How to Check a GST Number Without an OTP or Login

The short answer is that you are trying to get around something that was never in your way. Checking somebody else's GST number has never required an OTP. An OTP authenticates you as a taxpayer — it is how you get into your own account. It has nothing to do with looking a stranger up.

What people actually run into on the GST portal is a captcha, and the two get conflated easily enough: both are a box you have to fill in before the page will do anything. So this post separates the three tiers properly — what needs nothing, what needs a captcha, and what genuinely needs a login — and then shows how to check a GSTIN with none of the three, including a few hundred at a time.

What actually needs a login

Three tiers, and almost every confused search sits in the gap between the first two.

Needs nothing	Needs a captcha	Needs a full login
Format and check-digit validation of the number itself	Search Taxpayer → Search by GSTIN/UIN	Filing returns
Pure arithmetic — no server involved	Search Taxpayer → Search by PAN	Your cash, credit and liability ledgers
Catches every single-character typo	Search Taxpayer → Search Composition Taxpayer	Your own GSTR-2B
Unlimited, instant, offline	The e-way bill portal's Search → Taxpayer page	Downloading your registration certificate (REG-06)
—	No account, no OTP	Amending registration, generating e-way bills, deeper filing history

The public searches in the middle column return a genuinely useful record: legal name, trade name, registration status, date of registration, constitution of business, taxpayer type, jurisdiction and principal place of business. Searching by PAN instead returns the GSTINs registered against that PAN with their state and status — a different lookup entirely, and often the faster one when you suspect a typo in the middle of a number.

The check that needs nothing at all

Before any network call, there is a check that needs no portal, no captcha and no connection: the number has to be internally consistent. A GSTIN is fifteen characters with a fixed shape, and its last character is a check digit computed from the first fourteen. That makes typos self-detecting — change any single character and the arithmetic stops agreeing.

Run that first, always. It is free, it is instantaneous, and it disposes of the most common failure by far. The free GSTIN validator does it entirely in your browser, unlimited, with nothing leaving the page.

The portal search: captcha, no OTP

The government's own search lives at gst.gov.in under Search Taxpayer. Pick the facility that matches what you are holding — GSTIN/UIN, PAN, or composition taxpayer — enter the number, solve the captcha, and the record comes back. No account. No OTP. Free.

It is the authoritative source and it is the right tool for one number, occasionally. Its limits are practical rather than legal: one lookup at a time, a captcha per search, rate limiting once you have run several in quick succession, and no structured output you can do anything with afterwards.

Do not automate it

Scripting the portal search is the obvious next thought and the wrong one. The pages are rate-limited, the captcha exists precisely to stop automation, and working around it breaches the portal's terms of use. It also breaks the moment the markup changes. If you need more than the occasional manual search, use a documented interface instead — the reasoning is laid out in full in API versus portal scraping.

A search with no captcha either

If the captcha itself is what you are trying to avoid — you are checking a number on your phone, or on the fourth invoice this morning — our free GST number search gives you five lookups a day with no signup, no card and no captcha. It returns registration status, filing history, e-invoicing applicability and jurisdiction.

Five a day covers the person checking a new supplier before paying an invoice. If you are working through a vendor list, that is a different problem, and the next two sections are for you. If what you have is a business name rather than a number, searching by name is its own exercise with its own caveats.

Checking at scale

Past a handful of numbers, the answer is an API — and the point worth making here is how much simpler the authentication is than the thing you were worried about. One header. No captcha, no session cookie, no OTP, nothing to re-solve every request:

curl -H "X-API-Key: your_api_key" \
  https://gstinapi.com/api/get-taxpayer-info/27AAACR5055K1Z7

A found record comes back with taxpayer_data.status_code == 1; branch on that rather than on the presence of a field. The full response shape and the error codes are in the API documentation, and registration ships with free credits so you can test the integration before deciding anything.

Hundreds of numbers at once

The mistake with a long list is looking every row up. Two cheap passes first, and the expensive pass gets much smaller:

1. Validate offline. Malformed rows can never resolve, so a lookup spent on one is a lookup wasted. This is arithmetic and costs nothing.
2. Deduplicate. Vendor masters repeat the same GSTIN across dozens of invoice lines. One lookup per distinct number, not per row.
3. Look up what survives. Usually a fraction of what you started with.

Our MIT-licensed libraries do all three. They are on npm and PyPI, and verify_many deduplicates the input and skips malformed entries without spending a credit on them:

# pip install gstin-toolkit
from gstin_api import Client

client = Client(api_key="your_api_key")

gstins = ["27AAACR5055K1Z7", "29AAACI1195H1ZI", "27AAACR5055K1Z7", "NOT-A-GSTIN"]

# Deduplicates, drops the malformed row, and spends two credits rather than four.
for result in client.verify_many(gstins):
    print(result.gstin, result.status)

The Node client is the same shape — client.verifyMany(gstins) — and if all you want is the offline pass over a CSV column, with no key and no network involved at all, the CLI will do it standing up:

cut -d, -f3 vendors.csv | npx @dlminds/gstin-api validate

The wider pipeline — batching, retries, what to do with the rows that come back cancelled — is covered in the bulk verification guide. Two things worth carrying into it: a status of suspended is not the same as cancelled and needs its own handling, and a number that passes every offline check but returns nothing from the register is exactly the pattern that a fabricated GSTIN produces.

None of which, at any point, involved an OTP.

Frequently asked questions

Do I need an OTP to check someone else's GST number?

No, and you never have. An OTP authenticates you as a taxpayer logging into your own account. Looking up a third party's GSTIN is a public search that has never required one. What the GST portal does ask for on that page is a captcha, which people frequently remember afterwards as an OTP.

Does logging into the GST portal show me more about another business?

No. A login gets you access to your own account — your returns, your ledgers, your registration certificate. It does not widen what you can see about anyone else's registration. The public Search Taxpayer result is the same whether you are logged in or not, so creating an account to look up a supplier gains you nothing.

Can I check a GST number without a captcha as well?

Yes. Our free GSTIN search at /tools/gst-number-search allows five lookups a day with no signup, no card and no captcha, returning status, filing history, e-invoicing applicability and jurisdiction. For a format and check-digit test alone, the validator at /tools/gstin-validator runs entirely in your browser with no network call at all.

Is it legal to scrape the GST portal instead?

Automating the public search circumvents a captcha that exists specifically to prevent automation, which breaches the portal's terms of use, and the pages are rate-limited besides. Use a documented API or the free tools instead — the data is the same and neither the throttling nor the terms problem exists.

Why does the portal say "no records found" for a number I know is real?

Usually a transcription error, but also possible are a search typed into the wrong facility, a registration issued so recently it has not propagated to the public index, or a cancelled registration dropping out of a particular view. Validate the checksum offline first, then work through the causes in order.

How many GST numbers can I check without logging in anywhere?

Offline format and checksum validation is unlimited, because it is arithmetic on the string with no server involved. Live register lookups are limited: five a day on our free tool, and rate-limited on the portal. Past that you want an API key, which is the entire authentication story — no captcha, no session, no OTP.