QuickUse Generator

Alphanumeric CNPJ Validator

Check whether a CNPJ is valid — the classic numeric format or the new alphanumeric one — and see exactly why if it is not. Wrong check digit? It shows the correct CNPJ. 100% in your browser.

Editorial guide

About this generator

An honest technical read on what is happening behind the Generate button.

This tool checks whether a CNPJ — Brazil's company tax ID — is valid, and tells you precisely why when it is not. It accepts both the classic all-numeric format and the new alphanumeric one arriving in July 2026, with or without the XX.XXX.XXX/XXXX-XX mask. A valid ID is confirmed as numeric or alphanumeric; an invalid one is explained — wrong length, a forbidden character, non-numeric check digits, or check digits that simply do not match. When only the check digit is wrong, it shows you the CNPJ it should have been.

What “valid” actually checks

A CNPJ is fourteen positions: a twelve-position base (an eight-position root plus a four-position branch identifier) followed by two check digits. Validation is structural, not a lookup against Receita Federal's database — it confirms the number is internally consistent. Four things have to hold: the length is exactly fourteen after the mask is stripped; the base characters are drawn from the allowed alphabet; the last two positions are numeric; and those two digits equal what the módulo 11 algorithm computes from the first twelve. A genuine CNPJ passes all four. A typo, a transcription slip, or a made-up number fails at least one — and a good validator names which.

The check digit, briefly

The verification rests on the same módulo 11 scheme the numeric CNPJ has always used, with one addition for letters. Each base character becomes a number by the rule value = ASCII − 48, so 0–9 map to 0–9 and A–Z map to 17–42. The first check digit is a weighted sum of the twelve values with weights 5 4 3 2 9 8 7 6 5 4 3 2 taken modulo 11 (remainder 0 or 1 → digit 0, otherwise 11 − remainder); the second repeats over the twelve values plus the first digit with weights 6 5 4 3 2 9 8 7 6 5 4 3 2. The official sample 12.ABC.345/01DE-35 validates exactly this way. If you want the full worked arithmetic on a number of your own, the check-digit calculator lays out every term.

Why numeric-only validators start failing in 2026

This is the part that matters for anyone shipping software. From July 2026 new registrations can carry letters in the first twelve positions, so a validator built around ^\d{14}$ will reject a perfectly valid alphanumeric CNPJ the moment a new partner, supplier, or customer presents one. The failure is silent and downstream: a blocked signup, a rejected invoice, a payment that will not go through — all because a regular expression has not been widened. Existing numeric CNPJs are untouched and stay valid forever, so the risk is entirely about accepting the new format, not re-checking the old one. Testing your validation against real alphanumeric samples now is the cheap insurance.

Why this validator accepts I and O

A recurring question is whether every letter is allowed. For validation, yes: the full A-Z range is accepted, and a CNPJ containing I or O that satisfies módulo 11 is structurally valid — this tool confirms it rather than rejecting it. Separately, the technical group ENCAT recommended in Nota Técnica Conjunta 2025.001 that Receita avoid issuing the visually ambiguous letters I O U Q F. At the time of writing that is a recommendation pending confirmation, not a validation rule. The distinction is practical: a validator must accept those letters (an issued ID could legitimately contain them), while a generator of test data does well to avoid them by default.

Updating your own validation

Three changes cover most systems. Widen the database column that stores a CNPJ from a numeric type to text. Replace any ^\d{14}$ pattern with ^[A-Z0-9]{12}[0-9]{2}$. And make the check-digit routine convert characters with ASCII − 48 instead of parsing integers — the weights and the remainder rule are unchanged, so you extend one algorithm rather than maintaining two. Because digits keep their own value under ASCII − 48, the updated routine returns the identical result for every numeric CNPJ you already store. Serpro publishes reference implementations of the routine in Java, Python, and TypeScript, which make a useful conformance oracle when you port the logic into your own stack. For more on the rollout and what it means for your stack, see our guide on what changes with the alphanumeric CNPJ. Everything here runs entirely in your browser — nothing you paste is sent anywhere.

Frequently asked questions

How do I validate an alphanumeric CNPJ?

Paste the number — with or without the XX.XXX.XXX/XXXX-XX mask — into the field above. The tool strips the mask, checks that there are fourteen positions, that the first twelve are 0-9 or uppercase A-Z, that the last two are numeric, and that those two check digits match the módulo 11 result computed from the first twelve. If everything holds it reports a valid CNPJ and whether it is numeric or alphanumeric; otherwise it tells you which check failed.

What makes a CNPJ invalid?

Five things, and the validator names which one applies: the length is not fourteen; all positions are the same character (Receita excludes these); a base position contains something outside 0-9 / A-Z, such as a lowercase letter or a symbol; one of the two check-digit positions is not numeric; or the structure is fine but the check digits do not match the first twelve positions. The last case is the most common in practice — a single mistyped character usually changes the check digit.

Does it still validate the old numeric CNPJ?

Yes. The alphanumeric algorithm is a strict superset of the numeric one — under the rule value = ASCII − 48 a digit maps to its own value, so a classic CNPJ like 11.444.777/0001-61 produces exactly the check digits it always had and validates unchanged. You can check old and new formats with the same tool; nothing about your existing numeric CNPJs changes.

Are letters like I and O rejected?

No. For validation the full A-Z range is accepted: a CNPJ containing I or O that satisfies módulo 11 is structurally valid, and this tool confirms it. ENCAT separately recommended (Nota Técnica Conjunta 2025.001) that Receita avoid issuing the ambiguous letters I, O, U, Q and F, but at the time of writing that is a pending recommendation, not a validation rule — so a validator must accept those letters even though a test-data generator does well to avoid them.

My system rejects a CNPJ this tool says is valid — why?

Almost always because your system still uses a numeric-only check such as a ^\d{14}$ regular expression or an integer column, which cannot represent letters. From July 2026 that logic will reject valid alphanumeric CNPJs from new registrations. The fix is to widen the validation to accept A-Z in the first twelve positions; the check-digit math itself does not change.

Can the check digits themselves be letters?

No. Only the first twelve positions (the root plus the branch identifier) can be alphanumeric. The last two are always numeric because they are the output of the módulo 11 calculation, which always yields a digit 0-9. A valid alphanumeric CNPJ therefore matches the pattern [A-Z0-9]{12}[0-9]{2}; if the last two positions contain a letter, the number is malformed.

What does the suggested "correct CNPJ" mean?

When the first twelve positions are well-formed but the two check digits are wrong, there is exactly one pair of check digits that would make the number valid. The tool computes them and shows the full corrected CNPJ, so you can see whether you have a simple typo in the check digit versus an error earlier in the number. It is an aid for spotting transcription mistakes, not a claim that the corrected number is registered with Receita.

Is this official, and is my data sent anywhere?

It is not an official Receita Federal service, but it implements exactly the algorithm Serpro and Receita published (ASCII − 48 plus módulo 11), verified against the official sample 12.ABC.345/01DE-35. It runs entirely in your browser — what you paste is never sent to a server, and nothing is stored beyond an optional list of your own recent inputs kept locally on your device.