UK Postcode Validation: Regex vs PAF

If you're building checkout or address capture in 2026, you've probably hit the question already: do you validate UK postcode input with a regex, or call an API? The honest answer is both, because they do different jobs. UK postcode validation has two layers. One checks the shape of a string. The other checks whether the postcode actually exists in Royal Mail PAF (Postcode Address File) and returns the addresses behind it.

UK Postcode Validation in Two Layers

A regex confirms that a string looks like a UK postcode. A PAF lookup confirms that the postcode exists and returns its addresses. A regex cannot tell you whether a postcode is real, new or terminated. A lookup rejects garbage before it runs, and at no cost, but it still takes a round-trip, so you filter first.

Think of it as a cheap gate in front of a more authoritative check. The gate runs in your code, costs nothing and responds instantly. The lookup runs against the data source of record. Neither replaces the other.

What a postcode regex can and cannot do

A regex checks the postcode format: an outward code (such as SW1A) and an inward code (a digit followed by two letters, such as 0AA). It catches stray punctuation, missing characters and text pasted in by mistake. If you want to see a worked example of a validation function, this PHP postcode validation function shows the general approach, including standardising the string once it matches.

What it cannot do is tell you the postcode exists. Many strings match the pattern and belong to no delivery point. That is the gap a lookup fills.

What Is the Format of a Valid UK Postcode?

A UK postcode has two parts separated by a space: an outward code of two to four characters and an inward code of three. The inward code is always a digit then two letters. Postcodes vary in length, so a fixed length check is not enough on its own.

Outward codes come in several letter and digit patterns, which is why a good regex is longer than people expect. Normalise before you test: trim whitespace, uppercase the input and tolerate a missing space. Then match. Keep the pattern permissive rather than clever. A strict pattern that rejects a real postcode costs you a customer. A permissive one only sends a few extra requests to the API.

Are All UK Postcodes 7 Digits?

No. Postcodes are alphanumeric, not digits, and they run from five to seven characters excluding the space. SW1A 0AA has seven, M1 1AE has five. Any validation that assumes seven characters will reject real postcodes, so test length as a range, not a fixed value.

How the Two Layers Work Together in Practice

Run the regex first, in the browser and on the server. If the string fails, show an inline message and stop. No request leaves your system. Only a well-formed postcode goes to the lookup.

On our side, the same principle applies. Our October 2026 changelog states: "The format is checked before any credit is taken." A malformed postcode is rejected with a 400 (or a 404 on the getAddress.io-compatible /find) before the search runs. That behaviour is documented, but your own regex still saves a network round-trip and gives the user instant feedback.

Client-side length checks on autocomplete

Autocomplete suggestions are free, but the endpoint needs at least 2 characters. Our rate limits and errors page advises checking q.length >= 2 client-side before calling the API. It costs nothing either way - it just saves a round-trip. This is a small change, and it keeps your request log clean.

Why Does a Valid Postcode Return No Match?

A well-formed postcode can return nothing because it does not exist in PAF. The usual causes are a new postcode not yet added, a terminated postcode, or a typo that happens to match the valid format. It is a data answer, not a bug in your regex.

Our documentation lists exactly these cases for a 404: newly created postcodes not yet added to PAF, postcodes that have been terminated, and typos that match valid formatting. Royal Mail updates PAF daily and we refresh our copy monthly, in line with Royal Mail's release cycle, so a brand-new postcode can lag until the next refresh. Our data and licensing page covers this. Treat a 404 as "no match", not as "wrong address". Let the customer enter the address manually, as our WooCommerce plugin does when a postcode is not in PAF yet.

What a no-match costs

Per our rate limits and errors page, a charged endpoint returning 404 does not spend a credit. By contrast, the pricing page says a completed lookup costs one credit. So the cost sits with completed lookups, and a regex gate plus a sensible no-match path keeps wasted calls down. Credits come in one-off packs, valid for 12 months from each pack's own purchase. You can see the per-lookup rates, from 3.5p on the Starter pack to 2.5p on the Pro pack, on the pricing page.

Why Is My UK Postcode Invalid?

Usually one of three things: the string contains characters not allowed in a postcode, the shape is wrong, or the postcode is well-formed but not in PAF. Our docs describe the 400 as "The postcode contains characters that are not valid in a UK postcode." Pass only the postcode, with no extra text.

Letter-for-Digit Correction: One More Layer

Typing a letter where a digit belongs is a classic mistake, mostly O for 0 and I for 1. The general method is positional: the inward code always starts with a digit, so a letter in that slot is a candidate for correction. You try the input as typed first, and only correct when nothing matches.

Our changelog documents this within a narrow scope. A letter typed where a postcode needs a digit is corrected: BF1 OAB becomes BF1 0AB, and SWIA OAA becomes SW1A 0AA. The search runs exactly as typed first, and the correction is only tried when that finds nothing. A valid postcode is never changed. A corrected lookup that returns addresses is charged like any other lookup; one that still finds nothing is not. Don't rely on this for anything beyond what is documented.

A Practical Order of Checks

• Normalise the input: trim, uppercase, tolerate a missing space.
• Run a permissive regex client-side and server-side.
• For autocomplete, require at least 2 characters before calling.
• Run the lookup, and treat a 404 as "no match", not a delivery problem.
• Offer manual entry as the fallback.

Ready to wire it up? Our pricing page lists every pack, with 100 free lookups and no card required to start. Get your free API key and you can test both layers against real PAF data the same afternoon.

Frequently Asked Questions

Can I validate a UK postcode without an API?

You can check the format with a regex, with no API at all. That confirms the string is shaped like a postcode. It cannot confirm the postcode exists, so use a PAF lookup when you need to know that.

Does a malformed postcode use a credit?

No. Our October 2026 changelog states the format is checked before any credit is taken. A malformed postcode is rejected before the search runs, and a lookup that finds nothing is not charged either.

Is a no-match result a wrong address?

No. It means the query did not match PAF, for example a new postcode, a terminated one, or a typo. Let the customer enter the address manually rather than treating it as a failure.