Batch CPF Validator

How to validate many CPFs?

Paste your list with one CPF per line, formatted or not, and click validate. The browser runs through the whole thing and gives back a summary counting valid, invalid and the total.

Behind it runs the Receita Federal check-digit algorithm (modulo 11), which also throws out repeated sequences such as 111.111.111-11.

It all happens locally, so no CPF ever leaves your browser.

When to validate CPFs in batch: CRM imports, mailing cleanup and invoice reconciliation

Validating one CPF (the Brazilian individual taxpayer registry number) by hand is trivial, but real operational scenarios rarely involve a single number. The pain begins when you receive a spreadsheet with 500, 5,000 or 50,000 entries from a marketing form, a partner integration, a legacy CRM export or a notes-payable batch. A batch CPF validator separates numerically valid CPFs from those carrying typos, missing leading zeros, trivial sequences such as 11111111111 or stray characters from copy-pasting Excel cells.

Common situations that benefit from a batch validator include: importing a customer base into a new CRM and refusing rows that would crash downstream invoice generation; cleaning a mailing list before a transactional campaign so bounces and compliance complaints stay low; reconciling notes payable where the buyer CPF must match a stored cadastre; deduplicating leads captured across multiple landing pages; and producing CSV files for government portals (eSocial, REINF, DCTFWeb) that reject the whole upload if a single CPF fails the modulo-11 check.

Typical workflow: spreadsheet to invalid-report to manual fix

A practical batch workflow follows a predictable cycle. Start from the source spreadsheet (Excel, Google Sheets, CSV exported from your ERP). Select the CPF column, copy it, paste it into the tool, run the validation and review the report. Valid CPFs proceed to the next stage of the pipeline. Invalid ones go back to the data owner with a clear reason: "wrong check digit", "fewer than 11 digits", "trivial repeating sequence". The data owner corrects them manually, often by contacting the customer or comparing the value against a scanned document.

The loop matters because the validator catches mathematical errors, not authenticity. Cheap batch validation eliminates 95% of typos before any expensive operation (CRM API call, payment gateway, NF-e emission), saving rate-limit budget and human review time. After two or three iterations the spreadsheet converges to a clean state and only then is fed into production.

Types of error you will find

• Wrong check digit caused by a digit transposition when someone retyped the number from a paper document.
• Missing leading zeros. Excel happily strips the leading zero from 012.345.678-90 turning it into 1234567890. The number is still mathematically valid in some cases but loses its 11-digit shape, so a robust validator should left-pad with zeros before testing.
• Mixed formatting: some rows carry the mask 123.456.789-09, others only digits 12345678909, others have stray whitespace or non-breaking spaces. Normalise before comparing.
• Trivial sequences: 00000000000, 11111111111 through 99999999999 pass the modulo-11 math but are explicitly rejected by Receita Federal and by most validation libraries; treat them as invalid.
• CPF/CNPJ mix-up: a 14-digit string in the CPF column means someone pasted a company tax ID. Flag and route to the CNPJ pipeline.
• Unicode look-alikes: punctuation imported from Word may contain en-dash – or full-width digits. Strip everything that is not [0-9] first.

Deduplication: normalise first, compare later

Deduplicating a CPF column is straightforward once you remember that the canonical form is the 11-digit unmasked string. Apply a single regex such as replace(/\D/g, '') to every cell, left-pad with zeros to length 11, and only then build a set. Case-insensitive comparison is irrelevant because the field contains only digits. A common bug is comparing 123.456.789-09 with 12345678909 as raw strings and concluding they are different leads; both are the same individual.

When the spreadsheet links the CPF to other personal data (full name, e-mail, phone), pick a deduplication strategy that resolves conflicts. Keep the most recent record, the most complete record, or the record from the authoritative source. Document the rule because it changes the customer view downstream.

LGPD: a list of CPFs is a personal-data database

Under Brazilian law (Lei 13.709/2018, LGPD), the CPF is personal data. A spreadsheet of CPFs, even without names attached, can identify natural persons through cross-referencing, so it falls inside the law's scope. Three obligations are particularly relevant when running a batch validator:

• Legal basis (Article 7): you must justify why you hold those CPFs. Common bases are contract execution, legitimate interest, legal obligation, or explicit consent. Validating a list you have no right to process does not become legal because you cleaned it.
• Minimisation / necessity (Article 6, III): only keep CPFs you actually need for the declared purpose. After validation, delete the rejected entries you no longer use; do not stockpile invalid data "just in case".
• Security (Article 6, VII): protect the file in transit and at rest. A purely client-side validator that never sends the data to a server is the safest choice; that is the model this tool follows.

Practical takeaway: prefer a browser-only tool, avoid screen-sharing the spreadsheet over public calls, and erase the CSV from desktop and Downloads folders once the import is finished.

Performance: milliseconds locally, please do not hammer Receita

Algorithmic validation of a CPF is two modulo-11 calculations over 11 digits. A modern JavaScript engine can run that against tens of thousands of CPFs in a few hundred milliseconds. The bottleneck is paint and DOM updates, not arithmetic. Lists of 100,000 entries are realistic to validate in the browser without freezing the page if results are rendered in chunks.

What you should never do in batch is query Receita Federal's public consultation portal for every CPF. That endpoint is rate-limited and protected by CAPTCHA, and scripted access violates its terms of use. Commercial APIs such as Serasa, Serpro Datavalid or SintegraWS offer authenticated bulk queries with proper contracts; budget accordingly and only use them when you really need authoritativeness (status, name match, age).

Limits of an algorithmic validator

Remember what this tool does not do. It does not verify that the CPF belongs to a living person, that the holder's name matches a record, that the document is suspended at Receita, or that the person is of legal age. It only confirms that the eleven digits satisfy the official check-digit math. Treat the validator as a syntactic filter; keep an authoritative API call for high-stakes operations such as opening a bank account or emitting a fiscal note.

FAQ

Does the tool send my CPF list to a server? No. All validation runs in your browser. The list never leaves the device.

How do I handle CPFs that lost their leading zero in Excel? Before pasting, format the column as text in Excel or paste into the tool which left-pads to 11 digits before evaluating.

Why does 11111111111 show as invalid if the math works? Eleven repeated digits all pass the check-digit calculation, but Receita Federal does not issue such numbers; standard practice is to reject them as invalid.

Can I paste a column with mixed CPF and CNPJ? The validator focuses on the 11-digit CPF format. Rows with 14 digits will be flagged as invalid; separate them and use a CNPJ validator for those.

What is the largest batch I should validate at once? Browsers handle 50,000 to 100,000 lines comfortably. For larger sets, split into chunks and concatenate the reports.