Brazilian CPF Validation Algorithm Explained for JavaScript Developers

Understanding the Brazilian CPF

If you're developing software for the Brazilian market, you'll inevitably encounter the CPF (Cadastro de Pessoas Físicas). This is Brazil's individual taxpayer identification number, ubiquitous in registration forms, financial transactions, and government interactions. For developers, accurate CPF validation is paramount to maintain data integrity and prevent the entry of erroneous information into systems. A CPF is an 11-digit number, typically presented with formatting like 529.982.247-25. The first nine digits form the base number, while the last two are calculated verification digits, crucial for detecting common input errors.

The validation process hinges on a mathematical algorithm that recalculates these verification digits based on the preceding numbers. This ensures that any CPF entered into a system has a mathematically sound structure, significantly reducing the likelihood of typos or intentionally invalid numbers.

Step 1: Data Preparation - Removing Formatting

The initial and crucial step in validating a CPF is to normalize the input string. This involves removing any non-digit characters, such as periods (.) and hyphens (-). Software often presents CPFs in a user-friendly format, but for algorithmic processing, a clean string of digits is required. For example, 529.982.247-25 must be transformed into 52998224725.

This cleaning process ensures that the subsequent mathematical operations are performed only on the numerical digits, eliminating potential errors caused by unexpected characters. In JavaScript, this can be efficiently achieved using regular expressions. A common approach is to use the replace() method with a regex that targets and removes all non-digit characters ( egex_/ egex_/g).

Step 2: Initial Check - Length and Repetitive Digits

Before diving into the core algorithm, a few preliminary checks are essential. First, verify that the cleaned CPF string contains exactly 11 digits. If it's shorter or longer, it's invalid. Second, identify and reject CPFs composed of entirely repetitive digits. Numbers like 00000000000, 11111111111, or 99999999999 are considered invalid, even though they might pass the subsequent algorithmic checks. These are often referred to as "fake" or "empty" CPFs and are known to be mathematically valid according to the algorithm but are universally recognized as invalid in practice.

These initial checks act as a quick filter, immediately discarding obviously malformed or intentionally problematic inputs without expending computational resources on the more complex calculations. They are a critical part of a robust validation function.

Step 3: Calculating the First Verification Digit

The calculation of the verification digits is a two-part process. The first verification digit is derived from the first nine digits of the CPF. The algorithm involves a weighted sum:

1. Multiply each of the first nine digits by a decreasing weight, starting from 10 down to 2.
2. Sum these products.
3. Calculate the remainder of this sum when divided by 11.
4. If the remainder is less than 2, the first verification digit is 0.
5. If the remainder is 2 or greater, subtract the remainder from 11 to get the verification digit.

Let's illustrate with an example. Consider the base number 529982247:

• 5 * 10 = 50
• 2 * 9 = 18
• 9 * 8 = 72
• 9 * 7 = 63
• 8 * 6 = 48
• 2 * 5 = 10
• 2 * 4 = 8
• 4 * 3 = 12
• 7 * 2 = 14

The sum is 50 + 18 + 72 + 63 + 48 + 10 + 8 + 12 + 14 = 295.

Now, calculate the remainder when 295 is divided by 11: 295 % 11 = 8.

Since the remainder (8) is greater than or equal to 2, the first verification digit is 11 - 8 = 3.

This calculated digit 3 is then appended to the base number, forming a ten-digit sequence for the next step.

Step 4: Calculating the Second Verification Digit

The process for the second verification digit is nearly identical to the first, but it uses the first ten digits of the CPF (the original nine digits plus the first calculated verification digit) and a slightly different weighting sequence.

1. Multiply each of the first ten digits by a decreasing weight, starting from 11 down to 2.
2. Sum these products.
3. Calculate the remainder of this sum when divided by 11.
4. If the remainder is less than 2, the second verification digit is 0.
5. If the remainder is 2 or greater, subtract the remainder from 11 to get the verification digit.

Using our example, the first ten digits are 5299822473 (the base plus the calculated 3).

• 5 * 11 = 55
• 2 * 10 = 20
• 9 * 9 = 81
• 9 * 8 = 72
• 8 * 7 = 56
• 2 * 6 = 12
• 2 * 5 = 10
• 4 * 4 = 16
• 7 * 3 = 21
• 3 * 2 = 6

The sum is 55 + 20 + 81 + 72 + 56 + 12 + 10 + 16 + 21 + 6 = 349.

Now, calculate the remainder when 349 is divided by 11: 349 % 11 = 8.

Since the remainder (8) is greater than or equal to 2, the second verification digit is 11 - 8 = 3.

Thus, the complete CPF, including the calculated verification digits, is 52998224733. The original example CPF was 529.982.247-25. Our calculation yielded 33. This indicates that the example CPF provided in the source (529.982.247-25) would be invalid according to the standard algorithm. This discrepancy highlights the importance of implementing the algorithm precisely as specified.