Brazil's CNPJ — Cadastro Nacional da Pessoa Jurídica — is the country's business taxpayer ID. Fourteen digits, two of them verifiers, four of them encoding which establishment of the legal entity you are looking at (headquarters or a specific branch). Every legal entity registered in Brazil since July 1998 has one. This generator emits valid-format CNPJs for tests and seed data only — they pass the módulo 11 check but do not exist in Receita Federal's registry.
What CNPJ actually is
The CNPJ went live on July 1st, 1998, instituted by Instrução Normativa SRF nº 27/1998, replacing the older Cadastro Geral de Contribuintes (CGC) that traced back to the 1960s. Receita Federal — Brazil's federal tax authority — administers the registry. The institutional context was the rollout of Lei nº 9.317/1996 (SIMPLES nacional), which created a differentiated tax regime for small businesses and required a unified, queryable national registry. The CNPJ is the spine of that system.
Every entry in the database is a fourteen-digit number, conventionally formatted as XX.XXX.XXX/XXXX-XX — two dots after groups of three, a slash before the four-digit branch identifier, and a dash before the two verifier digits. The same legal entity (one pessoa jurídica) can register multiple establishments, each with its own CNPJ that shares the first eight digits and differs in the branch portion.
CNPJ anatomy: eight plus four plus two
The first eight digits are the raiz — the root that identifies the legal entity. Two different establishments of the same company share this prefix. The next four digits identify the specific establishment: 0001 is always the headquarters (matriz), 0002 through 9999 are branches (filiais), 0000 is reserved and never issued. The final two digits are checksums computed from the previous twelve, using a weighted módulo 11 scheme analogous to (but distinct from) the one used for CPF.
The checksums catch typos — transpose two digits in the base and the verifiers will almost certainly stop matching. They do not catch deliberate forgery, since anyone who knows the algorithm can mint a valid-looking CNPJ. That is exactly what this generator does, and exactly why every output ships with a test-only disclaimer.
The módulo 11 verifier algorithm (CNPJ weights)
To compute verifier digit d₁₃, multiply each of the twelve base digits by weights [5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2] in order, sum the products, take the result modulo 11. If the modulus is 0 or 1, the verifier is 0 (otherwise it is 11 - mod). For d₁₄, repeat with the now-thirteen known digits (base + d₁₃) and weights [6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2].
A common implementation mistake: reusing the CPF weights for CNPJ. They are different algorithms operating on different lengths. CPF uses the descending sequence [10..2] over nine digits; CNPJ uses the cyclic [5,4,3,2,9..2] sequence over twelve. The choice of 11 as modulus is shared for the same reason: 11 is prime, so the remainder space does not collapse under multiplication, which gives the scheme stronger error-detection properties than a modulo-10 alternative would.
A CNPJ whose fourteen digits are all identical — 00000000000000, 11111111111111, …, 99999999999999 — happens to satisfy the checksum math by accident, but Receita Federal explicitly excludes them by policy. This generator filters them out as a hard rule.
Matriz and filial: the branch identifier
The four-digit branch portion (digits 9 through 12) is what distinguishes one establishment of the same legal entity from another. The convention is rigid: 0001 is always the matriz, the headquarters of record where the entity was first registered. Branches are numbered sequentially starting from 0002, in the order they were opened. The slot 0000 is reserved and never issued, so the practical branch range is 0001 to 9999 — meaning a single pessoa jurídica can register up to 9999 establishments under one base.
Why this matters for testing: a real Brazilian business application is oftenestablishment-aware, not just company-aware. Tax obligations attach per estabelecimento. Inventory, payroll, and electronic invoices (NF-e) all key off the full fourteen-digit CNPJ, not just the eight-digit root. Generating mixed matriz and filial CNPJs lets you exercise that distinction directly. This tool exposes a branch type selector — pin every output to matriz, force only filiais, or let the random mode mix both — so the test fixture matches the production shape.
CNPJ vs CPF: pessoa jurídica vs pessoa física
Brazil separates legal entity identifiers (CNPJ, fourteen digits) from individual taxpayer identifiers (CPF, eleven). Both use módulo 11 verification with different weights and lengths, both are administered by Receita Federal, but they serve different regulatory regimes. CPF is personal data under LGPD. CNPJ is not personal data because LGPD Article 5, Section V defines the data holder (titular) as a natural person — pessoas jurídicas fall outside the law's protective scope. Public CNPJ data is openly available, which has practical consequences for testing and integration work.
Test-only ethics: a generator is not a backdoor
Generating valid-format CNPJs for QA fixtures, integration tests, and seed data is standard practice in Brazilian software development. Using a generated CNPJ to operate a fictitious business, file a fake declaration, or pass commercial KYC under false pretences is falsidade ideológica (Art. 299 of the Brazilian Penal Code) combined with Art. 11 of Lei nº 8.137/1990, which extends criminal liability to anyone who contributes to crimes against the tax order through a legal entity. Pessoa jurídica fraud carries materially stronger legal weight than pessoa física fraud — it triggers both criminal-code falsidade and tax-crime provisions. The legal use case is closed: testing your own software, seeding your own dev database, training your own validation logic.
CNPJ is public data — and why that helps testing
Receita Federal publishes the full CNPJ registry as open data: monthly snapshots of every active CNPJ, downloadable from the official portal at dados.gov.br and mirrored by the community at casadosdados.com.br. This is a fundamentally different posture from CPF, where any lookup goes through regulated KYC providers and requires the holder's consent. For developers, the consequence is that CNPJ integration testing can use real public data — or, when you want guaranteed-fake fixtures that will not collide with the registry, this generator.
Note: as of July 2026, Receita Federal is rolling out the new CNPJ alfanumérico via Instrução Normativa RFB nº 2.229/2024. Existing all-numeric CNPJs remain valid; the new alphanumeric format applies only to newly issued registrations. The módulo 11 algorithm extends to alphanumeric characters via an ASCII offset, but this generator emits the classic numeric format used by the active 50+ million CNPJ registry.
Where this generator earns its keep
Three patterns dominate. First, seeding a development database with twenty plausible- looking companies and their branch CNPJs in one click — quantity selector, branch type, copy all, done. Second, validating a form that accepts both formatted and raw CNPJ input — paste, watch the live verdict, ship. Third, exercising a branch-aware backend by forcing matriz-only or filial-only outputs and confirming the right code path fires.