How brazilian CPF numbers are created?
The CPF (Cadastro de Pessoas Físicas) is the Brazilian individual taxpayer registry identification number, issued by the Receita Federal (Federal Revenue). It is a unique number that serves as a national identifier for financial, fiscal, and even general civil procedures in Brazil. Every Brazilian citizen and resident must have a CPF for purposes like opening bank accounts, applying for jobs, and registering for government services.
But few know that behind the 11 digits of a CPF, there is a structured logic—including a subtle indication of the state where the CPF was issued.
Structure of a Brazilian CPF number
A CPF consists of 11 digits, usually displayed in the format:
XXX.XXX.XXX-YYWhere:
Last 2 digits (YY): Check digits (verificadores), calculated based on the first 9 digits using a mathematical algorithm to ensure validity.
First 9 digits (XXX.XXX.XXX): Random base number.
Generation logic of CPF numbers
1. Base Digits (First 9 Digits)
The first 8 digits are randomly generated. The 9th digit, however, is particularly important—it determines the state code, based on where the CPF was initially registered.
2. State Indicator: 9th Digit
The 9th digit in the CPF reflects the regional tax office responsible for the CPF registration. Each digit corresponds to a set of Brazilian states:
| 9th Digit | State(s) |
|---|---|
| 0 | Rio Grande do Sul |
| 1 | Distrito Federal, Goiás, Mato Grosso, Mato Grosso do Sul, Tocantins |
| 2 | Amazonas, Pará, Roraima, Amapá, Acre, Rondônia |
| 3 | Ceará, Maranhão, Piauí |
| 4 | Pernambuco, Rio Grande do Norte, Paraíba, Alagoas |
| 5 | Bahia, Sergipe |
| 6 | Minas Gerais |
| 7 | Rio de Janeiro, Espírito Santo |
| 8 | São Paulo |
| 9 | Paraná, Santa Catarina |
Important: This digit does not necessarily reflect the current residence of the CPF holder, but rather the location where the CPF was originally registered.
3. Verification Digits (Last 2 Digits)
These are checksum digits, used to ensure that the CPF number is valid and not randomly fabricated. They’re calculated using a modulus-11 algorithm:
First check digit:
- Multiply each of the first 9 digits by weights from 10 to 2, sum the results.
- Take the modulus 11 of the sum.
- If the result is less than 2, the first check digit is 0; otherwise, it’s
11 - result.
Second check digit:
- Repeat the process, but now include the first check digit and use weights from 11 to 2.
Real-World implications
Validation and fraud detection
Because the CPF follows a strict mathematical pattern, invalid or randomly guessed numbers can easily be flagged using validation algorithms. Tools and systems often reject CPFs with incorrect check digits or suspicious sequences (e.g., 111.111.111-11).
Geographic insight
Though mostly symbolic today, the 9th digit can give a hint of origin. For example, someone with a CPF ending in 8 likely registered it in São Paulo.
Digital registrations
Today, CPF numbers can be generated online via Receita Federal’s portal or through integration with services like eSocial or gov.br. The state-based digit may now be less relevant due to centralized processing, but it still reflects the system’s regionalized past.