether that handle appears in a dated list of the ones the major payment apps document. It flags handles that are one character away from a known one, because that is exactly how money reaches a stranger.
It is a format check and says so on every result. NPCI does not publish an open register of handles, so the list is compiled from the apps' own documentation and is incomplete by definition - an unlisted handle is unlisted, never invalid. And no check of any kind can tell you who an address belongs to.
Your UPI IDs stay in this browser tab. They are personal data, and a list of them from an accounts system is more sensitive still.
How to use it
- Paste a UPI ID. The two halves, the handle match and the format findings appear as you type.
- To check a list - a vendor file, a payout sheet - paste one per line and read the table, which carries the provider and any near-miss suggestion per row.
- Look hard at any row with a 'did you mean' value. A handle one character away from a real one is the classic shape of a payment-diversion attempt.
- Open 'Handles in the bundled list' to see exactly what the list covers and when it was reviewed.
- Export as CSV or JSON for a payout-file review, then confirm each payee through your bank or app rather than through the file.
Reading the results
Before the @: letters, digits, dots, hyphens and underscores, at least two characters. Many addresses are a mobile number, which is why 9876543210@upi is perfectly normal.
After the @: a handle that starts with a letter and continues with letters and digits. Handles belong to the payment service provider, not to the customer - @oksbi is Google Pay's State Bank handle, @ybl is PhonePe's YES Bank handle.
A recognised handle tells you which app or bank issued the address. It tells you nothing about the person. Two addresses on the same handle can belong to a hospital and to a fraudster.
A near-miss warning is the most valuable thing on the page. @okscbi is not @oksbi, and a payment to the first will not bounce - it will go wherever that address points.
Worked example: one letter, two different destinations
ramesh.kumar@oksbi passes: the name part uses letters and a dot, the handle starts with a letter and is in the bundled list as Google Pay's State Bank of India handle.
ramesh.kumar@okscbi also passes the format rules - it is a legal address in every respect. But okscbi is not in the list, and it is exactly one character from oksbi, so the page raises a warning and names the handle it looks like. Nothing about the string itself is wrong; the risk is that a human reading quickly will not see the extra letter.
not-a-upi-id fails outright, because there is no @ at all, and the page says which rule it broke rather than reporting a generic error.
Why there is no such thing as a UPI ID lookup
People often want a page that takes a UPI ID and returns a name. That would be a privacy failure, not a feature. The registered name behind an address is deliberately only shown inside an authenticated payment flow, at the moment you are about to pay, and NPCI's rules restrict who may resolve an address to a name and for what purpose.
So the honest division is this: a public page can check the shape of an address and warn you about look-alikes; only your own UPI app, logged in as you, can tell you whose it is. If a site offers to name the owner of any UPI ID you type, it is either wrong or it should not be doing it.
Checking a payout file before you run it
The practical use for bulk checking is a payout or vendor file, where a malformed address means a failed transfer and a rejected batch. Catching the malformed ones before the run saves a reconciliation. Catching the near-misses is more valuable still, because those do not fail - they succeed, to the wrong account.
Two habits are worth more than any validator here. Confirm a new payee's address through a channel you already trust rather than from the invoice that asked for payment, and send a token amount first: the name your app shows on that first payment is the only confirmation of ownership that exists.
Limitations: what the result does not prove
- Format only. It cannot tell you whether an address is registered, who it belongs to, whether the account is active, or whether a payment will succeed.
- The handle list is compiled from payment apps' own documentation, not from an NPCI register - none is published. It is dated and incomplete, so an unlisted handle means unlisted, never invalid.
- Near-miss warnings are a heuristic: a handle within one character of a listed one. They can miss a look-alike that differs by two characters, and they can flag a perfectly legitimate new handle.
- A well-formed address in a legitimate-looking invoice is the standard shape of payment-diversion fraud. Format checking is not fraud detection.
Privacy: where your data goes
Everything you paste, type or drop is processed in this browser tab. It is not uploaded, logged, stored or sent to analytics. Session recording and tag-manager scripts are switched off on this page.
Standards and sources
- NPCI - Unified Payments Interface product overview - checked 19 Sep 2026
- NPCI - UPI circulars and procedural guidelines
- Reserve Bank of India - customer awareness on digital payment frauds
Frequently asked questions
What is a valid UPI ID format?
name@handle. Before the @: letters, digits, dots, hyphens and underscores, at least two characters - very often a mobile number. After the @: a handle that starts with a letter and continues with letters and digits, belonging to a payment service provider rather than to you.
What does the part after the @ in a UPI ID mean?
It identifies the payment service provider that issued the address, not the bank where your money sits and not you. @oksbi is Google Pay on State Bank rails, @ybl is PhonePe on YES Bank rails, @paytm is Paytm. One person can hold several addresses on different handles pointing at the same account.
Can I find out who a UPI ID belongs to?
Not from a public page, by design. The registered name is shown inside your own UPI app at the moment you are about to pay, after an authenticated lookup. A site that offers to name the holder of any address you type is either making it up or should not be doing it.
Is my UPI ID safe to share?
Sharing an address so somebody can pay you is normal and is what it is for. The risk is in the other direction: never approve a collect request you did not expect, never enter your PIN to receive money, and never read out an OTP. Receiving money never needs a PIN.
Why is my handle not in the list?
Because there is no public register to build a complete list from - NPCI does not publish one, so this list comes from the apps' own documentation. New handles appear regularly, especially from newer apps and small finance banks. An absent handle carries no verdict at all.
What does the 'did you mean' warning mean?
The handle you entered is exactly one character away from one in the list. That is how look-alike addresses work: @okscbi reads as @oksbi at a glance, the payment succeeds, and the money is gone. Check the handle character by character before you pay a new address.
Can a UPI ID be a phone number?
Yes - 9876543210@upi is a perfectly ordinary address, and many apps default to it. The digits before the @ are just a name part; they are not validated as a phone number here, and a payment does not go to the phone.
What should I check before paying a new UPI ID?
Three things. That the handle is exactly what you were told, character by character. That the name your app displays matches the payee you expect. And, for anything significant, that a one-rupee test payment reached the right person before you send the rest.
Last reviewed by the A2Z.Tools team against the sources listed above.
