Which ID Numbers Does ONYRI Sanitize Detect, by Country?
A country-by-country list of the ID, tax, and social security numbers ONYRI Sanitize detects, and whether each is checked by format or by a real checksum.
ONYRI Sanitize checks a document against country-specific patterns for ID numbers, tax numbers, and social security numbers before it masks anything. Some of these checks only look at the shape of the number. Others run the same checksum formula the issuing government or bank uses. This page lists exactly what the engine looks for, country by country, and where you still need to check the result yourself.
How does ONYRI Sanitize check an ID number?
Every detector works one of two ways. A format check only confirms the shape is right, like a letter followed by eight digits. A checksum check goes further. It runs the same math the issuing body uses and drops a number that fails it. Take Jane Example's US passport number, C12345678. ONYRI confirms the shape but cannot confirm the number is real, because US passport numbers carry no public checksum. A French SIREN business number is different. ONYRI can verify its checksum on the spot.
France: which numbers does it detect?
| ID number | What it is | How ONYRI checks it |
|---|---|---|
| NIR (social security number) | 15 digits on a payslip or a Carte Vitale | Format only. The first digit must be 1 or 2, and Corsica's department code (2A or 2B) is accepted. No checksum is run. |
| SIRET | 14-digit ID for one business site | Format only: exactly 14 digits. |
| SIREN | 9-digit ID for the company itself | Format and checksum: the Luhn formula must pass. |
| VAT number (numéro de TVA) | FR, 2 digits, then the 9-digit SIREN | Format and checksum: the official key formula is checked. |
| IBAN | French bank account number | Format only. The interbank check digits are not verified. |
ONYRI also looks for French passport and ID card numbers, plus RIB bank slips and tax reference numbers. All four share the same limit as the NIR. The shape is checked, but there is no public checksum to confirm a fake-looking one is genuine. When in doubt, ONYRI masks it anyway, which is the safer direction to err on.
United States, United Kingdom, and Belgium: which numbers does it detect?
| ID number | Country | How ONYRI checks it |
|---|---|---|
| Social Security Number (SSN) | United States | Format plus rejection rules. An area, group, or serial pattern the SSA never issues is dropped. There is no single check digit. |
| EIN (Employer ID Number) | United States | Format plus a real-prefix check. The two-digit prefix must be one the IRS actually issues. |
| ZIP code | United States | Format plus range. 00000 is dropped, and so is a block that does not read like a real ZIP or ZIP+4. |
| National Insurance Number (NINO) | United Kingdom | Format plus rejection rules. Letter pairs HMRC never assigns are dropped. There is no single check digit. |
| National Number (Rijksregisternummer) | Belgium | Format and checksum: the modulo-97 key is checked against the birth date block. |
ONYRI also reads US passport numbers, and US driver's license numbers when a label like DL or Driver's license sits right next to the value. Without that label, a short mix of letters and digits is too ambiguous to flag safely. UK and Belgian postcodes are matched by format too, though a Belgian postcode only counts once a city name follows it.
Germany, Austria, and Switzerland: which numbers does it detect?
| ID number | Country | How ONYRI checks it |
|---|---|---|
| Steuer-ID (tax ID) | Germany | Format and checksum: an official ISO 7064 check digit is verified. |
| Versicherungsnummer (pension insurance number) | Germany | Format and checksum: the official formula set out in German insurance law is verified. |
| Sozialversicherungsnummer (SVNR) | Austria | Format and checksum: a weighted modulo-11 key is verified, and the embedded birth date must be real. |
| AHV number (n° AVS) | Switzerland | Format and checksum: the EAN-13 check digit is verified. Every real number starts with 756. |
These four checksums make DACH numbers some of the most reliable ONYRI detects. A German postal code needs more care. German capitalizes every common noun, so ONYRI only accepts a code next to a real place name, or next to a clear label such as PLZ, to avoid masking an ordinary amount like 2000 Euro.
Spain, Italy, the Netherlands, and Luxembourg: which numbers does it detect?
| ID number | Country | How ONYRI checks it |
|---|---|---|
| DNI / NIE | Spain | Format only. Recognized by shape: 8 digits plus a letter, or X, Y, or Z plus 7 digits plus a letter. Masked even if the control letter is wrong, so an OCR error can't leave it exposed. |
| NIF of a company (formerly CIF) | Spain | Format plus checksum or label: masked once the official check digit passes, or once CIF or NIF sits right next to it. |
| Codice fiscale | Italy | Format only. The 16-character shape is distinctive enough on its own. |
| Partita IVA (VAT number) | Italy | Format plus checksum or label: masked once its checksum passes, or once P.IVA sits right next to it. |
| BSN (citizen service number) | Netherlands | Format plus checksum or label: masked once it passes the official elfproef check, or once BSN sits right next to it. |
| National number (matricule) | Luxembourg | Format only. Masked once the first eight digits form a real birth date (YYYYMMDD); the number's own two check digits are not verified. |
ONYRI also reads postal codes next to a city name: Spain's 01000-52999, Italy's 5-digit CAP with an optional province like (MI), the Netherlands' 1234 AB, and Luxembourg's L-1234. National phone numbers are matched too, plus the +34, +39, +31, and +352 country codes.
A Dutch KvK number is 8 bare digits, too ambiguous on its own: ONYRI needs a label like KvK right next to it. A bare BSN is 9 digits; it's masked once it passes the elfproef check, or with a label like BSN nearby. Without either, check the preview and add it under Also mask.
Dates spelled out in words are read too: 3 de marzo de 2026, 1° marzo 2026, and 12 maart 2026. Spanish, Italian, and Dutch first and last names are matched against built-in dictionaries. Luxembourg documents are often written in French or German, so ONYRI reads dates and names in both. It also guesses a document's country from its text (language, IBAN, phone prefix, postal code), so the default profile adapts on its own. A profile set to a specific country keeps it.
What about bank details, cards, and technical secrets?
- IBAN, in ten of the eleven countries above (not the United States, which does not use IBAN). ONYRI matches the country code, length, and character pattern, but does not run the interbank checksum.
- Credit and debit card numbers, checked with the Luhn algorithm, the same math your card issuer runs.
- BIC and SWIFT codes, the bank identifier that often travels next to an IBAN.
- VAT numbers in several EU formats. The French and Italian keys are verified against their official formulas; the rest are matched by format only.
- Cloud and API keys, such as AWS, Google Cloud, Azure, Stripe, OpenAI, and Anthropic, plus Slack, GitHub, and GitLab tokens, JWTs, and SSH private keys. These sit on the Pro plan and above only, so a Free-plan export of a developer's log would leave them unmasked.
Free plans get 3 custom rules. Pro removes that limit, along with the cap on documents and pages. Either way, a rule you write once can be reused for every document in a profile, which is the practical way to cover a country ONYRI has not built a detector for yet.
Frequently asked questions
- Does ONYRI Sanitize detect ID numbers from countries other than these eleven?
- Not automatically. The built-in detectors cover France, the United States, the United Kingdom, Belgium, Germany, Austria, Switzerland, Spain, Italy, the Netherlands, and Luxembourg. For any other country, add the number as a custom rule, or type an example under Also mask, and every matching occurrence in the document is covered.
- What is the real difference between a format check and a checksum check?
- A format check only looks at length and character pattern, like nine digits in a row. A checksum check recomputes a control digit with the same formula the issuing body uses. A number that fails a checksum is very unlikely to be genuine. A number that only passes a format check might still be fake, or might be real but unverifiable.
- Are cloud and API keys masked on every plan?
- No. AWS, Google Cloud, Azure, Stripe, OpenAI, and Anthropic keys, plus Slack, GitHub, GitLab tokens, JWTs, and SSH private keys are Pro-only. On a Free plan, that kind of secret stays visible in the export, so check the Detected data list before sharing a technical document.
- Can I stop ONYRI from masking a value it got wrong?
- Yes. The Detected data list groups every match by family, with one checkbox per value. Untick anything you want to keep visible, right up until you download.
- Does a valid checksum mean the document belongs to a real, identifiable person?
- No. A checksum only proves the number is well-formed enough to be a genuine one of its kind. It says nothing about whether the person named nearby is real, or whether the number still belongs to them. Read the surrounding text before you decide what to keep visible.
Sources & references
- POMS RM 10201.030: Structure of the Social Security Number — US Social Security Administration
- Get your National Insurance number — GOV.UK
- Check a VAT number (VIES) — European Commission, Your Europe
- How EINs are assigned and valid EIN prefixes — US Internal Revenue Service (IRS)
- Composición del NIF de personas jurídicas y entidades — Agencia Tributaria (Spain)
- Codice fiscale: che cos'è e come si ottiene — Agenzia delle Entrate (Italy)
- Wat is het burgerservicenummer (bsn)? — Rijksoverheid (Netherlands)
- Structure du numéro d'identité (matricule) — Centre commun de la sécurité sociale (CCSS, Luxembourg)
Mask a document without uploading it
ONYRI Sanitize finds names, identifiers, bank details and secrets in a PDF, a Word file or a scan, and masks them in your browser. You check the preview, then download a flattened copy.