nullcipher

Finnish personal identity codes (henkilötunnus, HETU)

DDMMYY, a century sign, an individual number and a mod-31 control character. Masked even without a context word. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Finnish henkilötunnus (HETU)

What an AI chat would receive after masking

HETU [HETU_1]

1 × Finnish henkilötunnus (HETU) found and masked.

How the number is built and checked

A henkilötunnus is eleven characters, DDMMYYCZZZQ: date of birth, a century sign, a three-digit individual number and a control character. DVV's example is 131052-308T, a woman born on 13 October 1952. [1]

The century sign is + for the 1800s, - for the 1900s and A for the 2000s. Since 2023 there are more, so the codes do not run out: Y, X, W, V and U for the 1900s and B, C, D, E and F for the 2000s. The first code with Y was issued on 19 December 2023; existing codes did not change. [2]

The individual number is odd for men and even for women; DVV says the numbers issued are in practice between 002 and 899. nullcipher accepts 002–999 rather than risk missing one. [1]

The control character is the nine digits DDMMYYZZZ taken as one number, mod 31, looked up in 0123456789ABCDEFHJKLMNPRSTUVWXY (G, I, O, Q and Z are left out). For DVV's example 131052308 mod 31 = 25, the 26th character, T. The century sign is not part of the calculation. [1]

A real date, a valid century sign and a 1-in-31 control character together are rare by chance, so nullcipher masks a HETU even when no word like henkilötunnus stands in front of it.

How nullcipher recognises it

DDMMYY, a century sign (+ for the 1800s; -, Y, X, W, V or U for the 1900s; A, B, C, D, E or F for the 2000s — the letters other than A were added in 2023), a three-digit individual number from 002 and the control character: the nine digits DDMMYYZZZ mod 31 looked up in 0123456789ABCDEFHJKLMNPRSTUVWXY. A real date, a century sign and a 1-in-31 check together are rare enough by chance to be masked without a context word.

This is the rule text of the “Finnish henkilötunnus (HETU)” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

HETU 131052-308T

nullcipher replaces it with [HETU_1]. This is DVV's own example code, the one it uses to explain each part.

Why it matters in an AI chat

The code identifies a person for life. DVV changes it only in very exceptional cases — when someone's health or safety is threatened, or when another person has repeatedly misused the original code.

It gives away the exact date of birth and the sex, so a HETU next to a masked name still points at one person. Finnish payroll files, patient records and customer tickets carry it routinely.

Masked, the AI sees [HETU_1] and can still help with the rest of the text.

If it already leaked

  1. Report the offence to the police (for example in the police e-services) and follow their instructions. [3]
  2. Ask DVV for a block on notifications of move; once it is in place a move can only be notified in person at an office. You can also restrict the disclosure of your data from the population register for customer registers and direct marketing. [3]
  3. Place a voluntary credit ban in the Tax Administration's positive credit register, so no one can take loans, credit cards or instalment purchases in your name; Suomi.fi also recommends restricting account-number changes in MyTax and a registration prohibition at the Finnish Patent and Registration Office. [4]
  4. A new code is possible only when repeated misuse has clearly caused serious harm that a change could prevent. [3]
  5. If it only went into an AI chat and there is no sign of misuse, delete the conversation — how, for each major assistant, is on the page listing every type. The number itself stays the same, so the steps above are about noticing and blocking misuse, not about replacing it.

Sources

  1. Personal identity code — Digital and Population Data Services Agency (DVV) — checked 2026-09-23.
  2. Uudet välimerkit takaavat henkilötunnusten riittävyyden — DVV (the new century signs, first issued 19.12.2023) — checked 2026-09-23.
  3. Questions and answers for victims of identity theft or data leak — DVV — checked 2026-09-23.
  4. Make the necessary blocks — Suomi.fi guide for victims of identity theft and data leaks — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 30 secret types and how to delete a chat you already sent.