How the number is built and checked
A PESEL is eleven digits, RRMMDDPPPPK: the last two digits of the birth year, the month, the day, a four-digit serial PPPP and the check digit K. The last digit of the serial is even for women and odd for men. The minister for digital affairs assigns the number. [1]
The month carries the century. January to December are 01–12 for people born 1900–1999, 21–32 for 2000–2099, 41–52 for the 2100s, 61–72 for the 2200s and 81–92 for 1800–1899. So someone born on 12 January 1914 has a PESEL starting 140112, and someone born on 12 January 2014 one starting 142112. [1]
The check digit: multiply the first ten digits by 1 3 7 9 1 3 7 9 1 3, add up the last digit of each product, and subtract the last digit of that sum from 10. gov.pl works it through on 0207080362: 0 + 6 + 0 + 3 + 0 + 4 + 0 + 7 + 6 + 6 = 32, and 10 − 2 = 8, so the full number is 02070803628. When the sum ends in 0 the result is 10, which nullcipher reads as a check digit of 0. [1]
One random number in ten has the right check digit, and an eleven-digit order or account number can easily hold a plausible date. So nullcipher masks a PESEL only when PESEL (or numer PESEL, nr PESEL) stands within 40 characters before it, and only when the date is real and the check digit matches.
How nullcipher recognises it
Eleven digits YYMMDDZZZXQ with a real date, where the month carries the century (01–12 for 1900–1999, 21–32 for 2000–2099, 41–52, 61–72 and 81–92 for 2100s, 2200s and 1800s) and Q is the check digit: the first ten digits times 1 3 7 9 1 3 7 9 1 3, summed, and 10 minus the last digit of the sum (0 when that last digit is 0). One number in ten passes by chance, so it is only masked with a context word — PESEL, numer PESEL — within 40 characters before it.
This is the rule text of the “Polish PESEL number” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.
Example (fake)
PESEL 02070803628nullcipher replaces it with [PESEL_1]. This is gov.pl's own worked example of the check-digit calculation, for a birth date of 8 July 1902.
Why it matters in an AI chat
A PESEL gives away the exact date of birth and the sex, and it is the number Polish public registers file people under, so it turns up next to names in HR exports, patient lists and contracts.
Since 1 June 2024 banks and other financial institutions must check whether a PESEL is reserved before they sign, for example, a loan or credit agreement. That is what a leaked PESEL is mostly good for: credit taken out in someone else's name.
Masked, the AI sees [PESEL_1] and can still help with the rest of the text.
If it already leaked
- Reserve the number (zastrzeż PESEL). Online it takes a trusted profile (profil zaufany), a qualified signature, an e-ID card or your online-banking login and is done in mObywatel; you can also apply at a municipal office. Any adult with a PESEL can do it, it is free, and it takes effect at once. [2]
- A reserved PESEL does not get in the way of daily life: you can still register with a doctor, fill a prescription, take cash from a machine, make bank transfers, travel abroad and deal with offices. When you want a loan you lift the reservation yourself, indefinitely or until a date and time you choose. [2]
- If it only went into an AI chat and there is no sign of misuse, delete the conversation — how, for each major assistant, is on the page listing every type. Reserving the number protects you whether or not anyone read the chat.
Sources
- Czym jest numer PESEL — gov.pl — checked 2026-10-03.
- Zastrzeż swój numer PESEL lub cofnij zastrzeżenie — gov.pl — checked 2026-10-03.
Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 242 detectors, with a page for 59 secret types, and how to delete a chat you already sent.