CPF Validator

How does CPF validation work?

Validation runs on the check-digit algorithm used by Brazil's Federal Revenue (Receita Federal). A CPF carries 11 digits: the first 9 make up the base number, while the last 2 act as control digits, derived through weighted multiplication with modulo 11.

When the check digits fail to match the calculation, the CPF counts as invalid. A repeated sequence like "111.111.111-11" gets flagged too: it clears the formatting mask but breaks down under the mathematical algorithm.

The whole check happens inside your own browser. No CPF you type here ever reaches a server or gets logged anywhere.

The CPF (Cadastro de Pessoas Fisicas): origins and the role of the Receita Federal

The CPF (Cadastro de Pessoas Fisicas) is the unique identifier the Brazilian federal tax authority assigns to every natural person with tax obligations or formal links to Brazilian institutions. Often compared to the US Social Security Number, the CPF has wider everyday reach: it ties a citizen to bank accounts, health plans, school enrollments, real estate deeds, vehicles, electoral records and loyalty programs.

Created by Law 4.862/1965 as a centralized registry for income tax, and consolidated by Decree-Law 401/1968, when the modern CPF replaced earlier taxpayer cards. The first physical CIC cards shipped in 1970. Since then the document evolved from a purely fiscal tool into the de facto national identifier of Brazil.

The Receita Federal do Brasil (RFB) is the only authority that can issue, suspend, regularize or cancel a CPF, operating through branches, partner banks (Banco do Brasil, Caixa), Correios and consulates. Since 2018, newborns can be registered for a CPF directly at the birth registry.

Anatomy of the 11 digits: 9 base + 2 check digits

A CPF is composed of 11 decimal digits, conventionally displayed in the mask XXX.XXX.XXX-XX. The structure can be split as follows:

• Digits 1 to 8: pseudo-random sequence generated by the Receita Federal at registration time. They carry no public meaning and are not derived from name, birth date or address.
• Digit 9: indicates the regiao fiscal (fiscal region) where the taxpayer was first registered. The country is split into 10 fiscal regions, numbered 0 to 9.
• Digits 10 and 11: the two digitos verificadores (check digits, DV1 and DV2), computed from the previous nine digits via the modulo 11 algorithm.

Fiscal region mapping per the RFB: 0 RS; 1 DF, GO, MT, MS, TO; 2 AC, AM, AP, PA, RO, RR; 3 CE, MA, PI; 4 AL, PB, PE, RN; 5 BA, SE; 6 MG; 7 ES, RJ; 8 SP; 9 PR, SC. The 9th digit is immutable: even when the holder moves between states, the original fiscal region stays encoded for life.

The modulo 11 algorithm step by step

The check-digit logic is purely arithmetic. The choice of 11 as modulus is not arbitrary: 11 is prime, which maximizes error detection in adjacent-digit transpositions.

First check digit (DV1)

• Multiply the first 9 digits, in order, by weights 10, 9, 8, 7, 6, 5, 4, 3, 2.
• Sum the products and compute the remainder modulo 11.
• If the remainder is less than 2, DV1 = 0; otherwise DV1 = 11 minus the remainder.

Second check digit (DV2)

• Append DV1 to the first 9 digits and multiply by weights 11, 10, 9, 8, 7, 6, 5, 4, 3, 2.
• Sum, take modulo 11 and apply the same rule.

Worked example on base 667.556.317: DV1 weighted sum is 294; 294 mod 11 = 8; DV1 = 11 - 8 = 3. DV2 weighted sum is 346; 346 mod 11 = 5; DV2 = 11 - 5 = 6. Final CPF: 667.556.317-36.

Why numbers like 111.111.111-11 pass the math but are invalid

CPFs composed of a single repeating digit (000.000.000-00, 111.111.111-11, ..., 999.999.999-99) satisfy the modulo 11 formula because the algebraic structure is symmetric. The Receita Federal explicitly blacklists all repeating-digit sequences, so any serious validator must reject them even though they pass arithmetic verification. This tool already implements that exclusion.

More importantly, the modulo 11 test only confirms that a sequence is well-formed. It does not prove that the number was issued, that it is currently regular, or that it belongs to the person presenting it. Confirming those facts requires queries to the official RFB endpoint or to authorized bureaus such as Serasa, Boa Vista or Quod.

Where the CPF is mandatory in Brazil

The list of situations that legally require a CPF covers nearly every interaction with public and private institutions:

• Filing income tax and any RFB declaration.
• Opening bank, brokerage or digital wallet accounts.
• Issuing or receiving an electronic invoice (NF-e, NFC-e, NFS-e).
• Buying real estate, vehicles, firearms and other registered goods.
• Enrolling in schools and universities (ENEM, SISU).
• CLT employment, FGTS, PIS and INSS benefits.
• Health plans, dental plans and life insurance.
• Electoral registration with the TSE.
• Domestic flights and some land borders.
• Social-welfare programs (Bolsa Familia, Auxilio Brasil).
• Newborn CPF at the birth registry, since 2018.

CPF and the LGPD: legal status and best practices

Under Law 13.709/2018 (LGPD), the CPF is personal data but not sensitive personal data — Article 5, II reserves that category for racial origin, health, sexual life, religion, political views, biometrics and genetics. Even so, the CPF identifies a unique natural person and is subject to all general LGPD requirements: purpose limitation, necessity, transparency, security and accountability.

In practice, a company must (i) tell users why it is collecting the CPF, (ii) rely on a valid legal basis from Article 7 (consent, contract, legal obligation, legitimate interest, fraud prevention), (iii) collect only what the purpose requires and (iv) protect the number with encryption at rest, access control and log auditing. The ANPD can fine non-compliant organizations up to 2 percent of Brazilian revenue, capped at R$ 50 million per infraction.

Common fraud patterns and the limits of online validators

Because the CPF unlocks credit, benefits and contracts, it is a constant fraud target. Main vectors:

• CPF cloning: criminals open accounts using a real number leaked or stolen.
• Fake validators and giveaways: sites that harvest the CPF for resale.
• SIM swap: hijacking the phone line to bypass SMS authentication.
• Pix and boleto scams: forged payment instruments tied to a real CPF.

This validator runs local, offline arithmetic verification: nothing is sent to a server and the RFB is not queried. Any browser-based tool can only confirm the math. To know whether a CPF actually exists and is regular, use the official Comprovante de Situacao Cadastral on the RFB portal or contract a credit-bureau API. Be wary of free services that claim to check "in real time" against the RFB database — most are scrapers that violate the LGPD.

FAQ

Does this validator store the CPF I type?

No. The calculation runs entirely in your browser. No HTTP request is made with the digits and no server-side log is recorded.

Can I confirm the CPF belongs to a real person?

No. The tool only confirms the 11 digits form an arithmetically valid sequence. Ownership and regularity require official RFB channels or a licensed credit bureau.

Is it legal to validate other people's CPFs?

Yes, with a legitimate purpose (onboarding, fraud prevention, contract signing) and LGPD principles respected. Mass validation of unsolicited lists may breach the LGPD.

Why does my CPF start with a 0?

Leading zeros are valid and significant. Some systems strip them, causing false negatives. Always type the full 11 digits.

Can the same CPF be issued to two people?

No. The RFB guarantees uniqueness and the number is non-transferable. Even after death, the CPF is not reassigned — it is marked as deceased.