Croatian OIB (osobni identifikacijski broj)

How the number is built and checked

An OIB has eleven digits: ten chosen at random, which carry no information about the person, and one check digit. By law it is unique, reveals nothing, never changes and is never reused. For international data exchange the letters HR are put in front. ^[1]

The check digit follows ISO 7064 “MOD 11,10”. Start with 10; for each of the ten digits add it, take the result mod 10 (counting 0 as 10), double that and take it mod 11. The check digit is 11 minus the final value, and 0 when that gives 10. For the first ten digits of the Tax Administration's own OIB, 1868313648, the running value goes 2, 9, 10, 5, 5, 1, 8, 8, 4, 4, so the check digit is 11 − 4 = 7: 18683136487. ^[2][4]

Because the other ten digits are random, the check digit is the only thing to test, and one random eleven-digit number in ten passes. nullcipher therefore masks it only when OIB or osobni identifikacijski broj stands within 40 characters before it. The German tax ID uses the same check; a number labelled Steuer-ID is masked as a German tax ID.

How nullcipher recognises it

Eleven digits: ten chosen at random and an ISO 7064 MOD 11,10 check digit. Nothing else in the number can be checked and one random number in ten passes, so it is only masked with a context word — OIB, osobni identifikacijski broj — within 40 characters before it.

This is the rule text of the “Croatian OIB (osobni identifikacijski broj)” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

OIB: 18683136487

nullcipher replaces it with [OIB_1]. This is the OIB the Tax Administration (Porezna uprava) prints in its own contact details — an office's number, not a person's — used here as the example.

Why it matters in an AI chat

The OIB is the permanent identifier that Croatian bodies use in official records, in everyday work and when exchanging data, so it appears on official paperwork of every kind.

AZOP, the data protection agency, warns that once someone has your name, phone, e-mail or OIB, you should expect phishing that tries to get the rest, such as your card details.

Masked, the AI sees [OIB_1] and can still help with the rest of the text.

If it already leaked

1. Be especially careful with e-mails and messages that follow: do not reply to a suspicious one or open its attachment, do not click its link but type the address into the browser yourself, and never send a PIN, password or other confidential data in reply. ^[3]
2. The OIB cannot be changed, so there is no new number to apply for. ^[1]
3. If it only went into an AI chat and there is no sign of misuse, delete the conversation — how, for each major assistant, is on the page listing every type. Watching for phishing and misuse is what protects you afterwards.

Sources

1. Zakon o osobnom identifikacijskom broju (NN 60/2008), članci 3–4 — Narodne novine — checked 2026-10-03.
2. Pravilnik o osobnom identifikacijskom broju (NN 1/2009), članak 3 — Narodne novine — checked 2026-10-03.
3. Savjeti građanima za samozaštitno ponašanje — Agencija za zaštitu osobnih podataka (AZOP) — checked 2026-10-03.
4. Porezna uprava (contact details: “OIB: 18683136487”) — checked 2026-10-03.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 242 detectors, with a page for 59 secret types, and how to delete a chat you already sent.