How CPF and CNPJ Algorithms Work
CPF and CNPJ are not random number sequences — they contain check digits calculated by a mathematical algorithm based on modulus 11. Understanding this algorithm is fundamental for implementing correct validations in your code.
The structure of the CPF
The CPF (Individual Taxpayer Registry) is composed of 11 digits in the format NNN.NNN.NNN-DV, where the first 9 are the base number and the last 2 (DV) are the check digits. The 9 base digits are assigned by Brazil's Receita Federal and the check digits are calculated from them. CPFs with all identical digits (000.000.000-00, 111.111.111-11, etc.) are invalid by definition, even if the calculated digits happened to match.
The ninth digit of the CPF indicates the state of registration: 1 for DF, GO, MS, MT, and TO; 2 for AC, AM, AP, PA, RO, RR, and TO; 3 for CE, MA, and PI; 4 for AL, PB, PE, and RN; 5 for BA and SE; 6 for MG; 7 for ES and RJ; 8 for SP; 9 for PR and SC; 0 for RS. This is useful for developers who need to filter or segment users by region.
Calculating the first CPF check digit
To calculate the first check digit: multiply each of the first 9 digits by the weights 10, 9, 8, 7, 6, 5, 4, 3, and 2 respectively. Sum all results. Calculate the remainder of dividing by 11. If the remainder is less than 2, the first check digit is 0. If the remainder is 2 or greater, the digit is 11 minus the remainder.
Example with CPF 123.456.789-XX: (1×10) + (2×9) + (3×8) + (4×7) + (5×6) + (6×5) + (7×4) + (8×3) + (9×2) = 10+18+24+28+30+30+28+24+18 = 210. Remainder of 210 divided by 11 = 210 mod 11 = 1. Since 1 < 2, the first check digit is 0. For the second digit, include the first calculated verifier and use weights 11, 10, 9, 8, 7, 6, 5, 4, 3, 2 for the first 10 digits.
The structure of the CNPJ
The CNPJ (National Corporate Taxpayer Registry) has 14 digits in the format XX.XXX.XXX/XXXX-DV. The first 8 digits identify the company (root), the next 4 identify the branch (0001 for headquarters), and the last 2 are check digits. As of July 2026, Brazil's Receita Federal will implement an alphanumeric CNPJ, where the first 12 characters may include letters, but the check digit calculation remains the same.
Like the CPF, CNPJs with all identical digits are invalid. The validation process is similar to CPF but uses two different sets of weights — and it is important to note that the first 12 characters (without check digits) are used in the calculation, not all 14.
Calculating CNPJ check digits
For the first CNPJ check digit, use weights 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, and 2 applied to the first 12 digits. Sum the products, divide by 11, and apply the same rule as the CPF: remainder less than 2 results in 0, otherwise 11 minus the remainder.
For the second digit, use weights 6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, and 2 applied to the first 12 digits plus the first calculated verifier. This different set of weights for each verifier is what makes the CNPJ algorithm slightly more complex than the CPF.
Why do these algorithms exist?
Check digits exist to detect typing errors — which are the most common cause of invalid documents in forms. With two check digits, the CPF detects any transposition of adjacent digits and any single digit change. The modulus 11 algorithm was chosen for being mathematically efficient and having a low collision rate (invalid numbers that accidentally pass validation).
For developers, implementing CPF and CNPJ validation in the frontend layer (before sending to the server) improves user experience and reduces backend load. Implementing it also in the backend ensures malformed data does not enter the database even if someone bypasses frontend validation. Help4Dev offers both generators and validators that you can use to test your implementations.