Pix Key: The Types, How to Validate It and the Pix QR Code

The five types of Pix key

A Pix key is a nickname. Instead of handing over your bank, branch and account number to receive a transfer, you register a key that points to that account, and whoever pays you only needs the key. Pix is Brazil's instant-payment system, run by the Central Bank since 2020, and it defines five key types. One account can hold several: individuals can register up to 5 keys per account, businesses up to 20.

• CPF — the Brazilian individual taxpayer ID, just its 11 digits.
• CNPJ — the company tax ID, 14 digits.
• Phone — the mobile number, with area code and country code.
• Email — any valid email address.
• Random key — also called EVP (Virtual Payment Address), a string generated by the bank that reveals nothing about you.

Each key can be linked to only one account at a time. If you try to register your CPF as a key and it already lives in another bank, the system offers to "port" it. The random key is the only one you can mint freely (up to the account limit) without exposing any personal data — handy for pasting into a public post or a fundraiser.

How each key is formatted (CPF, phone, email, random)

The detail that trips up nearly everyone is that the format you type into the app is not necessarily the format the system stores. DICT — the Central Bank's directory of keys — keeps everything normalized: no punctuation on the CPF, an international prefix on the phone, lowercase on the email.

The phone follows the international E.164 standard: +55 (Brazil), then the two-digit area code and an eight- or nine-digit number. The random key is a version-4 UUID: 32 hexadecimal characters grouped 8-4-4-4-12 and separated by hyphens, 36 characters in all. Notice the digit that opens the third block — in a v4 UUID it is always 4.

How to validate a key before saving it

Validating a key's format heads off the silly mistake of mistyping a number and sending money into the void. Each type has its own rule:

• CPF and CNPJ — beyond the digit count, they must pass the modulo-11 check digit. A CPF like 111.111.111-11 has the right shape but fails the math; it is invalid.
• Phone — must start with +55, carry an area code that actually exists (11 to 99, with gaps), and have the right number of digits.
• Email — valid syntax, with a local part, an @ and a domain. Pix caps the email at 77 characters.
• Random — must match the v4 UUID pattern exactly, including the version 4 and the variant character (8, 9, a or b) at the start of the fourth block.

The Pix Key Validator detects the type automatically and applies the right rule, including the modulo-11 check on CPF/CNPJ. But keep one caveat in mind: validating the format does not confirm that the key belongs to who you think, or that the account is active. Only your bank's app settles that, by showing the recipient's name before you confirm. Always read that name.

What the BR Code is (the Pix QR payload)

A Pix QR code is no magic — underneath it sits plain text. That text follows the BR Code standard, Brazil's adaptation of EMVCo's QR specification (the same one behind contactless card payments). The structure is a run of fields in TLV format: Tag (two digits identifying the field), Length (two digits with the size of the value) and Value (the content itself).

Here is a real static Pix QR charging R$ 10.00 to the phone +5511999998888:

Reading the fields one by one:

The last field, tag 63, is a CRC16-CCITT computed over everything before it (including the characters 6304). It acts as a check digit for the whole QR: change a single character in the payload and the CRC no longer matches, so the app rejects the code. In the example above the CRC comes out to 8882 in hexadecimal.

Copy-and-paste Pix, from the inside

The famous "Pix copy and paste" is, literally, this same BR Code text. The QR code is just a visual way to carry the string; when the app cannot read the camera, it accepts the pasted text and arrives at the very same result. They are two representations of one piece of data.

BR Codes come in two flavors:

• Static (tag 01 = 11) — the one used in the example. Reusable, with a fixed or open amount, usually carrying *** in the identifier field. This is the code you print and tape to the counter.
• Dynamic (tag 01 = 12) — generated per charge. Instead of the raw key, field 26 carries a bank URL; the payer's app fetches that URL and pulls the amount, due date and order data in real time. This is what appears at e-commerce checkouts.

Because copy-and-paste is plain text, it is also the place to stay alert against fraud: a scammer can send you a tampered string. That is why the app always shows the recipient's name and details before you confirm — that screen, not the QR, is where you check who the money is going to.

Generating and decoding a Pix QR code

To create a charge you do not have to assemble the TLV string by hand. The Pix QR Code Generator asks for the key, the recipient's name, the city and an optional amount, builds the payload in the BR Code standard, computes the CRC16 and hands you a QR ready to print or share.

For the reverse trip — you received a copy-and-paste string and want to see where it points before paying — the Pix Decoder unpacks each TLV field and shows the embedded key, amount, name and city, and confirms whether the CRC checks out. It is a good way to inspect a suspicious code without opening your bank app.

And if your need is generic — a link, some text, a contact — rather than a Pix charge, the QR Code Generator handles any content. The QR is only an envelope; what changes is the standard of what goes inside it.

Frequently asked questions

Can I have more than one Pix key?

Yes. Individuals can register up to 5 keys per account and businesses up to 20. You can mix the types — for instance, CPF, email and a random key on the same account — but each individual key can be linked to only one account at a time.

Is the random key more secure?

More discreet, mainly. Because it reveals no CPF, phone or email, it is the ideal choice for posting somewhere public, like a raffle or an ad, without spreading your personal data. The security of the transfer itself is the same across all key types.

Does validating the key format guarantee the money reaches the right person?

No. The Pix Key Validator only confirms that the key is well formed (and that the CPF/CNPJ passes its check digit). The destination is guaranteed by your bank's app, which queries DICT and shows the account holder's name before you confirm. Always check that name.

Why can two different Pix QR codes point to the same key?

Because the QR carries more than the key: amount, name, city, charge identifier and the type (static or dynamic). Change any of those fields and the payload changes — and with it the CRC16 and the QR image. The key underneath stays the same.

Is Pix copy-and-paste different from the QR code?

No, it is the same content. The copy-and-paste is the BR Code text itself; the QR code is just the graphic version of that text. Pasting the code or scanning the image leads to exactly the same charge.