Introduction
Brazilian software frequently validates CPF and CNPJ identifiers in registration, billing, tax and customer-management flows. A random sequence of digits usually fails immediately because the final positions are mathematical check digits.
Test teams need syntactically valid values to exercise form masks, validation services and downstream integrations without using a real person or organization. The utily.tools CPF & CNPJ Generator creates such values for development and quality assurance.
Weighted sums and modulo-11 verification
Both identifiers use weighted sums followed by modulo-11 rules. Each base digit is multiplied by a position-dependent weight, the products are added and the remainder determines a check digit. A second pass includes the first calculated digit to produce the final one.
A valid check digit proves only that the number satisfies the arithmetic rule. It does not prove that the identifier was issued, belongs to a specific taxpayer or is active in an official registry.
Technical foundations and behavior
A classic CPF has nine base digits and two verification digits. CNPJ has twelve base positions and two verification digits, traditionally including the branch sequence. Validation also commonly rejects repeated values such as 000.000.000-00 even when a naive calculation appears acceptable.
CPF calculation
For the first digit, the nine base digits are multiplied by weights 10 through 2. The second uses ten digits and weights 11 through 2. A common rule maps remainders below 2 to zero and otherwise uses 11 minus the remainder.
CNPJ calculation
The first CNPJ digit uses weights 5,4,3,2,9,8,7,6,5,4,3,2. The second prepends 6 and includes the first verifier. Alphanumeric CNPJ formats require a specification-aware character-to-value mapping rather than digit-only arithmetic.
Responsible testing
Generated values should remain inside development and test environments. Systems must not use them to impersonate taxpayers, bypass identity verification or create fraudulent transactions. Official existence checks require authorized registry integration.
Real-world applications
Front-end form tests
QA can verify masks, validation messages, paste behavior and formatted versus unformatted submission.
Automated test fixtures
A test suite can create independent valid values instead of reusing one hard-coded document across parallel runs.
Integration boundaries
Generated data exercises local validation, while sandbox-issued identifiers should be used when an external provider performs registry checks.
Standards and deeper technical reference
Identifiers, check digits and what validation proves
CPF and CNPJ are Brazilian tax identifiers administered by Receita Federal. Their final positions are check digits designed to detect common transcription errors. A mathematically valid number only satisfies its formation rule: it does not prove that a person or company exists, is active, owns the number or consented to its use.
Test generators should produce synthetic values only and must never query, enumerate or present real taxpayer records. Formatting punctuation is a presentation layer; validation begins by removing permitted separators, checking length and character repertoire, rejecting known invalid repeated patterns, and then recalculating both check digits.
| Identifier | Base | First pass | Second pass |
|---|---|---|---|
| CPF | 9 digits | Weights 10 through 2 | Include first check digit; weights 11 through 2 |
| Numeric CNPJ | 12 digits | Weights 5,4,3,2,9,8,7,6,5,4,3,2 | Include first check digit; weights start at 6 then 5 through 2 |
Modulo 11 calculation in detail
For each pass, multiply each base position by its weight and sum the products. The classic CPF and CNPJ rule derives a remainder modulo 11 and maps small remainders to zero; otherwise the digit is 11 minus the remainder. The second digit repeats the process with the first digit appended and the shifted weight sequence.
Implement the weight sequence visibly and test against official examples. Compact formulas that derive weights from indexes are easy to get wrong at the wrap point. Validation should compare digits without converting the whole identifier to a Number, because identifiers are strings and leading zeros are meaningful.
CNPJ alphanumeric transition in July 2026
Receita Federal introduced alphanumeric CNPJ for new registrations beginning in July 2026 while existing numeric CNPJs remain unchanged. The identifier keeps 14 positions: the first 12 may contain digits and uppercase letters, and the final two remain numeric check digits. The modulo 11 structure remains, but each alphanumeric character is converted using its ASCII decimal value minus 48, so A maps to 17, B to 18 and so on.
Systems must stop modeling CNPJ as a numeric database column and should accept both legacy numeric and new alphanumeric forms. Case normalization, input masks, regexes, exports, API schemas and sorting all require review. A generator that supports only numeric CNPJ must label that limitation clearly rather than claiming complete compatibility with new registrations.
Primary specifications and references
- CNPJ Alfanumérico project and technical documentationReceita Federal do Brasil
- Cálculo do DV do CNPJ AlfanuméricoReceita Federal do Brasil
- Simulador oficial do CNPJ AlfanuméricoGoverno Federal do Brasil
Conclusion
CPF and CNPJ verification digits are error-detection mechanisms built from weighted modulo arithmetic. They are valuable for input validation but are not evidence of identity or registration status.
I support document generators when they are clearly framed as development tools and kept away from real transactions. Use the utily.tools CPF & CNPJ Generator responsibly, and read more site articles about test data, identifiers and validation.