nullcipher

Norwegian fødselsnummer and D-numbers

DDMMYY + three individual digits + two mod-11 check digits; a D-number adds 4 to the first digit. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Norwegian fødselsnummer

What an AI chat would receive after masking

Fødselsnummer: [FODSELSNUMMER_1]

1 × Norwegian fødselsnummer found and masked.

How the number is built and checked

A fødselsnummer is eleven digits: the date of birth as DDMMYY, a three-digit individual number and two check digits. Today the third individual digit also records the gender. [1]

The check digits are k1 = 11 − ((3·d1 + 7·d2 + 6·m1 + 1·m2 + 8·y1 + 9·y2 + 4·i1 + 5·i2 + 2·i3) mod 11) and k2 = 11 − ((5·d1 + 4·d2 + 3·m1 + 2·m2 + 7·y1 + 6·y2 + 5·i1 + 4·i2 + 3·i3 + 2·k1) mod 11). A result of 11 becomes 0; a result of 10 means that individual number cannot be used. For 010190 124 the first sum is 102, remainder 3, so k1 = 8; the second sum is 110, remainder 0, so k2 = 0: 01019012480. [3]

A D-number, for people who need a Norwegian identity number without qualifying for a fødselsnummer (for example because they pay tax in Norway or own property there), is built the same way with 4 added to the first digit: born on 1 January 1985, it starts 410185. [2]

From 2032 new numbers become gender-neutral and k1 may take up to four values instead of one (k2 is unchanged). nullcipher already accepts those values, so numbers issued under the new rule are caught too. The price is that about 1 in 30 random numbers get both check digits right, so nullcipher still wants a word such as fødselsnummer, fnr, D-nummer or personnummer within 40 characters before the number. [3]

How nullcipher recognises it

Eleven digits, DDMMYY plus five, passing both mod-11 check digits (k1 with weights 3 7 6 1 8 9 4 5 2, k2 with 5 4 3 2 7 6 5 4 3 2); the extra k1 values Skatteetaten allows from 2032 are accepted too. A D-number is the same with 4 added to the first digit (day + 40). Masked with a context word — fødselsnummer, fnr, D-nummer, personnummer, national identity number — within 40 characters before it.

This is the rule text of the “Norwegian fødselsnummer or D-number” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

Fødselsnummer: 01019012480

nullcipher replaces it with [FODSELSNUMMER_1]. Skatteetaten publishes no complete specimen number, so this one is constructed for illustration: born 1 January 1990, individual number 124, and the check digits 8 and 0 that the formula above gives.

Why it matters in an AI chat

Norwegian banks, employers, NAV, the health service and the tax administration all key their records on the fødselsnummer, and it gives away the date of birth and, for numbers issued before 2032, the gender.

The Norwegian Data Protection Authority's advice to ID-theft victims is about limiting the damage — blocking credit, watching accounts and post — not about replacing the number, because a leaked number stays in use.

A pasted HR case or customer log typically holds the number next to a name and an address, which is exactly the combination needed to impersonate someone. Masked, the AI sees [FODSELSNUMMER_1] and can still follow the case.

If it already leaked

  1. Report ID theft to the police (politiet.no) as soon as possible, and write down everything that happened in as much detail as you can. [4]
  2. Ask the credit information agencies (kredittopplysningsbyråene) for a voluntary credit block, so no one can get credit in your name. You have to lift it yourself when you need credit. [4]
  3. Tell your bank, card and insurance companies. Close accounts with transactions you did not make at once and ask for written confirmation, and report unknown transactions as soon as you see them. [4]
  4. Keep an eye on your post, and contact Posten if you suspect someone has redirected it. [4]
  5. If it only went into an AI chat and there is no sign of misuse, delete the conversation — how, for each major assistant, is on the page listing every type. The number itself stays the same, so the steps above are about noticing and blocking misuse, not about replacing it.

Sources

  1. Fødselsnummer — Skatteetaten (Norwegian Tax Administration) — checked 2026-09-23.
  2. D-nummer — Skatteetaten — checked 2026-09-23.
  3. Nytt fødselsnummer fra 2032 — Skatteetaten's Folkeregisteret API documentation (today's k1/k2 formulas and the 2032 rule) — checked 2026-09-23.
  4. Råd til deg som er utsatt for ID-tyveri — Datatilsynet (Norwegian Data Protection Authority) — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 30 secret types and how to delete a chat you already sent.