nullcipher

German tax ID (Steuer-ID, IdNr)

Eleven digits: one digit repeated in the first ten, and an ISO 7064 MOD 11,10 check digit. Masked after a context word. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: German tax ID (Steuer-ID)

What an AI chat would receive after masking

Steuer-ID [STEUER_ID_1]

1 × German tax ID (Steuer-ID) found and masked.

How the number is built and checked

The IdNr is eleven digits and never starts with 0. Among the first ten digits either exactly two or exactly three are the same, and three equal digits never stand directly one after another. The eleventh is the check digit. [1]

The check digit follows ISO 7064 MOD 11,10: start with 10; for each of the first ten digits, add it, take the sum mod 10 (a 0 becomes 10), double that and take it mod 11. The check digit is 11 minus the final value, and 10 becomes 0. For 8609574271 the running value goes 5, 2, 4, 6, 2, 7, 2, 8, 10, 2, so the check digit is 9: 86095742719. [1]

The number stays valid for life, through marriage, a move or a change of name. [2]

About 1 in 10 random numbers get the check digit right, so nullcipher masks an eleven-digit number (also written 12 345 678 901) only after Steuer-ID, Steueridentifikationsnummer, Identifikationsnummer, IdNr or tax ID within 40 characters.

How nullcipher recognises it

Eleven digits (or 12 345 678 901), not starting with 0, where among the first ten exactly one digit repeats — twice, or three times but never three in a row — and the 11th is the ISO 7064 MOD 11,10 check digit. That check is passed by about 1 in 10 random numbers, so it is only masked with a context word — Steuer-ID, Steueridentifikationsnummer, Identifikationsnummer, IdNr, tax ID — within 40 characters before it.

This is the rule text of the “German tax ID (Steuer-ID)” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

Steuer-ID 86095742719

nullcipher replaces it with [STEUER_ID_1]. This is the first of the valid example numbers in the IdNr check-digit concept published by Deutsche Rentenversicherung (among the first ten digits only the 7 appears twice, and the check digit is 9).

Why it matters in an AI chat

Employers, pension providers, health insurers, the employment agency and banks all receive the IdNr, and employers and benefit providers can obtain it automatically if you do not give it. It therefore sits in countless payroll and HR files — the files people paste into AI chats to ask about a payslip.

It does not change after a leak: the BZSt keeps the same number for your whole life.

Masked, the AI sees [STEUER_ID_1] and can still explain the payslip or the tax letter.

If it already leaked

  1. If your identity has been misused, the BSI (Federal Office for Information Security) advises filing a criminal complaint, which you can do at your state police's online station (Onlinewache). [3]
  2. Check with the leak checkers the BSI names (Hasso Plattner Institute, University of Bonn) whether your details appear in known leaks, and secure your bank, shopping, social media and e-mail accounts with strong passwords and two-factor authentication. [3]
  3. For your rights as someone affected, the BSI points to the consumer advice centres (Verbraucherzentralen) and the Federal Commissioner for Data Protection (BfDI). [3]
  4. Do not expect a new number: the IdNr stays the same for life; the BZSt can only tell you your existing number again on request. [2]
  5. If it only went into an AI chat and there is no sign of misuse, delete the conversation — how, for each major assistant, is on the page listing every type. The number itself stays the same, so the steps above are about noticing and blocking misuse, not about replacing it.

Sources

  1. Steueridentifikationsnummer (IdNr) nach § 139b AO — Informationen zur Berechnung gültiger Prüfziffern, version 2.3 of 1 March 2016 (PDF) — Deutsche Rentenversicherung Bund, Zentrale Zulagenstelle für Altersvermögen — checked 2026-09-23.
  2. Fragen und Antworten zur IdNr — Bundeszentralamt für Steuern (BZSt) — checked 2026-09-23.
  3. Identitätsdiebstahl durch Datenleaks und Doxing — Bundesamt für Sicherheit in der Informationstechnik (BSI) — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 30 secret types and how to delete a chat you already sent.