CPF

Cadastro de Pessoas Físicas, the 11-digit Brazilian individual taxpayer number, ending in two mod-11 check digits.

Validate

Validates a CPF: 9 base digits and 2 modulus 11 check digits (REGRA_VALIDA_CPF of the Receita Federal).

Rejects a reserved number (all 11 digits the same, for example 00000000000).
A value that does not have exactly 11 digits, or the wrong check digits, is invalid.
Empty, blank or non-numeric input is invalid.
Sources: the norm of the CPF, IN RFB nº 2.172/2024, does not define the check digits. The rule and the worked example 280.012.389-38 come from the Receita Federal Manual de Preenchimento da e-Financeira (REGRA_VALIDA_CPF). The reserved numbers come from the Receita Federal DJE layout, which lists the 10 numbers with all digits the same (000.000.000-00 to 999.999.999-99) as not valid.

Pending decision

The reference (JS) ignores the formatting characters (., -) and whitespace around and between groups. Other libraries accept digits only. See the open decision in docs/findings.md.

Parameter	Type	Required
`cpf`	`string`	yes
returns	`boolean`

Check if a CPF is valid.

Returns false for a reserved number (all digits the same, such as 00000000000) and for a wrong check digit.
The reserved numbers are the ones the Receita Federal's DJE layout lists as not valid. The CPF's own norm, IN RFB nº 2.172/2024, has no check digit rule; the rule is the one of the Receita Federal's e-Financeira manual (Anexo II, REGRA_VALIDA_CPF, approved by the Ato Declaratório Executivo Cofis nº 10/2026).

import { isValidCpf } from '@brazilian-utils/brazilian-utils';

isValidCpf('155151475'); // false
isValidCpf('111 444 777 35'); // true (whitespace mask)

Code: brazilian-utils/javascript

Try it with JavaScript isValidCpf

Shared test cases (37) and the result in each library cpf.isValid

The cases, as JSON

Format

Formats a CPF as 000.000.000-00.

options.pad left-pads the value with zeros to 11 digits first.
options.obfuscate hides the first 3 digits and the 2 check digits with *, after padding. This is the rule the Leis de Diretrizes Orçamentárias set for publishing a CPF (Lei nº 14.194/2021, art. 149, and Lei nº 15.321/2025, art. 163).
A number is read only when it is a safe non-negative integer. A negative, fractional, non-finite or unsafe number returns an empty string. 2.4.0 read the digits of any number (-12345678909 gave 123.456.789-09).
A value with no digits (empty, or only letters and symbols) returns an empty string even with options.pad. Until 2.4.0 pad returned the full zero mask (000.000.000-00).
Digits beyond the 11th are dropped. A value that is not a string or a number (null, undefined, an object) returns an empty string.
A number loses its leading zeros, so pass a string, or use options.pad, for a CPF that starts with 0.

Pending decision

The reference (JS) formats only the characters an incomplete value has and returns an empty string for empty or invalid input. Other libraries return null. See the open decision in docs/findings.md.

Parameter	Type	Required
`value`	`string \| number`	yes
`options`	`FormatCpfOptions`	no
`options.pad`	`boolean`	no
`options.obfuscate`	`boolean`	no
returns	`string`

Format a CPF.

Options (FormatCpfOptions): pad left-pads the value with zeros to 11 digits before masking (default false); obfuscate hides the first 3 digits and the 2 check digits. An empty value, or one without digits, gives '' even with pad.
obfuscate is applied after pad. It follows the rule the Leis de Diretrizes Orçamentárias set for publishing a CPF: "ocultar os três primeiros dígitos e os dois dígitos verificadores" (Lei nº 14.194/2021, art. 149, first set by Lei nº 12.309/2010, art. 87, § 5º; Lei nº 15.321/2025, art. 163, the LDO for 2026, repeats it).

import { formatCpf } from '@brazilian-utils/brazilian-utils';

formatCpf('74650688000'); // 746.506.880-00
formatCpf('746506880', { pad: true }); // 007.465.068-80
formatCpf('12345678909', { obfuscate: true }); // ***.456.789-**

Code: brazilian-utils/javascript

Try it with JavaScript formatCpf

Shared test cases (69) and the result in each library cpf.format

The cases, as JSON

Parse

Removes CPF formatting and keeps only digits, capped at 11 digits.

A number is read only when it is a safe non-negative integer. A negative, fractional, non-finite or unsafe number returns an empty string. 2.4.0 read the digits of any number.
A value that is not a string or a number (null, undefined, an object) returns an empty string.

Parameter	Type	Required
`value`	`string \| number`	yes
returns	`string`

Remove CPF formatting, keep only digits, and cap the result to 11 digits.

import { parseCpf } from '@brazilian-utils/brazilian-utils';

parseCpf('746.506.880-00'); // 74650688000

Code: brazilian-utils/javascript

Try it with JavaScript parseCpf

Shared test cases (23) and the result in each library cpf.parse

The cases, as JSON

Generate

Generates a valid random CPF: 11 digits, unformatted.

state (a state code such as SP) sets the 9th digit, the fiscal region, to the region of that state (see cpf.getInfo). The code is read ignoring letter case and surrounding whitespace, so "sp" and " SP " are SP. 2.4.0 read only the uppercase code and gave a random digit for "sp".
Without state, or with an unknown code, the digit is random.
A CPF whose 11 digits are all the same is never returned.

Parameter	Type	Required
`state`	`StateCode`	no
returns	`string`

Generate a valid random CPF.

The optional state argument (StateCode, e.g. "SP") fixes the região fiscal digit (the 9th) to that state's code.
state ignores letter case and surrounding whitespace ('sp' is 'SP'). Without state, or with an unknown code, a random região fiscal digit is drawn.

import { generateCpf } from '@brazilian-utils/brazilian-utils';

generateCpf();
generateCpf('SP'); // the 9th digit is 8, the SP região fiscal code
generateCpf('MG'); // the 9th digit is 6, the MG região fiscal code

Code: brazilian-utils/javascript

Try it with JavaScript generateCpf

Shared test cases (4) and the result in each library cpf.generate

The cases, as JSON

Decode

Reads the fields of a CPF: the 8-digit base, the fiscal region digit with its states, and the 2 check digits. Accepts the same input as cpf.isValid and returns null exactly when cpf.isValid is false.

base is the first 8 digits. checkDigits is the last 2.
fiscalRegion is the 9th digit, as a string: 1 to 9 for the 1st to 9th Região Fiscal of the Receita Federal, and 0 for the 10th.
states lists the states of that region, sorted by state name: 1 DF, GO, MT, MS, TO; 2 AC, AP, AM, PA, RO, RR; 3 CE, MA, PI; 4 AL, PB, PE, RN; 5 BA, SE; 6 MG; 7 ES, RJ; 8 SP; 9 PR, SC; 0 RS.
The digit is the fiscal region of the address given at the first registration. It is not the place of birth or of residence.
In a region with more than one state, the number does not say which one.
Returns null for a reserved number such as 00000000000 and for any value that is not a string.
Returns a new object, with a new states list, on every call.

Parameter	Type	Required
`value`	`string`	yes
returns	`CpfInfo \| null`

Read the fields a CPF encodes, as a CpfInfo: the 8 digit base, the fiscalRegion digit (the 9th digit, the Região Fiscal of the Receita Federal the CPF was registered in, "1" to "9" and "0" for the 10ª), the states of that region (StateCode[], sorted by state name) and the 2 checkDigits. Accepts the same masked or unmasked input as isValidCpf and returns null for anything that is not a valid CPF. The region is the one of the address given at the first registration: it says nothing about where the holder was born, lives today or asked for the number, and a region with more than one state does not tell which of them it was.

`fiscalRegion`	`states`
`"1"`	DF, GO, MT, MS, TO
`"2"`	AC, AP, AM, PA, RO, RR
`"3"`	CE, MA, PI
`"4"`	AL, PB, PE, RN
`"5"`	BA, SE
`"6"`	MG
`"7"`	ES, RJ
`"8"`	SP
`"9"`	PR, SC
`"0"`	RS

import { getCpfInfo } from '@brazilian-utils/brazilian-utils';

getCpfInfo('123.456.789-09');
// {
//   base: '12345678',
//   fiscalRegion: '9',
//   states: ['PR', 'SC'],
//   checkDigits: '09',
// }

getCpfInfo('12345678900'); // null (invalid check digits)

Source: Receita Federal, "Cadastros: CPF e CNPJ".

Code: brazilian-utils/javascript

Try it with JavaScript getCpfInfo

Shared test cases (23) and the result in each library cpf.getInfo

The cases, as JSON

Guides

Specification

Summary

The CPF is an 11-digit national identification number. The first eight digits are the registration number, assigned at random. The ninth digit identifies the Fiscal Region responsible for the registration. The last two digits are check digits. Since January 2023, Brazil has used the CPF as its single identification number.

Validation rules

The input must contain exactly 11 characters.
The check digits come from the standard mod-11 algorithm.
Sequences with all digits equal (for example, 00000000000) are invalid.

Algorithm

Reject the input if its length != 11 or if it is a repeated sequence.
Calculate the first check digit (DV1):
- Multiply the first 9 digits by the weights 10..2.
- Add the results.
- DV1 = (sum % 11 < 2 ? 0 : 11 - (sum % 11))
Calculate the second check digit (DV2):
- Multiply the first 10 digits (including DV1) by the weights 11..2.
- Add the results.
- DV2 = (sum % 11 < 2 ? 0 : 11 - (sum % 11))
Compare DV1 and DV2 with the last two digits.

Sources of the rules

The norm of the CPF, IN RFB nº 2.172/2024, does not define the check digits.
The check digit rule (REGRA_VALIDA_CPF) and the worked example 280.012.389-38 come from the Receita Federal Manual de Preenchimento da e-Financeira, approved by Ato Declaratório Executivo Cofis nº 10/2026.
The reserved numbers (all 11 digits the same, 000.000.000-00 to 999.999.999-99) come from the Receita Federal DJE layout, which lists them as not valid.
The obfuscated form of formatCpf (***.456.789-**) follows the rule the Leis de Diretrizes Orçamentárias set for publishing a CPF: Lei nº 14.194/2021, art. 149, repeated by Lei nº 15.321/2025 (LDO 2026), art. 163.

Fiscal region (9th digit)

The 9th digit is the Região Fiscal of the Receita Federal of the address given when the CPF was first registered. 1 to 9 are the 1st to 9th regions, and 0 is the 10th.

Digit	States
1	DF, GO, MT, MS, TO
2	AC, AP, AM, PA, RO, RR
3	CE, MA, PI
4	AL, PB, PE, RN
5	BA, SE
6	MG
7	ES, RJ
8	SP
9	PR, SC
0	RS

The digit is not the place of birth or of residence. It is the region of the address at the first registration.
In a region with more than one state, the number does not say which one.
getCpfInfo returns { base, fiscalRegion, states, checkDigits }: the first 8 digits, the 9th digit as a string, the states of that region sorted by state name, and the 2 check digits. It returns null exactly when isValidCpf is false.
generateCpf(state) writes the digit of the region of state. The state code is read ignoring case and surrounding whitespace ("sp" is SP). 2.4.0 read only the uppercase code.

Example: getCpfInfo("123.456.789-09") returns { base: "12345678", fiscalRegion: "9", states: ["PR", "SC"], checkDigits: "09" }.

Numbers as input

formatCpf and parseCpf also take a number. It is read only when it is a safe non-negative integer. A negative, fractional, non-finite or unsafe number gives an empty string. 2.4.0 read the digits of any number.

Regex

Unformatted CPF: ^\d{11}$
Formatted CPF: ^\d{3}\.\d{3}\.\d{3}-\d{2}$

Examples

Valid: 11144477735
111.444.777-35: pending decision. The reference (JS) accepts it, the other libraries do not.
Invalid: 00000000000 (repeated sequence)
Invalid: 1114447773 (must contain exactly 11 characters)
Invalid: 111444777355 (must contain exactly 11 characters)

Validate

Format

Parse

Generate

Decode

Guides

Specification

Summary

Validation rules

Algorithm

Sources of the rules

Fiscal region (9th digit)

Numbers as input

Regex

Examples

Official sources

On this page