nullcipher

Italian codice fiscale

Sixteen characters from name, birth date, sex and place, with a check character; omocodia letters accepted. Masked even without a context word. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Italian codice fiscale

What an AI chat would receive after masking

Codice fiscale [CODICE_FISCALE_1]

1 × Italian codice fiscale found and masked.

How the number is built and checked

A codice fiscale for a person is sixteen characters: three letters from the surname, three from the first name, the last two digits of the birth year, a letter for the month, the day of birth (plus 40 for women), four characters for the place of birth and a final check character. [1]

The rules come from the Ministry of Finance decree of 23 December 1976. When two people's data give the same code (omocodia), the Agenzia delle Entrate gives each a different one by replacing digits, starting from the right, with letters and recomputing the check character; the decree maps 0–9 to L M N P Q R S T U V. It is rare: in 2015 the code had to be differentiated for 35,800 people among more than 94 million registered subjects, under 0.08% of all codes. [2]

The check character comes from the first fifteen: characters in odd positions (1st, 3rd, …) are converted with the decree's odd-position table, those in even positions count A=0 … Z=25 or their digit value, and the total mod 26 gives the letter. For RSSMRA85T10A562 the total is 122, 122 mod 26 = 18, so the check character is S.

Because the structure and the check character together are rare by chance, nullcipher masks a codice fiscale even without a label, in upper or lower case.

How nullcipher recognises it

Sixteen characters: six letters for surname and name, two-digit year, a month letter (A B C D E H L M P R S T), two-digit day (plus 40 for women), a letter and three digits for the place of birth, and the check character computed from the first fifteen with the odd- and even-position tables of the 1976 decree. The digits may be replaced by the omocodia letters L M N P Q R S T U V. Upper or lower case. The structure and check together are rare enough by chance to be masked without a context word.

This is the rule text of the “Italian codice fiscale” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

Codice fiscale RSSMRA85T10A562S

nullcipher replaces it with [CODICE_FISCALE_1]. Constructed for illustration in the way the textbook “Mario Rossi” example is: RSS and MRA from the names, 85 for 1985, T for December, 10 for the day and A562 as the place code, with the correct check character S.

Why it matters in an AI chat

A codice fiscale is worked out from your surname, first name, date and place of birth and sex, so reading it back gives away all of those except the full name. It changes only if those personal data change.

It is on the tessera sanitaria, on every contract, payslip and invoice, and it is the key Italian bodies use to find you — which is why pasted invoices and HR files are full of them.

Masked, the AI sees [CODICE_FISCALE_1] and can still read the invoice or the payslip.

If it already leaked

  1. Report online crimes to the Polizia Postale: a pre-report (pre-denuncia) at denunceonline.poliziadistato.it, signed in with SPID or CIE, which you then formalise at a Polizia di Stato office within 48 hours. When checked, the online pre-report was still a pilot open at some offices only; otherwise make the report in person at a police office. [3]
  2. The Polizia Postale's advice: take your time before giving out personal or banking data, never send copies of documents through links in text messages or e-mails, and check any request by calling back on a number you already know. [4]
  3. If the tessera sanitaria or the codice fiscale card was lost or stolen, ask the Agenzia delle Entrate for a replacement — online with SPID, CIE or CNS for the health card, or at an office. [1]
  4. If it only went into an AI chat and there is no sign of misuse, delete the conversation — how, for each major assistant, is on the page listing every type. The number itself stays the same, so the steps above are about noticing and blocking misuse, not about replacing it.

Sources

  1. Codice fiscale e tessera sanitaria — risposte alle domande più frequenti (cittadini) — Agenzia delle Entrate — checked 2026-09-23.
  2. Il codice fiscale e le problematiche collegate alle omocodie — hearing of the Director of the Agenzia delle Entrate, 10 February 2016 (PDF) — checked 2026-09-23.
  3. Denuncia per reati telematici — Polizia Postale — checked 2026-09-23.
  4. Furto d'identità: proteggi i tuoi dati dai cybercriminali (14 March 2025) — Polizia Postale — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 30 secret types and how to delete a chat you already sent.