CNPJ Validator

How does CNPJ validation work?

A CNPJ has 14 digits. The first 8 identify the company, the next 4 indicate the branch (0001 is the headquarters) and the last 2 are check digits that the Receita Federal calculates through weighted multiplication with modulo 11.

When the check digits don't match the calculation, the CNPJ is invalid. The same goes for sequences with all digits identical, like "00.000.000/0000-00", which passes the mask but doesn't survive the mathematical algorithm.

All the checking happens inside your browser. No CNPJ typed here ever reaches a server.

CNPJ validation: the modulo 11 algorithm in depth

The CNPJ (Cadastro Nacional da Pessoa Juridica) is the federal identifier the Receita Federal assigns to legal entities and certain contractual arrangements in Brazil. It carries 14 digits, formatted as XX.XXX.XXX/YYYY-ZZ: 8 digits identify the company root (matriz), 4 digits identify the branch (filial — 0001 is always the matriz), and the final 2 digits are check digits (DV1 and DV2) calculated with the modulo 11 algorithm.

A pure offline validator — like this one — runs the arithmetic on the 12 first digits and confirms that the 13th and 14th positions match the values produced by the algorithm. It does not confirm that the company actually exists or is active before the tax authority; that requires an online query against the Receita Federal database (directly or via a proxy such as BrasilAPI).

Computing DV1

Take the first 12 digits and multiply, in order, by the weight vector 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2. Sum the products, compute the remainder modulo 11; if the remainder is less than 2, DV1 = 0; otherwise DV1 = 11 minus the remainder.

function dv1(digits) {
  const weights = [5,4,3,2,9,8,7,6,5,4,3,2];
  const sum = digits.slice(0,12)
    .reduce((acc, d, i) => acc + d * weights[i], 0);
  const r = sum % 11;
  return r < 2 ? 0 : 11 - r;
}

Computing DV2

Append DV1 to the first 12 digits and multiply the resulting 13-digit string by the weight vector 6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2. Apply the same modulo 11 rule. A CNPJ is arithmetically valid when DV1 and DV2 produced by the formula match positions 13 and 14 of the candidate.

Mathematically valid but rejected sequences

CNPJs formed by a single repeating digit (00000000000000, 11111111111111, ..., 99999999999999) satisfy the algebra of the modulo 11 algorithm. The Receita Federal blacklists every uniform-digit sequence, so a robust validator must reject them explicitly — this tool does. The same applies to other documents in the same family (CPF, CNH, PIS).

Offline validation vs Receita Federal lookup

Validating a CNPJ has two very different meanings:

• Offline (mathematical): confirms the format and the check digits. Runs in microseconds, no network, no rate limit. Suitable for input masks, regex pre-checks and high-volume batch jobs.
• Online (cadastral): confirms that the company exists, is active, and returns trade name, address, CNAE codes and partners. Requires a query to the Receita Federal (SOAP CSC/CDS legacy or REST modern), to brasilapi.com.br/api/cnpj/v1/{cnpj} (free, rate-limited) or to commercial bureaus (Serasa, Boa Vista, Quod).

A common architecture is to cheap-fail first: run the offline check on every submission, only spend the network round-trip when the math passes. This easily reduces API spend by 80% on dirty user-typed input.

Frontend integration patterns

A user-friendly CNPJ field on the web is typically built with three layers:

• Input mask: format as the user types — 00.000.000/0000-00. Vanilla JS, IMask.js or React libraries like react-input-mask handle this cleanly.
• Regex pre-validation: a quick /^\d{14}$/ check after stripping punctuation. Useful as an HTML5 pattern attribute.
• Check-digit validation on blur: never on every keystroke — the calculation is cheap but firing it on each keypress causes flicker and false-error UX. Debounce or wait for blur.

In React, react-hook-form integrates well with schema validators like Zod or Yup. A custom resolver wraps the modulo 11 function and surfaces an error message under the field:

import { z } from 'zod';
import { cnpj } from 'cpf-cnpj-validator';

const schema = z.object({
  cnpj: z.string().refine(cnpj.isValid, {
    message: 'CNPJ invalido',
  }),
});

Popular JS libraries: cpf-cnpj-validator, brazilian-values, @brazilian-utils/brazilian-utils. On the backend Node side, the validator package does not ship CNPJ logic — pick one of the dedicated libraries above or import a small custom function.

The alphanumeric CNPJ rollout (July 2026)

Normative Instruction RFB 2.229/2024 introduces an alphanumeric CNPJ starting in July 2026. The total length stays at 14 characters but the first 12 may include uppercase letters A-Z in addition to digits. The check digits (positions 13 and 14) remain numeric and are still computed with the same modulo 11 algorithm, after a deterministic transliteration: each letter is mapped to its codePointAt(0) - 48 ASCII value, so A becomes 17, B becomes 18, and so on.

All existing numeric CNPJs remain valid forever — they are a subset of the new format. Software that hard-coded a numeric-only regex (/^\d{14}$/) will break: legacy ERPs, accounting suites, NF-e issuers and ETL pipelines all need an update before July 2026. The Receita has published reference implementations in C#, Java and Python.

Branch numbering and the matriz convention

Positions 9 to 12 carry the filial (branch) number. By convention 0001 is the matriz (head office) and additional branches are numbered 0002, 0003, etc. A company with N branches therefore exposes N + 1 distinct CNPJs sharing the same 8-digit root. When integrating with the Receita, each filial has its own cadastral record, address and CNAE, even though tax obligations may consolidate at the matriz.

CNPJ and the LGPD

Under Brazilian law, the CNPJ is data of a legal entity, not a natural person. The LGPD (Law 13.709/2018) protects personal data — information that identifies or makes identifiable a natural person. A pure CNPJ, isolated from any partner CPF, falls outside the LGPD scope and can be freely consulted, shared and stored. The Receita Federal provides a public CNPJ portal precisely for that reason.

Caution: the QSA (Quadro de Socios e Administradores) linked to the CNPJ contains CPFs and names of partners — those are personal data and are subject to LGPD principles of purpose, minimization and security.

FAQ

Does this tool confirm the CNPJ exists at the Receita?

No. It runs an offline mathematical check of the modulo 11 digits. To confirm cadastral existence, query the Receita Federal directly or use a proxy such as BrasilAPI (brasilapi.com.br/api/cnpj/v1/{cnpj}).

Will my numeric CNPJ stop working in 2026?

No. Existing numeric CNPJs remain valid indefinitely. The 2026 change opens the door to alphanumeric new issuances; legacy data is unaffected.

Is there a free public CNPJ lookup API?

Yes. BrasilAPI proxies Receita data with sane rate limits and no key. For higher volume use commercial bureaus or the official RFB integrated APIs (with contract).

Can the same root have CNPJs in different states?

Yes. Each filial may sit in a different UF. The address and inscricao estadual are registered per filial; the root is national.

Should I validate the CNPJ on every keystroke?

No. Validate on blur or after a 300 ms debounce. Running the algorithm on each input event is cheap but produces poor UX, flashing errors while the user is still typing.