Anyone building software for Brazil eventually needs CPFs for testing: validating a signup form, populating a staging database, exercising mask and validation rules. The problem is obvious — you cannot use real people's CPFs in a test environment. That is a privacy violation and, under Brazil's data protection law (LGPD), a concrete legal risk.
The solution is to generate synthetic CPFs: numbers that are structurally valid (they pass check-digit validation) but belong to no real person. This guide explains how the CPF is validated and how to generate correct numbers for your tests.
How the CPF is structured
The CPF has 11 digits, usually shown as 123.456.789-09. The first nine are the number's base; the last two are check digits, computed from the first nine.
This structure is what lets you validate a CPF without querying any database: you recompute the check digits from the base and compare them with the two trailing digits provided. If they match, the number is structurally valid.
How the check digit works
The calculation uses mod 11, a classic error-detection algorithm:
For the first check digit, each of the nine base digits is multiplied by a descending weight (from 10 down to 2). The results are summed, the remainder of division by 11 is computed, and the digit is derived from that remainder (if the remainder is 0 or 1, the digit is 0; otherwise it is 11 minus the remainder).
The second check digit follows the same logic but now includes the first check digit in the calculation, with weights from 11 down to 2. This chaining is what makes the CPF resistant to typos — swapping or transposing digits almost always breaks validation.
Why not use real CPFs in testing
Beyond privacy and LGPD, there is a practical reason: you have no control over real CPFs. You do not know whether they will collide with existing records, you cannot generate volume on demand, and you expose personal data in logs, screenshots, and staging databases that often have weaker security than production.
Synthetic CPFs solve all of this: you generate as many as you need, without touching anyone's personal data.
How to generate valid CPFs
Use our CPF generator to create structurally valid numbers instantly. You can generate them with or without the mask (with dots and hyphen, or digits only), matching the format your system expects. Every generated number passes check-digit validation, so it exercises the full flow: masking, validation, and persistence.
Note: a generated CPF is structurally valid but does not correspond to a real person. Use it exclusively for development, testing, and QA. Generating or using a CPF to impersonate someone is a crime in Brazil.
Summary
Test CPFs should be synthetic: structurally valid, but unlinked to real people. The check digit uses mod 11 over the nine base digits, which lets you validate the number offline. To populate test environments safely and within LGPD, generate the numbers instead of using real data.
Content verified 2026-06-04. CPF validation rules (mod-11 check digit) are stable and have not changed.