Batch CNPJ Validator

How to validate many CNPJs?

Paste your list with one CNPJ per line, formatted or not, and click validate. All the processing happens right in your browser.

The check applies the check-digit algorithm by modulo 11 with cyclic weights, and it handles the new alphanumeric format as well.

Runs 100% locally.

What batch CNPJ validation is for

The CNPJ (Cadastro Nacional da Pessoa Jurídica) is the unique identifier Brazil's Federal Revenue Service assigns to every legal entity in the country: companies, branches, sole proprietors, non-profits, public bodies, condominiums and foreign entities. Whenever your operation handles dozens, hundreds or thousands of such identifiers, validating them in bulk first is the difference between clean data and an avalanche of downstream errors.

Typical scenarios include supplier onboarding (verifying that every vendor in a procurement spreadsheet has a structurally correct identifier), due diligence on acquisitions, fiscal reconciliation (matching CNPJs on invoices against the general ledger), import and export of NF-e, NFS-e and CT-e XML files, CRM lead enrichment and migration of legacy databases full of decades-old typos. Catching a wrong digit here costs seconds; catching it after a payment was routed to the wrong account costs hours of rework and reputational risk.

This validator runs entirely in the browser. Each line is normalised, checked against the check-digit algorithm and classified. No identifier is transmitted to any server, which matters when the list is a confidential prospect pipeline or an NDA-covered supplier base.

CNPJ structure: 14 positions, three blocks

A CNPJ has fourteen characters split into three semantic blocks. The first eight positions form the root and identify the legal entity itself. The next four positions identify the establishment: the headquarters is always 0001 and each additional branch is numbered sequentially (0002, 0003, and so on). The last two positions are the check digits, calculated from the previous twelve characters.

The standard display mask is XX.XXX.XXX/XXXX-XX, but the punctuation is purely cosmetic. When the system stores or transmits the value, only the fourteen characters matter. A robust validator strips dots, slashes and hyphens before doing anything else and accepts both the masked and the unmasked form interchangeably.

The modulus 11 check-digit algorithm

The two check digits are produced by the classic modulus 11 algorithm. The first digit is computed by multiplying the first twelve characters by the weights 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2, summing the products, dividing by 11 and subtracting the remainder from 11. If the result is 10 or 11, the digit is 0; otherwise it is the result itself. The second digit follows the same procedure over the first thirteen characters using the weights 6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2.

Purely repetitive inputs such as 00.000.000/0000-00 or 11.111.111/1111-11 satisfy the formula by accident, so production validators reject those sequences explicitly even though the arithmetic checks out.

Alphanumeric CNPJ (RFB Normative Instruction 2,229/2024)

In October 2024 Receita Federal published Normative Instruction RFB 2,229, which introduces the alphanumeric CNPJ. The change takes effect in July 2026 and addresses a practical problem: the pool of purely numeric combinations is nearing exhaustion. From that date the first eight positions (the root) and the four positions that identify the establishment may contain letters A to Z in addition to digits. The two final positions remain numeric because they are the check digits.

The check-digit calculation continues to use modulus 11 with the same weights, but the conversion of each character changes. Digits keep their value. Letters are converted using the ASCII code minus 48: A becomes 17, B becomes 18, and so on up to Z = 42. Once every character is converted, the algorithm proceeds as before.

Two reassurances matter. First, existing CNPJs are not migrated: every numeric identifier issued before July 2026 stays valid forever with its original check digits. Second, the visual mask is preserved, so layouts already reserving fourteen positions plus punctuation keep rendering correctly. Validators, however, must accept letters in the first twelve positions or they will reject legitimate identifiers issued from 2026 onward.

Structural validation versus registry consultation

A structurally valid CNPJ is not necessarily an active business. The algorithm only proves the fourteen characters are internally consistent; it says nothing about whether Receita Federal issued that identifier or whether the company is operating. Receita classifies each CNPJ by registry status: Ativa, Suspensa, Inapta (typically missing declarations), Baixada (closed) or Nula.

A well-designed batch workflow uses the two layers in sequence. The mathematical validator weeds out typos cheaply and offline; only survivors are sent to the registry API. This cuts API quota use and avoids paying for lookups doomed from the start.

Public APIs and rate limiting

Several public and commercial APIs expose CNPJ registry data. BrasilAPI offers a free community-maintained endpoint, excellent for prototypes and small batches but without SLA and subject to 429 errors at peaks. ReceitaWS is widely used and historically caps the free tier around three queries per minute, with paid plans for higher throughput. MinhaReceita, SintegraWS, CNPJa and CNPJ.ws provide commercial tiers with predictable throughput. Some teams build a fallback chain that switches provider on 429 or 5xx, which materially improves resilience.

For very large batches, downloading Receita Federal's official open data dump and loading it locally is the most reliable option: several gigabytes but no rate limits, refreshed monthly.

A practical batch workflow

• Export the CNPJ column from the source system (CSV, XLSX, ERP query) and paste it into the validator.
• Run the algorithmic check and separate the valid list from the invalid list.
• Send the invalid entries back to the data owner for correction, ideally with the exact reason (wrong length, failed check digit, repetitive sequence).
• For each valid CNPJ, query a registry API to retrieve company name, status, address, primary CNAE and partners.
• Cross-reference the API response with the source system: flag mismatched legal names, closed registrations or addresses that no longer match.
• Store both the raw input and the API response in an audit table so the same identifier is not queried twice in the same day.

CNPJ and the LGPD

The CNPJ itself is public and Brazilian law allows it to be processed without explicit consent. However, data associated with it may include personal information about partners, administrators and contacts, which is protected by the LGPD. When a batch pipeline enriches CNPJs with partner names or personal documents, those fields fall under the same regime as any other personal data: define a clear legal basis, retain only what is necessary and document the processing.

FAQ

Does this tool send my CNPJ list to any server?

No. The validation runs in your browser using JavaScript. Nothing is uploaded, logged or stored anywhere.

Will alphanumeric CNPJs be accepted from 2026?

Yes. The validator implements the modulus 11 calculation with the ASCII-minus-48 conversion required by Normative Instruction RFB 2,229/2024, so both legacy numeric identifiers and new alphanumeric ones are recognised.

Why is a structurally valid CNPJ shown as inactive elsewhere?

Because the algorithm only proves internal consistency. To know whether the company is operating, query the Federal Revenue Service registry through one of the APIs listed above.

Is there a maximum batch size?

Performance is bounded only by the browser. Lists of tens of thousands of entries are processed in a few seconds on modern hardware.

Why are sequences like 11.111.111/1111-11 rejected?

Repetitive sequences satisfy the modulus 11 formula by mathematical accident but are never issued by Receita Federal, so production validators reject them explicitly.