General · Philterd

Brazilian Identifiers (CPF, CNPJ)

Redact Brazilian CPF (individual) and CNPJ (company) tax identifiers, formatted or unformatted, validated by their mod-11 check digits.

View policy → Download JSON → View source on GitHub

v1.0.0 Updated 2026-06-15 Philter Requires Phileas 4.1.0+ (redaction policy schema 1.1.0 with the mod11 validator) By Philterd

BrazilCPFCNPJtax IDnational ID

The policy

The full brazilian-identifiers.json file. The same content you’d get by downloading. Copy any part of it, or use the buttons in the hero to grab the whole file.

{
  "config": {
    "splitting": {
      "enabled": false,
      "threshold": 4000
    }
  },
  "ignored": [],
  "identifiers": {
    "identifiers": [
      {
        "classification": "br-cpf",
        "pattern": "\\b\\d{3}\\.?\\d{3}\\.?\\d{3}-?\\d{2}\\b",
        "caseSensitive": false,
        "validator": {
          "name": "mod11",
          "params": {
            "variant": "cpf"
          }
        },
        "identifierFilterStrategies": [
          {
            "strategy": "REDACT",
            "redactionFormat": "[REDACTED-BR-CPF]"
          }
        ]
      },
      {
        "classification": "br-cnpj",
        "pattern": "\\b\\d{2}\\.?\\d{3}\\.?\\d{3}/?\\d{4}-?\\d{2}\\b",
        "caseSensitive": false,
        "validator": {
          "name": "mod11",
          "params": {
            "variant": "cnpj"
          }
        },
        "identifierFilterStrategies": [
          {
            "strategy": "REDACT",
            "redactionFormat": "[REDACTED-BR-CNPJ]"
          }
        ]
      }
    ]
  }
}

Example

Input

CPF 529.982.247-25 and CNPJ 11.222.333/0001-81 on file.

Output

CPF [REDACTED-BR-CPF] and CNPJ [REDACTED-BR-CNPJ] on file.

Entities this policy acts on

BRAZIL_CPFBRAZIL_CNPJ

What this policy does

Detects and redacts the two Brazilian tax identifiers using Phileas’s generic identifier filter with the mod11 validator, so each match is kept only if its mod-11 check digits are valid:

CPF (Cadastro de Pessoas Fisicas): the 11-digit individual taxpayer number, validated by the mod11 validator with the cpf variant.
CNPJ (Cadastro Nacional da Pessoa Juridica): the 14-digit company number, validated by the mod11 validator with the cnpj variant.

Both accept formatted (000.000.000-00, 00.000.000/0000-00) and unformatted input, and each is replaced with a distinct token.

Why the validator matters

An 11- or 14-digit pattern would over-match. The validator keeps a match only if the two check digits are correct, so 52998224724 (a CPF shape that fails the check) is left in place while 52998224725 is redacted. Sequences of a single repeated digit are also rejected. Detection remains probabilistic; validate against your own documents.

Test vectors

CPF, valid: 529.982.247-25 / 52998224725. Invalid (bad check digit): 52998224724.
CNPJ, valid: 11.222.333/0001-81 / 11222333000181. Invalid (bad check digit): 11222333000182.

Contextual cues

In free text, anchor on a nearby cue (“CPF”, “CNPJ”) and capture only the identifier with groupNumber:

{
  "classification": "br-cpf",
  "pattern": "CPF[\\s:#-]*(\\d{3}\\.?\\d{3}\\.?\\d{3}-?\\d{2})",
  "caseSensitive": false,
  "groupNumber": 1,
  "validator": { "name": "mod11", "params": { "variant": "cpf" } },
  "identifierFilterStrategies": [
    { "strategy": "REDACT", "redactionFormat": "[REDACTED-BR-CPF]" }
  ]
}

This trades recall for precision.

Prerequisites

Use Phileas 4.1.0 or later, which provides redaction policy schema 1.1.0 and the mod11 validator. The example input and output were verified against Phileas 4.1.0.

References

CPF and CNPJ (Receita Federal)

Use this policy

Download and load into your running Philter instance:

# Download the policy
curl -O https://raw.githubusercontent.com/philterd/pii-redaction-policies/main/policies/philterd/general/brazilian-identifiers.json

# Upload to your Philter instance
curl -X POST http://localhost:8080/api/policies \
     -H "Content-Type: application/json" \
     --data @brazilian-identifiers.json

# Redact text using the policy
curl http://localhost:8080/api/filter?p=brazilian-identifiers \
     --data "your text here" \
     -H "Content-Type: text/plain"

No Philter instance yet? Deploy one in 5 minutes → · Want to tune this policy against your data? Talk to the team.

← All policies