Which regex validates a CPF?

To accept it with or without punctuation: ^(?:\d{3}\.\d{3}\.\d{3}-\d{2}|\d{11})$. It checks the format only: 111.111.111-11 passes the regex and is not a valid CPF. To check the check digit, use the CPF validator on this site or do the calculation in your code.

Can a regex validate the check digit?

Not in practice. The digit comes from a weighted sum with modulo 11, and a regex cannot do arithmetic. The way to go is a regex for the format and a function for the digit. The badge in the Check digit column of the results uses the same calculation as the CPF, CNPJ and PIS validators on this site.

What does the alphanumeric CNPJ regex look like?

The first 12 positions accept uppercase letters and digits, and the last two characters are always digits: ^[0-9A-Z]{2}\.[0-9A-Z]{3}\.[0-9A-Z]{3}/[0-9A-Z]{4}-\d{2}$ with punctuation, or ^[0-9A-Z]{12}\d{2}$ without. It also accepts every numeric CNPJ. If the field should only take the current format, pick the numeric variant.

How do I validate Mercosul and old plates with a regex?

The Mercosul plate follows the LLLNLNN format: ^[A-Z]{3}\d[A-Z]\d{2}$, with the i flag to accept lowercase. The old one is LLL-NNNN, with the hyphen optional when written: ^[A-Z]{3}-?\d{4}$. To accept both: ^[A-Z]{3}(?:-?\d{4}|\d[A-Z]\d{2})$. Neither tells you whether the plate was actually issued.

How do I validate a Brazilian phone number with a regex?

A mobile number has a two-digit area code and nine digits starting with 9. With a mask: ^$[1-9]{2}$ ?9\d{4}-\d{4}$. A landline has eight digits starting with 2 to 5. The pattern on this site accepts any two-digit area code without a zero, so codes that were never assigned, like 23, pass too. If you need the official list of area codes, check Anatel's numbering plan.

Why was my regex stopped?

It is probably catastrophic backtracking: a repeated group with a quantifier inside, like (a+)+$, tries an exponential number of combinations when the text ends without matching. Here the regex runs in a worker with a 2 second limit, so the tab does not freeze. To fix it, remove the nested repetition or write a part that can only match one way, like a+$.

Does the regex work in Python, Java or PHP?

The patterns use common syntax: classes, quantifiers and, for extraction, lookbehind. For validation they work almost unchanged. The differences show up in named groups, flags and the double backslash in Java strings. Test in your engine before copying.

Is the text I test sent anywhere?

No. The regex runs in your browser, in a Web Worker. The text and the regex do not go to a server, the page address, usage metrics or local storage, so you can test a log with real data.

Regex tester with Brazilian patterns

Run a JavaScript regex against your text and see the matches, the groups and the result of a substitution. Ready-made patterns cover CPF, CNPJ (including the alphanumeric one), CEP, phone numbers and Mercosul license plates, to validate a form mask or pull data out of a log. Everything runs in your browser.

Regex

If you paste a regex written as /pattern/flags, the flags move to the buttons below.

Flags

Text to test

Each line is treated as its own value, like a form field. That makes ^ and $ apply to the line without the m flag.

Replace with (optional)

Type a regex

Write the regex and the text, or pick a Brazilian pattern below.

Brazilian patterns

Pick the document, the format, and whether you want to validate a whole field or extract from a text. The regex shows up ready to copy or to test here.

Document

Punctuation

Use

Pattern regex^(?:\d{3}\.\d{3}\.\d{3}-\d{2}|\d{11})$Flags: -

What this pattern does not check

Format only: the regex does not compute the check digit. The badge in the results uses the same calculation as the validator on this site.

Need values to test the CPF pattern?

Open the CPF generator

Regex for Brazilian documents

A regex only checks whether the text has the right shape. CPF, CNPJ, CEP, phone numbers and plates have well defined formats, so they fit a regex well, but the number can still be fake: the check digit needs a calculation a regex cannot do. The patterns on this page are for validating a field mask, where the regex covers the whole value, or for extracting documents from a log, finding each one in the middle of the text without cutting into a longer number.

What each pattern accepts

The table shows the format of each pattern. Punctuation can be required, forbidden or optional, and the format changes with the variation you pick.

Document	Accepts
CPF	000.000.000-00 or 00000000000
CNPJ	00.000.000/0000-00 or 14 digits; in the new format, uppercase letters and digits in the first 12 positions
CEP	00000-000 or 00000000
Phone	(11) 91234-5678 or 11912345678, with an optional +55; 8-digit landlines and old mobiles too
License plate	ABC1D23 (Mercosul) and ABC-1234 (old)
PIS/PASEP	000.00000.00-0 or 11 digits
Date	dd/mm/yyyy or ddmmyyyy
Amount in reais	R$ 1.234,56 or R$ 1234,56

Validating a field or extracting from a text

When validating, the regex starts with ^ and ends with $, so the whole value has to match, and a value with a stray line break is refused because the pattern does not use the m flag. When extracting, the regex uses the g flag and looks at what comes before and after: an 11-digit CPF is not pulled out of the middle of a 13-digit number. To test a list of values at once, use the per-line test.

This is JavaScript regex

The tester uses your browser's regex engine. In Python, Java, PHP or PCRE the syntax differs in a few places: the named group is (?P<name>...) in Python, Java needs double backslashes inside strings and some engines limit lookbehind. The Brazilian patterns use lookbehind for extraction, so check them in your engine before copying.

Stuck regex and privacy

The regex runs in a Web Worker with a 2 second limit. If it goes over, the worker is stopped and the tab keeps responding. The text and the regex stay in the browser's memory only: they do not go to a server, the page address, usage metrics or local storage.

Questions aboutregex and documents

Common questions from people who validate forms and extract data from logs in Brazil.