How the number is built and checked
A kennitala is ten digits, DDMMYY-NNVÖ: the birth date, two digits with no meaning (normally given in order from 20), the check digit V and the century digit Ö — 9 for the 1900s, 0 for the 2000s, 8 for the 1800s. Þjóðskrá assigns it automatically at birth or registration. [1]
The check digit: multiply the first eight digits by 3 2 7 6 5 4 3 2, add, divide by 11 and subtract the remainder from 11. Þjóðskrá's worked example is someone born on 12 January 1960 with serial 33: 3 + 4 + 0 + 6 + 30 + 0 + 9 + 6 = 58, 58 mod 11 = 3, 11 − 3 = 8, so the first nine digits are 120160-338 and, with 9 for the century, the number is 120160-3389. A result of 11 gives 0; a result of 10 cannot be used, so the serial is raised by one and the digit recalculated. [1]
From 18 February 2026 Þjóðskrá issues kennitölur that do not pass this check, and warns that systems relying on it must change. nullcipher still requires the check, because without it any ten digits that start with a date would be masked. So a kennitala issued from that date is not recognised: add it to your own word list in the masking tool instead. [1]
It is masked only when kennitala (or kt.) stands within 40 characters before it, with a real date, a valid century digit and a matching check digit.
How nullcipher recognises it
DDMMYY-NNCÖ or ten digits: a real date, two serial digits NN, the check digit C (the first eight digits times 3 2 7 6 5 4 3 2, summed; 11 minus the sum mod 11, where 11 becomes 0 and 10 is never issued) and the century digit Ö (9 for the 1900s, 0 for the 2000s, 8 for the 1800s). Kennitölur issued from 18 February 2026 no longer pass this check and are not recognised. Masked with a context word — kennitala, kt. — within 40 characters before it.
This is the rule text of the “Icelandic kennitala” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.
Example (fake)
kennitala 120160-3389nullcipher replaces it with [KENNITALA_1]. Built from Þjóðskrá's own worked example (born 12 January 1960, serial 33, check digit 8), with the century digit 9 that a 1960 birth gets.
Why it matters in an AI chat
The Icelandic data protection act allows a kennitala to be used whenever it has a legitimate purpose and is needed for secure identification, so it is asked for in many everyday dealings and turns up in customer e-mails, invoices and spreadsheets.
Its first six digits are the birth date and its last digit the century, so a kennitala next to a masked name still points at one person.
Masked, the AI sees [KENNITALA_1] and can still help with the rest of the text.
If it already leaked
- If it has been used to commit an offence, go to the police. Lögreglan explains when to report an offence (tilkynna) and when to press charges (kæra), and asks you to contact it if you are not sure which. [3]
- The data protection act lets Persónuvernd, the data protection authority, prohibit or order the use of kennitölur (article 13). An organisation that asks for yours without a legitimate purpose can be challenged on that ground. [2]
- If it only went into an AI chat and there is no sign of misuse, delete the conversation — how, for each major assistant, is on the page listing every type. The number does not change because it leaked.
Sources
- Um kennitölur — Þjóðskrá — checked 2026-10-03.
- Lög um persónuvernd og vinnslu persónuupplýsinga nr. 90/2018, 13. gr. — Alþingi — checked 2026-10-03.
- Tilkynna brot — Lögreglan (island.is) — checked 2026-10-03.
Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 242 detectors, with a page for 59 secret types, and how to delete a chat you already sent.