The last character of most national identity numbers is not part of the identifier itself. It is a check digit, computed from the characters that come before it. Its only job is to catch common typing mistakes, and it is effective at that. But it cannot tell you if the number was ever issued to a real person — a distinction that is frequently missed.

What the last character is for

The scheme is old and widely used on bank account numbers, ISBNs, shipping references, and barcodes. You take the digits, multiply each by a fixed weight, add the results, divide by some number and derive a character from the remainder. Change one digit and the total changes, so the character no longer matches. Swap two adjacent digits and, with well-chosen weights, the total also changes.

Those two errors — one wrong digit, and two digits the right way round in the wrong order — are the overwhelming majority of mistakes people make copying a long number. A check digit catches these errors at the point of entry, preventing them from causing problems downstream.

China's resident identity card uses a scheme of this family, specified in the national standard GB 11643-1999. The seventeen digits are weighted, summed, and reduced to produce a final character with eleven possible values — the ten digits and, for the eleventh, the letter X. That X is a Roman numeral ten, and the standard says so directly, which is why an ID ending in X is not a data-entry error.

Why it proves nothing about a person

What gets lost is that the check digit is a function of the other digits, and the function is public.

That means anyone can compute it. Given any seventeen digits, working out the eighteenth is arithmetic that a person could do on paper. The calculation contains no secret key or any other information known only to the issuing authority. A number that passes therefore tells you exactly one thing: whoever typed it made no single-digit error. It does not tell you the number was ever issued, that it belongs to the person presenting it, or that the person exists.

The distinction is between a number being well formed and a number being real. Only the issuing authority can answer the second question, and it answers it by looking the number up, not by doing arithmetic on it.

Singapore has written the distinction into policy

This is not only a technical observation. Singapore's regulator has drawn exactly this line and attached a deadline to it.

The position is that an NRIC number may be used to identify someone — to say which record we are talking about — but must not be used to authenticate them, that is, to prove they are who they claim. Organisations were told to stop using NRIC numbers as passwords, as default account credentials, or as the thing that unlocks access, with a deadline at the end of 2026 and enforcement following.

The reasoning is the same as the arithmetic. An identifier that appears on forms, gets quoted in correspondence and is printed on documents is not a secret, and something everybody can see cannot be the thing that proves you are you. A check digit does not change that, because the check digit is computable by the same everybody.

Hong Kong's is not even published

The HKID also has a check character, usually in brackets at the end. The same logic applies, but with an important caveat: the algorithm is not officially published.

What circulates is a reconstruction. It is consistent, it works, and implementations agree with each other — but no specification from the issuing department underlies it, which means anything built on it rests on reverse engineering rather than on a standard. That does not make a validator useless; it does mean the confidence attached to the result should be lower than for a scheme with a published specification behind it, and anyone telling you otherwise is overstating what they know.

The part of the number that is not arithmetic

Chinese ID numbers carry structure beyond the checksum. The first six digits are an administrative division code identifying where the card was issued, and those codes are governed by a separate standard.

The wrinkle is that the code is fixed at issue and division codes change. Districts merge, get renamed, get reorganised, and retired codes are not reassigned to anywhere else. So a perfectly valid, currently held ID can contain a code that no longer appears in any current lookup table.

Tools that map the code to a place name will therefore sometimes return nothing, or return the wrong answer if they silently fall back to a nearby match. A tool should report that the code is retired. One that always returns a place name, perhaps by falling back to a nearby match, is not being helpful — it is being careless.

What to do instead of checking arithmetic

For tasks like validating form input or cleaning a data import, a checksum validator is the right tool — which is what our China resident ID and Hong Kong HKID format validators do. It will catch the common typos it was designed for.

If you need to know a person is who they say, no format check will do it. That requires verification against the issuing authority, or a document check, or one of the national digital identity services, and those exist precisely because arithmetic cannot answer the question.

Where this comes from, and what will date

The Chinese scheme, its weights, and the meaning of the X are specified in GB 11643-1999, which also references the standard governing division codes. The identification-versus-authentication distinction and the deadline are from Singapore's data protection regulator. The Hong Kong scheme is described from public reconstructions because no official specification exists.

The arithmetic does not date. The Singapore deadline does — it falls at the end of 2026, after which the relevant question stops being what organisations must do and becomes what they did. Division codes will keep changing, which is the point of that section rather than a caveat to it.

Note on what this guide deliberately omits. There are no complete worked identity numbers here. The arithmetic is described, but no complete, valid-looking numbers are provided. A page arguing that such numbers prove nothing should not help anyone generate them.