CPF vs CNPJ: Brazil's Individual and Company Tax IDs Explained

Introduction

The CPF identifies a person and the CNPJ identifies a company. Both are issued by the Receita Federal (Brazil's federal tax authority), both carry check digits, and almost every Brazilian form asks for one of them. If your user is an individual, you collect a CPF. If your user is a business, you collect a CNPJ, and usually the CPF of the people behind it too.

For a team outside Brazil, mixing the two up causes real problems: a seller onboarded as a person when they invoice as a company, or a company verified without anyone checking who controls it. This guide explains how each number works, what you can verify with it and how the two connect.

What the CPF is

The CPF (Cadastro de Pessoas Físicas, Brazil's individual taxpayer ID) is a lifelong number for each person. It ties people to bank accounts, Pix keys, invoices, employment records and identity documents. Foreigners with tax, banking or property ties to Brazil can also hold one.

• Format: 11 digits, written as 000.000.000-00. The last two are check digits.
• Who holds it: individuals, Brazilian or foreign.
• Privacy: it is personal data under the LGPD (Brazil's data protection law), even though people share it at every checkout.

More detail in What Is a Brazilian CPF?

What the CNPJ is

The CNPJ (Cadastro Nacional da Pessoa Jurídica, Brazil's company taxpayer ID) is the national registry of legal entities, also run by the Receita Federal. Companies, nonprofits, government bodies and many other entities have one.

A CNPJ has 14 characters, written as 00.000.000/0000-00:

• The first 8 form the root, which identifies the company.
• The next 4 identify the establishment. 0001 is usually the head office, and branches get other numbers under the same root.
• The last 2 are check digits.

Two details matter for developers:

1. Branches share a root. Two CNPJs with the same first 8 characters belong to the same company. Your data model should not treat them as unrelated businesses.
2. The CNPJ is becoming alphanumeric. Under Instrução Normativa RFB 2,229/2024, the Receita Federal started issuing alphanumeric CNPJs to new registrations in July 2026. Existing numbers do not change, and the check digits stay numeric. A field that only accepts digits will reject valid new companies.

CPF vs CNPJ at a glance

The last row is the one that changes your compliance work. Company registration data is published by the Receita Federal in an open dataset, while CPF data belongs to individuals and needs a legal basis to process.

Where the two meet: partners and micro-entrepreneurs

The CPF and the CNPJ are not separate worlds. Every company has people behind it, and the CNPJ registration lists them in the QSA (Quadro de Sócios e Administradores, the list of partners and officers).

Small businesses blur the line even more. Many Brazilian sellers, couriers and freelancers work as an MEI (individual micro-entrepreneur), a simplified regime under the Simples Nacional. An MEI has its own CNPJ, but it is a one-person business, so the risk you are managing is really the risk of that person.

In practice:

• Onboarding a marketplace seller or courier? Ask whether they operate as a person (CPF) or a company (CNPJ). If it is an MEI or a small company, verify both the CNPJ and the CPF of the person who will run the account.
• Onboarding a larger company? Verify the CNPJ, check the registration status and look at the QSA to understand who is behind it. The KYB guide on this blog goes deeper on that flow.

How to verify each one

Verifying a CPF

The check digits only prove that the number is well formed. To know that the CPF exists and matches the user, look it up. The CPFHub.io Simple Lookup returns the holder's name, gender and date of birth:

curl --max-time 10 \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  https://api.cpfhub.io/cpf/00000000000

A CPF that is not found returns 404 and does not use a credit. When you need the registration status at the Receita Federal or the year of death, use the Real-Time Lookup, which takes the CPF and the holder's date of birth. The full flow is in How to Verify a Brazilian CPF Number.

Verifying a CNPJ

The CNPJ Lookup uses the same API key and the same credit balance:

curl --max-time 10 \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  https://api.cpfhub.io/cnpj/11222333000181

It accepts numeric and alphanumeric CNPJs, with or without formatting, and returns fields such as razao_social (legal name), nome_fantasia (trade name), situacao_cadastral (registration status: Ativa, Baixada, Inapta, Suspensa or Nula), main and secondary CNAE activity codes, address, company size, Simples Nacional and MEI options, and the QSA. The CPF of an individual partner always comes back masked.

The data comes from the Receita Federal's public CNPJ dataset and is refreshed monthly, so a very recent change can take a cycle to appear. A CNPJ that is not found returns 404 and does not use a credit. Field reference in the CNPJ documentation.

For a single manual check, the Receita Federal also has a public CNPJ lookup page with a captcha.

Common mistakes

• One field for both. A single "tax ID" field that accepts 11 or 14 characters makes validation and analytics harder. Ask first whether the user is a person or a company, then show the right field.
• Digits only. Since July 2026, new CNPJs can contain letters. Normalize to uppercase and strip punctuation, but keep letters.
• Treating branches as new companies. Group CNPJs by the 8-character root.
• Verifying the company and forgetting the person. A valid, active CNPJ says nothing about who is typing. For small businesses, verify the CPF of the account owner as well.

Frequently asked questions

Can a person have both a CPF and a CNPJ?

Yes. Every person keeps their CPF, and if they open a company or register as an MEI, that business gets its own CNPJ. The two numbers coexist and identify different legal persons.

Is the CNPJ the same as a company registration number?

It is the federal tax registration of the entity, and in practice the number every Brazilian business uses on invoices, contracts and bank accounts. State and municipal registrations exist too, but the CNPJ is the identifier you collect for KYB.

Do I need a CPF or a CNPJ to invoice a Brazilian customer?

It depends on whether the customer is a person or a company. Brazilian electronic invoices identify the buyer by CPF or CNPJ. Confirm the invoicing rules for your setup with a Brazilian accountant.

How much does a CNPJ lookup cost?

The CNPJ Lookup uses the same credit balance as the CPF lookups, and a CNPJ that is not found does not use a credit. Plans start with 50 free credits and no credit card. See pricing.

Read also

• What Is a Brazilian CPF? A Guide for Foreign Companies
• How to Verify a Brazilian CPF Number
• Brazil KYC Requirements in 2026: What Foreign Companies Need to Know
• Brazil Identity Verification API: What Data You Can Get from a CPF

Conclusion

The CPF identifies people and the CNPJ identifies companies, and Brazilian onboarding uses both. Collect the right one for each user type, accept the new alphanumeric CNPJ, and verify the person behind small businesses as well as the business itself.

Test CPF and CNPJ lookups with 50 free credits and no credit card at cpfhub.io.