Brazilian document validators

What a validator checks

Every Brazilian document follows a construction rule: a fixed length, a set of allowed characters and one or more check digits computed from the rest. DevBR Kit validators apply that rule and name the problem they find: wrong length, invalid character, a run of repeated digits (such as 111.111.111-11), an unknown state or bank code, or a check digit that does not match.

One important caveat: a valid check digit does not mean the document exists. The arithmetic only proves the number is well formed. Whether a CPF (taxpayer ID) is in good standing, a CNPJ (company ID) is active, an account belongs to anyone or a boleto has been paid can only be answered by the Receita Federal, state tax offices, banks or traffic departments, and none of them is queried here.

Batch validation, one value per line

Open the Validate tab of any tool and paste the whole list, for example a column copied from a spreadsheet or the output of a SELECT, up to 1000 lines at a time. Mask punctuation is ignored, so masked and unmasked values can be mixed. Each line gets its own verdict in input order, which makes it easy to spot bad records before a migration or import.

Some validators accept context on the line. For the state registration (IE), SP 110.042.490.114 is checked against São Paulo only, while a bare number is tested against all 27 states and lists the ones that accept it. For bank accounts, a line reads <bank> <branch> <account>.

Which one to use

• Individuals: CPF, PIS/PASEP, título voter ID, CNH driver’s licence and RG (São Paulo pattern).
• Companies and tax: CNPJ, including the alphanumeric format, and state registration (IE).
• Vehicles: RENAVAM and licence plates (old or Mercosur).
• Payments: cards (Luhn and brand), bank accounts and boletos, both bank and utility/tax slips.

If your problem is only punctuation and you do not need check digits verified, the document formatter adds or strips masks on whole lists.

Your data stays in the browser

Validation runs in JavaScript on the page itself. Pasted values are not sent to any server, there are no cookies or analytics, and closing the tab discards everything. Even so, when you handle real customer data, follow Brazil’s data protection law (LGPD) and your company’s data policy.