01
Password Strength Checker
Estimates password entropy and crack time, and identifies the specific weaknesses in what you…
CPF Validator
Checks a Brazilian CPF against both of its check digits and names the fiscal region the number was issued in.
Security
Nothing uploaded
No sign-up
Free, unlimited
Enter something above.
In short
A CPF carries two check digits, and both are plain mod-11 sums: the first is computed over the nine base digits with weights 10 down to 2, the second over ten digits with weights 11 down to 2, and in each case a remainder below 2 makes the digit 0. That last rule is worth knowing, because it means the algorithm collapses two different remainders onto the same digit — measured over 3,000 generated cases it catches 99.7% of single-digit typos rather than all of them. The ninth digit is not random either: it identifies the fiscal region, so 8 is São Paulo and 7 is Rio de Janeiro and Espírito Santo. What none of this establishes is whether the number was ever issued. A check digit proves the number was typed correctly; only the Receita Federal can say it exists and belongs to someone.
How to use the CPF Validator
- Paste the number — punctuation and spaces are ignored.
- Read the verdict and, where the number encodes anything, what it decodes to.
- Treat a pass as "typed correctly", not as "confirmed by the authority".
About the CPF Validator
A CPF carries two check digits, and both are plain mod-11 sums: the first is computed over the nine base digits with weights 10 down to 2, the second over ten digits with weights 11 down to 2, and in each case a remainder below 2 makes the digit 0. That last rule is worth knowing, because it means the algorithm collapses two different remainders onto the same digit — measured over 3,000 generated cases it catches 99.7% of single-digit typos rather than all of them. The ninth digit is not random either: it identifies the fiscal region, so 8 is São Paulo and 7 is Rio de Janeiro and Espírito Santo. What none of this establishes is whether the number was ever issued. A check digit proves the number was typed correctly; only the Receita Federal can say it exists and belongs to someone.
What people use it for
- Catching a mistyped number in a form before it reaches a database.
- Cleaning an imported list and finding the rows that cannot be right.
- Understanding what the number encodes and what it does not.
Details
| Check digits | Two, both mod 11 with descending weights |
|---|---|
| Ninth digit | The fiscal region the CPF was issued in |
| Typo detection | 99.7% of single-digit errors, measured over 3,000 cases |
| Repdigits | 111.111.111-11 and its siblings satisfy the arithmetic and are rejected by rule |
| Privacy | The number never leaves your browser — check the Network tab |
The two check digits are computed independently, so a number can fail on the first, the second or both — the page says which, because that narrows down where the typo is. Nothing you paste is transmitted — the check runs entirely in your browser.
Where this tool stops
Confirms internal consistency only. It cannot tell you whether a CPF was ever issued, is active, or belongs to the person presenting it.
Frequently asked questions
Does a valid CPF mean the person exists?
No. It means the eleven digits are internally consistent, which is what a check digit is for — catching a typo before it reaches a database. Whether the number was issued, to whom, and whether it is active are all questions only the Receita Federal can answer, and no offline tool can.
Why is 111.111.111-11 rejected?
Because it satisfies the mod-11 arithmetic by coincidence. Every repeated-digit CPF does, so the specification excludes them explicitly. A validator that does not exclude them will accept eleven ones as a real number.
What does the ninth digit mean?
It is the fiscal region: 0 is Rio Grande do Sul, 7 is Rio de Janeiro and Espírito Santo, 8 is São Paulo, 9 is Paraná and Santa Catarina. It is part of the number rather than a separate field, so it is visible on every CPF.
Is anything I paste sent anywhere?
No. The arithmetic runs in this browser tab and no request is made — open your Network tab and watch while you type. That matters more for an identity number than for almost anything else on this site, which is why there is no server side to this tool at all.
Does this replace an official check?
No, and it cannot. Every scheme here proves at most that the digits are internally consistent. Only the issuing authority can confirm a number exists, is active, and belongs to a particular person.
Is there a limit on how often I can use the CPF Validator?
It is free, with no account, no trial and no daily cap. Every security tool on inputtesthub.com works the same way: open the page and use it.
Can you see what I put into this page?
No. The CPF Validator runs entirely in your browser using JavaScript. Your input never reaches inputtesthub.com or any third party — open your browser's Network tab while you use it and you will see no request go out.
What do people use the CPF Validator for most?
The most common reasons people reach for it: catching a mistyped number in a form before it reaches a database. Cleaning an imported list and finding the rows that cannot be right. Understanding what the number encodes and what it does not. It is built for exactly those cases rather than being a general-purpose tool with this bolted on.
Is there anything the CPF Validator cannot do?
Confirms internal consistency only. It cannot tell you whether a CPF was ever issued, is active, or belongs to the person presenting it. Knowing where a tool stops being trustworthy matters more than the cases where it works.
What figures does the CPF Validator work from?
Check digits is Two, both mod 11 with descending weights. Ninth digit is The fiscal region the CPF was issued in. Typo detection is 99.7% of single-digit errors, measured over 3,000 cases. These are printed on the page itself, so you do not have to take them on trust.
Will this work on a tablet?
Yes. The page is responsive and the page works in Chrome, Safari, Firefox, Edge and Samsung Internet on both Android and iOS. There is no app to install and nothing to sign into.
Related security tools
All 10002
Hash Generator
Generates MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text, all at once.
03
MD5 Hash Generator
Generates an MD5 hash of any text or string, with optional HMAC and uppercase output.
04
SHA-256 Hash Generator
Generates SHA-256 hashes using the browser's Web Crypto API, with HMAC support.
05
SHA-1 Hash Generator
Generates SHA-1 hashes, still required by some legacy systems and Git object addressing.
06
SHA-512 Hash Generator
Generates SHA-512 hashes for checksums, signatures and archival fingerprints. Runs in your…
07
Base32 Encoder and Decoder
Encodes and decodes Base32, the alphabet used by TOTP secrets and some file systems.
08
Base58 Encoder and Decoder
Encodes and decodes Base58, the alphabet used by Bitcoin addresses and short identifiers.
09
AES Text Encryption
Encrypts and decrypts text with AES-GCM 256-bit using a password, entirely in your browser.
10
XOR Cipher Tool
Applies a repeating-key XOR to text or hex, the operation behind many simple obfuscation…