Spanish DNI and NIE numbers

How the number is built and checked

A DNI number is eight digits and a control letter. Divide the number by 23 and look the remainder up in the table T R W A G M Y F P D X B N J Z S Q V H L C K E (remainder 0 is T, 22 is E). The Ministry of the Interior's example: 12345678 ÷ 23 leaves 14, so the letter is Z — 12345678Z. The table never uses I, Ñ, O or U. ^[1]

A NIE, for foreign residents, is X, Y or Z, seven digits and a control letter. For the calculation X becomes 0, Y 1 and Z 2, and the same mod-23 table applies: X1234567 → 01234567 → L. ^[1]

For Spanish residents the same number and letter serve as the tax number (NIF). One letter in 23 is right by chance, so nullcipher masks a DNI- or NIE-shaped value only after DNI, NIE, NIF or documento nacional de identidad within 40 characters. ^[1]

How nullcipher recognises it

A DNI is eight digits and the letter TRWAGMYFPDXBNJZSQVHLCKE[number mod 23]; a NIE is X, Y or Z, seven digits and the same letter, computed with X, Y, Z read as 0, 1, 2. A hyphen or space before the letter is allowed. One letter in 23 is right by chance, so it is only masked with a context word — DNI, NIE, NIF, documento nacional de identidad — within 40 characters before it.

This is the rule text of the “Spanish DNI or NIE” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

DNI 12345678Z

nullcipher replaces it with [DNI_NIE_1]. This is the worked example on the Ministry of the Interior's own page about the control digit.

Why it matters in an AI chat

The DNI number is asked for everywhere in Spain — contracts, invoices, hotel check-ins, delivery apps — which is why it ends up in so many pasted spreadsheets and tickets.

INCIBE, Spain's national cybersecurity institute, documents a real case in which someone used another person's DNI and the victim ended up owing taxes to the Agencia Tributaria.

Masked, the AI sees [DNI_NIE_1] and can still work with the rest of the document.

If it already leaked

1. Report the identity theft (denuncia por suplantación de identidad) to the Policía Nacional or Guardia Civil, with all the evidence you have. ^[2]
2. Ask CIRBE, the Banco de España's credit-risk register, whether loans or credit were taken out in your name. ^[2]
3. If the card itself was stolen or copied, request an appointment to renew your DNI so the compromised document stops being valid; contact the Agencia Tributaria if tax obligations appeared in your name. ^[2]
4. INCIBE's free helpline 017 (Tu Ayuda en Ciberseguridad) guides you through which bodies to contact; also report impersonating profiles to each platform. ^[2][3]
5. If it only went into an AI chat and there is no sign of misuse, delete the conversation — how, for each major assistant, is on the page listing every type. The number itself stays the same, so the steps above are about noticing and blocking misuse, not about replacing it.

Sources

1. Cálculo del dígito de control del NIF/NIE — Ministerio del Interior — checked 2026-09-23. interior.gob.es answered automated requests with a browser challenge on 2026-09-23, so the text was checked that day against the Internet Archive's copy captured 2026-02-28. Internet Archive copy, captured 2026-02-28.
2. Tras ser suplantado con su DNI acaba debiendo impuestos a la Agencia Tributaria — INCIBE — checked 2026-09-23.
3. Suplantación de identidad y secuestro de cuentas: ¿cómo actuar? — INCIBE — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 30 secret types and how to delete a chat you already sent.