The structure
Every South African ID number is thirteen digits, in fixed blocks:
| Digits | Meaning |
|---|---|
| 1-6 | Date of birth, YYMMDD |
| 7-10 | Sequence within that birth date; 0000-4999 female, 5000-9999 male |
| 11 | Citizenship: 0 for a citizen, 1 for a permanent resident |
| 12 | Historically a race digit, abolished in 1994; now unused |
| 13 | A Luhn checksum over the first twelve |
The century problem
The date is stored as two digits for the year, so 85 could be 1885, 1985 or 2085. Nothing in the number resolves it. Most of the time it does not matter, but for 29 February it does: that date is real in 2000 (a leap year) and not in 1900 (not one).
Any tool that prints a confident full birth date from an ID number is guessing at the century. The honest output is the day and month, with the year left open.
What the check digit is for
The last digit is a Luhn checksum - the same algorithm that validates credit-card numbers. It catches every single mistyped digit and almost every swap of two adjacent digits, which are exactly the errors people make copying a number off a form.
It is a typo catcher, not a security feature. Anyone can compute a valid check digit, which is precisely why a tool that hands out complete, checksum-valid ID numbers is a very different - and much less welcome - thing than one that validates a number you were given.
What a valid number actually proves
This is the part most checkers gloss over. A number that passes every check is internally consistent: the date is real and the checksum matches. That means there is no typo in it.
It does not mean the number was ever issued, that it is still current, or that it belongs to the person who gave it to you. Only the Department of Home Affairs can answer those, and no offline tool can. Our validator says exactly this, rather than implying more than a format check can deliver.
Why the same number makes a poor secret
Because the first ten digits are derived directly from a birth date and a gender - both things that are often already public or easy to guess about a specific person - an ID number is far less random than it looks. Anyone who knows someone's date of birth and gender already knows most of the digits; the only unknowns are the small sequence number within that day and the citizenship digit, and the check digit is fully determined by the rest. This is a well-known criticism of using the number as a password, security-question answer, or account-linking secret: a string that functions like an identifier, not a secret, is a weak basis for authenticating someone.
It remains genuinely useful for what it was designed to do - uniquely and verifiably identifying a person to an institution that can check it against an official register - which is a different job from proving that the person presenting it is who they claim to be.
Where this comes from
- South African ID structure (YYMMDD, gender at the 5000 boundary, citizenship digit, unused race digit abolished 1994, Luhn check digit): the published national ID format, cross-checked across sources.
- The observation that a predictably-derived identifier (built from birth date and gender) is a weak authentication secret is a standard point in information-security and privacy discussions of ID-number-based verification generally, not specific to any one country's system.