Pix Key Validator

What are the Pix key types?

Pix works with 5 key types: CPF (11 digits), CNPJ (14 digits), email, phone with country code (+55) and random key in UUID v4 format. From the format alone, the tool figures out which type it is and checks the checksum whenever that applies.

For CPF and CNPJ, we go by the check digits under modulo 11. When the key is an email or phone, it's the format that gets examined. And a random key runs through the UUID pattern check. Note that there's no lookup against the Pix registry here, just a check on the structure.

Validation stays local from start to finish. No key is transmitted.

Pix key: a unique identifier registered in the Central Bank's DICT

A Pix key is a friendly identifier that points to a transactional account inside Brazil's instant payment system. Instead of typing bank code, agency, account number and holder document, the payer enters one short string – the key – and the system retrieves the underlying account details. The infrastructure behind it is the DICT (Diretório de Identificadores de Contas Transacionais), a centralized database operated by the Banco Central do Brasil (BCB). Every institution that participates in Pix queries DICT in real time when a transfer starts.

DICT enforces uniqueness (one key, one account), coordinates portability, mediates ownership claims and – since the 2025 Bacen security overhaul – stores fraud marks that can suspend problematic keys. As of October 2025 the directory held over 901 million keys, mostly from individuals (858 million). A Pix-enabled app resolves a key into the correct account in under a second and settles 24/7. This validator inspects the local structure of a string and decides whether it conforms to one of the five permitted formats – it does not query DICT, so it cannot confirm registration, but it catches typos before you send money to a non-existent address.

The five key types and their formats

Pix accepts five categories of keys, each with a strict format defined in the BCB's Operational Manual for DICT.

• CPF – 11 digits with valid modulo 11 check digits. One CPF can be registered as a Pix key in only one institution at a time.
• CNPJ – 14 digits, also validated by modulo 11. A legal entity can register one CNPJ key per CNPJ root, regardless of branches. New alphanumeric CNPJs (2026) follow the same modulo 11 rule on the digit codes of letters and numbers.
• E-mail – any string fitting the standard mailbox grammar (local-part, at sign, domain with at least one dot). Maximum 77 characters; banks send a verification message before activation.
• Mobile phone – stored in E.164 format (plus sign, country code, area code, subscriber number). Brazilian numbers appear as +55 plus two-digit DDD plus nine digits. Only mobiles that can receive SMS are accepted.
• Random key (EVP) – a 36-character UUID v4 generated by DICT itself, like dbbf965d-677c-49ff-b9da-5131da1505f3, with version 4 and variant in 8/9/a/b. Reveals nothing about the holder – ideal for online vendors and marketplaces.

Quotas: 5 keys per individual account, 20 per business account

A natural person may hold up to five keys per transactional account, in any combination of the five types. A legal entity may hold up to twenty keys per account. Limits are per account, not per person. If a user tries to register a key already linked elsewhere, DICT triggers an ownership claim (reivindicação de posse): the original institution is notified, the user has up to seven calendar days to confirm or deny, and only after the window closes is the key transferred.

Portability: the key belongs to the person, not the bank

Keys are portable. The customer can move a key from Bank A to Bank B by requesting the registration in Bank B; the new institution opens a portability request in DICT, the previous one is notified, and within minutes the link is updated. No fee, no minimum balance, no contract can prevent it. The legal principle is that the customer owns the key; the institution merely hosts it. Vendors and recurring payers do not need to update records when a recipient changes banks.

What this validator checks locally

The tool strips whitespace and tries each type's regex (11 digits for CPF, 14 digits or 12-char alphanumeric for CNPJ, E.164 for phone, RFC-style for e-mail, UUID v4 for random key), then computes modulo 11 check digits for CPF/CNPJ and rejects sequences of repeated characters that pass modulo 11 but are known invalid. It cannot contact DICT, so even a perfectly formatted key may not be registered – always cross-check the recipient name shown by your banking app before confirming.

Fraud patterns to be aware of

Pix moves money in seconds and is largely irreversible, which has made it a prime target for social engineering. The most common patterns reported by Brazilian banks and federal police include:

• Fake bank support call – scammer poses as fraud officer, claims a suspicious key was registered in the victim's name, and asks for a Pix to a "secure account". Banks never ask for transfers to fix anything.
• Counterfeit boleto QR code – the legitimate boleto is intercepted by malware and the QR is replaced with one pointing to a mule account. Visual layout identical; only the destination key changes.
• Phishing for key portability – a forged SMS or e-mail asks to "confirm" the portability of the key. Clicking authorizes a hostile institution to capture it.
• Fake recipient on marketplaces – attacker compromises the seller's chat and swaps the agreed Pix key for their own. The buyer pays the wrong person.
• "Wrong Pix" reversal scam – the victim receives an unexpected Pix and then a call asking for an immediate refund to a different key. The original transfer was made with a stolen account and will later be charged back.

Best practices for choosing and using Pix keys

• For online sales and public profiles, prefer a random key. It exposes nothing about you and can be rotated by deleting and regenerating.
• Reserve CPF and phone keys for trusted circles – they double as personal identifiers and leaking them outside Pix has consequences.
• Never confirm a portability request you did not initiate. If your bank sends an unexpected verification, decline and contact support through the official app.
• Always read the recipient name the app displays before authorizing – a mismatch is the strongest signal something is wrong.
• Enable the nightly Pix limit and trusted-contacts feature available in most banks since 2024.
• If you receive an unsolicited Pix, do not refund it directly. Open a dispute with your bank under the MED (Mecanismo Especial de Devolução).

Frequently asked questions

Does this validator query DICT? No. It only checks local structure (regex, check digits, format). DICT access is restricted to authorized Pix participants.

Why does my random key have 36 characters and not 32? Because the EVP is a UUID v4 in canonical dashed form (8-4-4-4-12 hex digits plus four dashes). Some apps display only the 32 digits, but the full form is what circulates.

Can I have two keys of the same type? Yes, within the per-account quota (5 for individuals, 20 for businesses) and provided each is unique system-wide – e.g. two different e-mails.

What if a key is marked as fraudulent? Since October 2025, the BCB hides keys with a fraud mark from DICT lookups. Transfers fail with explicit error, and the holder must clear the mark through their institution.

Can I receive Pix without a key? Yes. The payer can use a QR code or type bank, agency and account manually. Keys are convenience, not requirement.