Brazil CPF check digits
Enter the nine digits 529982247 and get check digits 25, so the full CPF is 52998224725; or paste eleven digits to see whether the last two match. Placeholders such as 11111111111 are flagged as invalid. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Number
- 529982247
- Calculation mode
- Compute
- Input
- 529982247
- Check digits
- 25
- Check digit 1
- 2
The Brazilian CPF (Cadastro de Pessoas Físicas) is an eleven-digit tax identifier used across banking, payroll, e-commerce, and government forms. Nine digits identify the person; the last two are check digits derived from a fixed mod-11 formula so that single mistypes and many transpositions fail instead of looking like another valid registration. This capability computes those two check digits from a pure nine-digit base, or validates a complete eleven-digit CPF and reports whether the stored pair matches the recomputed value. Repeated-digit strings such as all zeros or all ones are treated as invalid under Brazilian rules even when the arithmetic would pass.
How Brazilian CPF check digits are calculated
A CPF is always eleven decimal digits when written without punctuation. The first nine form the base registration; the tenth and eleventh are verificadores. To obtain the first check digit, multiply each of the nine base digits by the descending weights ten through two, sum the products, take that sum modulo eleven, and map the remainder: if the remainder is less than two the digit is zero, otherwise the digit is eleven minus the remainder.
To obtain the second check digit, append the first check digit to the nine base digits and repeat the same mod-11 process with weights eleven down through two. Validation is the inverse: recompute both digits from the first nine characters and compare them to the last two. Official practice also rejects CPFs in which every digit is identical—for example 00000000000 or 11111111111—because those strings satisfy the arithmetic for some weight patterns yet are not issued as real identifiers.
What you can do with it
Audit CPF columns in bulk exports
Batch-validate every CPF in a payroll CSV or ERP extract and quarantine rows whose check digits no longer match the recomputed pair or are repeated-digit placeholders.
FAQ
What are Brazilian CPF check digits?
They are the tenth and eleventh digits of a CPF, computed from the first nine with official mod-11 descending weights so single-digit typos and many transpositions are far more likely to fail validation than to look like another registration.
What happens with letters, dots, hyphens, or wrong lengths?
Failed validation tasks are not billed. Strip formatting such as XXX.XXX.XXX-XX in your client before calling.
Is the Brazil CPF check digits tool free?
The browser tool is free and runs locally.
Why is a CPF like 11111111111 marked invalid?
Strings such as 00000000000 or 11111111111 can satisfy the arithmetic, yet they are never issued as real identifiers. Following official practice, the tool marks them as invalid.
How is the second CPF check digit calculated?
Append the first check digit to the nine base digits, multiply the ten digits by the weights 11 down to 2 and add them up. A remainder below 2 gives 0; otherwise the digit is 11 minus the remainder.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/cpf-brazil \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"number":"529982247"}'const res = await fetch("https://api.kit.forhosting.com/enc/cpf-brazil", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"number": "529982247"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/cpf-brazil",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"number": "529982247"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/cpf-brazil", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"number":"529982247"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"number":"529982247"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/cpf-brazil", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"number": "529982247"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.cpf_brazil",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Non-numeric characters, wrong lengths, and empty input are rejected with a clear invalid_input error. Run it free in the browser or call the KIT API; both paths share the same pure arithmetic with no network round-trip and no stored registries.
How Brazilian CPF check digits are calculated
Because the algorithm is pure integer modular arithmetic with fixed weights, the same nine digits always produce the same pair of check digits on every platform—browser, Worker, or offline test harness—which is why the capability ships as a tier-A parse engine rather than a model call.
How to compute check digits or validate a full CPF
Send a number field that contains only characters zero through nine. Mode validate expects exactly eleven digits. Empty strings, missing number, invalid mode values, and wrong lengths (for example eight or twelve digits) fail before any weighted sum runs and are not billed. Spaces, dots, hyphens, letters, and decimal points are rejected as non-numeric input with invalid_input so a form never accepts a silently cleaned value—strip punctuation in your client if users type the familiar XXX.XXX.XXX-XX mask. Mode compute is the default: provide exactly nine base digits; the engine returns check_digits as a two-character string, check_digit_1 and check_digit_2 separately, cpf as the full eleven-digit code, and length eleven. The response reports valid true only when the trailing pair matches the recomputed expected_check_digits and the string is not an all-identical digit run; it always includes base (the first nine digits), check_digits as submitted, expected_check_digits, and the canonical cpf built from base plus expected pair. That shape makes it easy to show “you typed XY, expected AB” in a KYC or signup UI without a second request. Because the path is pure parse with no clock, random source, or network, the same input always yields the same JSON on the free browser tool and on the API. At $0.002 per successful request you can protect bulk CRM imports, partner file audits, and form gates without negotiating a custom tier.
Where CPF check digits fit real product workflows
Brazilian fintech and marketplace onboarding flows ask for a CPF early; validating check digits on blur reduces failed submissions and support tickets without calling a government registry for every keystroke. Payroll and HR systems import employee CSVs and should quarantine rows whose eleventh digit no longer matches, which catches both human edits and off-by-one bugs in upstream generators. Do not treat a passing check digit as proof that the person exists in Receita Federal systems or that the document is active—it only proves the eleven-digit string is arithmetically well formed under the CPF rule and is not a repeated-digit placeholder, the same honesty bar you apply to any tax-id checksum tool. E-commerce checkout that accepts CPF as a tax ID can block proceed until valid is true and show expected_check_digits when the pair is wrong. Data-quality jobs recompute expected_check_digits for every CPF column in an export and flag mismatches before they reach billing or fiscal reporting.
Integration use cases
Complete nine base digits for fixtures and forms
Take a nine-digit base from a test plan or partial record, call compute mode, and store or display the full eleven-digit cpf with both check digits appended.
Validate typed or imported CPFs at entry
When a signup form, CRM import, or partner API submits eleven digits, call validate mode and block storage when valid is false, showing expected_check_digits to fix a mistype.
Technical questions
How do I compute CPF check digits with this API?
POST with number set to exactly nine digits and mode compute (or omit mode). The response includes check_digits, check_digit_1, check_digit_2, and cpf (the full eleven-digit code).
How do I validate a full eleven-digit CPF?
POST with the eleven-digit string and mode validate. The response includes valid, check_digits, expected_check_digits, base, and the canonical cpf.