How CPF and CNPJ Validation Works (the Check Digit)

What a check digit is

Take any Brazilian CPF, say 111.444.777-35. The first nine figures identify the taxpayer record; the last two, after the hyphen, were not picked by anyone. They are computed from the other nine by a fixed formula. That is the check digit: a number derived mathematically from the rest, with a single job — to catch typing mistakes before they turn into a corrupted record.

The idea is old and everywhere: barcodes, a book's ISBN, card numbers (which use the Luhn algorithm), bank accounts. If you mistype one figure or swap two neighbouring ones, the check no longer adds up and the system answers "invalid number" without querying any database.

CPF (the individual taxpayer ID) and CNPJ (the company ID) both use a method called modulo 11. It is particularly good at the two most common human errors when typing long numbers: substituting a single digit (typing 8 where it was 3) and transposing two adjacent figures (typing 21 instead of 12). Because each position is multiplied by a different weight, touching any column changes the final result.

The CPF algorithm step by step (modulo 11)

A CPF has 11 digits: 9 base figures plus 2 check digits. Let's compute the two check digits of 111.444.777-?? and see where the 3 and the 5 come from.

First check digit

Multiply each of the first 9 figures by weights running from 10 down to 2, left to right, and add the products:

Now divide the sum by 11 and look at the remainder: 162 ÷ 11 = 14, remainder 8. The rule is: if the remainder is 0 or 1, the digit is 0; otherwise the digit is 11 minus the remainder. Since 8 is greater than 1, the first check digit is 11 − 8 = 3.

Second check digit

Repeat the process, now over the first 10 figures (including the 3 we just found) with weights from 11 down to 2. The sum is 204. 204 ÷ 11 = 18, remainder 6. So the second digit is 11 − 6 = 5. Done: 111.444.777-35 is a mathematically valid CPF.

To check a number without doing the arithmetic by hand, the CPF Validator runs exactly this algorithm and shows immediately whether the digit matches. To produce test numbers that already carry the correct check digit, use the CPF Generator.

The CNPJ algorithm

A CNPJ has 14 digits: 8 for the root (which identifies the company) + 4 for the branch order (usually 0001) + 2 check digits. The method is the same modulo 11, but the weights differ: they start at 2 and climb to 9, then restart. For the first check digit, the weights applied to the 12 figures are 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2.

Let's validate 11.222.333/0001-??. Multiplying and adding gives 102. 102 ÷ 11 = 9, remainder 3 → first digit = 11 − 3 = 8. For the second digit the weights become 6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2 over the 13 figures: the sum is 120, 120 ÷ 11 = 10, remainder 10 → second digit = 11 − 10 = 1. Result: 11.222.333/0001-81.

The CNPJ Validator automates this calculation. If your problem is only presentation — turning 11222333000181 into the masked form with dots, slash and hyphen — use Format CNPJ, which only applies the punctuation without changing the number.

The new alphanumeric CNPJ

From July 2026, Brazil's tax authority begins issuing alphanumeric CNPJs. The format keeps 14 characters and the same mask, but the first 12 positions (root + branch order) may contain uppercase letters A through Z in addition to digits 0 through 9. The last two positions stay numeric — the check digits are never letters.

The digit calculation changes in one elegant detail: instead of using the value of the figure, it uses the ASCII code of the character minus 48. For digits this changes nothing — '0' has ASCII 48, so 48 − 48 = 0; '9' has ASCII 57, and 57 − 48 = 9. For letters, 'A' becomes 65 − 48 = 17, 'B' = 18, and so on up to 'Z' = 90 − 48 = 42.

Systems that treat the CNPJ as an integer will need to start treating it as text. To test whether your form accepts letters, the Alphanumeric CNPJ Validator applies the ASCII-minus-48 rule and checks the two final numeric digits.

A valid format does not mean the number exists

This is the most common misunderstanding. The check digit proves only internal consistency: that those 11 or 14 figures form an arithmetically coherent combination. It says nothing about the real world. A CPF that passes validation may:

• never have been issued to anyone;
• be suspended, cancelled or pending regularisation;
• belong to someone other than the person filling in the form.

There is also a tricky edge case: sequences of repeated figures, such as 111.111.111-11, actually pass the raw modulo-11 calculation (do the math — both digits match). That is why serious validators explicitly reject every all-same-digit number, even when the arithmetic checks out. Confirming that a document exists and is active requires querying the tax authority's official records — something no local validation can do.

When to use test data instead of real documents

Developers and QA analysts constantly need CPFs and CNPJs that pass validation in order to test forms, imports and reports. The temptation to use your own document — or a colleague's — is strong, and it is exactly what you should avoid.

A real person's document is personal data protected by Brazil's data-protection law (LGPD). Scattering real CPFs across test databases, screenshots, staging spreadsheets and logs creates needless liability. The right alternative is to generate fictitious yet mathematically valid numbers with the CPF Generator and the CNPJ Generator. They produce correct check digits — the form accepts them — without corresponding to any specific person or company.

The healthy workflow in short: generate fictitious data to populate the test, validate with the CPF Validator or the CNPJ Validator to confirm your routine accepts what it should, and reserve queries against official records for production only, with real documents and consent.

Frequently asked questions

Does a CPF that passes validation belong to a real person?

Not necessarily. Validation only confirms that the check digit matches the other nine figures. The CPF may never have been issued, or may be inactive. To know whether it exists and what its status is, you must query the tax authority.

Can I use a generated CPF in a real registration?

No. Generators produce format-valid numbers, but using them to open an account, issue an invoice or impersonate someone is fraud. They exist only for software testing and demonstrations.

Does the alphanumeric CNPJ invalidate the old ones?

No. The new calculation uses the ASCII code minus 48, and for digits that value is the digit itself. Every numeric CNPJ already issued stays valid under the same algorithm, with no change at all.

Why does 000.000.000-00 sometimes "pass"?

Because sequences of identical figures happen to satisfy the modulo-11 arithmetic. They are invalid by business rule, and any correct validator rejects them before even computing the digit.

What is the difference between validating and formatting a document?

Formatting only applies the visual mask (dots, slash and hyphen) without judging whether the number is coherent. Validating runs the check-digit calculation and tells you whether the number is arithmetically consistent. They are independent operations.