How to validate a CURP from Mexico

Regular phrase

The following regular expression checks:

• The positions where letters, vowels, and consonants are expected in first and last names.
• Valid date (although to simplify it, months with less than 31 days are not being validated).
• Valid list of federal entities.
• And it generates references to separate the first 17 digits (group 1) from the last digit (group 2).

/^([A-Z][AEIOUX][A-Z]{2}\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])[HM](?:AS|B[CS]|C[CLMSH]|D[FG]|G[TR]|HG|JC|M[CNS]|N[ETL]|OC|PL|Q[TR]|S[PLR]|T[CSL]|VZ|YN|ZS)[B-DF-HJ-NP-TV-Z]{3}[A-Z\d])(\d)$/

Full validation

I publish the code in JavaScript to be able to run it here, but I'm sure it's very easy to port to any other language.

//Función para validar una CURP
function curpValida(curp) {
    var re = /^([A-Z][AEIOUX][A-Z]{2}\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])[HM](?:AS|B[CS]|C[CLMSH]|D[FG]|G[TR]|HG|JC|M[CNS]|N[ETL]|OC|PL|Q[TR]|S[PLR]|T[CSL]|VZ|YN|ZS)[B-DF-HJ-NP-TV-Z]{3}[A-Z\d])(\d)$/,
        validado = curp.match(re);
	
    if (!validado)  //Coincide con el formato general?
    	return false;
    
    //Validar que coincida el dígito verificador
    function digitoVerificador(curp17) {
        //Fuente https://consultas.curp.gob.mx/CurpSP/
        var diccionario  = "0123456789ABCDEFGHIJKLMNÑOPQRSTUVWXYZ",
            lngSuma      = 0.0,
            lngDigito    = 0.0;
        for(var i=0; i<17; i++)
            lngSuma = lngSuma + diccionario.indexOf(curp17.charAt(i)) * (18 - i);
        lngDigito = 10 - lngSuma % 10;
        if (lngDigito == 10) return 0;
        return lngDigito;
    }
  
    if (validado[2] != digitoVerificador(validado[1])) 
    	return false;
        
    return true; //Validado
}


//Handler para el evento cuando cambia el input
//Lleva la CURP a mayúsculas para validarlo
function validarInput(input) {
    var curp = input.value.toUpperCase(),
        resultado = document.getElementById("resultado"),
        valido = "No válido";
        
    if (curpValida(curp)) { // ⬅️ Acá se comprueba
    	valido = "Válido";
        resultado.classList.add("ok");
    } else {
    	resultado.classList.remove("ok");
    }
        
    resultado.innerText = "CURP: " + curp + "\nFormato: " + valido;
}

#resultado {
    background-color: red;
    color: white;
    font-weight: bold;
}
#resultado.ok {
    background-color: green;
}

<label>CURP:
    <input type="text" id="curp_input" oninput="validarInput(this)" style="width:100%;" placeholder="Ingrese su CURP">
</label>
<pre id="resultado"></pre>

Description

Taking into account the structure with which a CURP is formed:

• The first character is the initial of the first surname [A-Z]
  (if it is another letter, a X) is used.
• Followed by the first internal vowel of the surname [AEIOUX]
  (or one Xif it does not have one).
• And the initials of the second surname and first name[A-Z]{2}
• Birth date.
  • \d{2}year.
  • (?:0[1-9]|1[0-2])month.
  • (?:0[1-9]|[12]\d|3[01])day.
• The sex (Man or Woman)[HM]
• The state entity in which you were born (listed in the pdf )
  (?:AS|B[CS]|C[CLMSH]|D[FG]|G[TR]|HG|JC|M[CNS]|N[ETL]|OC|PL|Q[TR]|S[PLR]|T[CSL]|VZ|YN|ZS)
• The first internal consonants of surnames and names[B-DF-HJ-NP-TV-Z]{3}
• The homoclave (homonymy and century)[A-Z\d]
• The check digit (captured in group 2)(\d)

After seeing if it matches the regex, we check that the check digit is valid. That is, if it matches the calculated first 17 characters:

if (validado[2] != digitoVerificador(validado[1]))

To calculate the digit, first add the value of each of the 17 characters, which have a value from 0 to 36 according to this order (dictionary):

0123456789ABCDEFGHIJKLMNÑOPQRSTUVWXYZ

for(var i=0; i<17; i++)
    lngSuma = lngSuma + diccionario.indexOf(curp17.charAt(i)) * (18 - i);

And take the 10's complement of the last digit of this sum (or 0if it gives 10).

lngDigito = 10 - lngSuma % 10;
if (lngDigito == 10) return 0;
return lngDigito;

My answer is a bit late, but some time ago I made this method to validate RFCs, both for individuals and legal entities. I took the regex from the official SAT site to validate RFC. I hope someone finds it useful. The function is done inJS

function validateRFC(rfc) {

        var patternPM = "^(([A-ZÑ&]{3})([0-9]{2})([0][13578]|[1][02])(([0][1-9]|[12][\\d])|[3][01])([A-Z0-9]{3}))|" +
            "(([A-ZÑ&]{3})([0-9]{2})([0][13456789]|[1][012])(([0][1-9]|[12][\\d])|[3][0])([A-Z0-9]{3}))|" +
            "(([A-ZÑ&]{3})([02468][048]|[13579][26])[0][2]([0][1-9]|[12][\\d])([A-Z0-9]{3}))|" +
            "(([A-ZÑ&]{3})([0-9]{2})[0][2]([0][1-9]|[1][0-9]|[2][0-8])([A-Z0-9]{3}))$";
        var patternPF = "^(([A-ZÑ&]{4})([0-9]{2})([0][13578]|[1][02])(([0][1-9]|[12][\\d])|[3][01])([A-Z0-9]{3}))|" +
            "(([A-ZÑ&]{4})([0-9]{2})([0][13456789]|[1][012])(([0][1-9]|[12][\\d])|[3][0])([A-Z0-9]{3}))|" +
            "(([A-ZÑ&]{4})([02468][048]|[13579][26])[0][2]([0][1-9]|[12][\\d])([A-Z0-9]{3}))|" +
            "(([A-ZÑ&]{4})([0-9]{2})[0][2]([0][1-9]|[1][0-9]|[2][0-8])([A-Z0-9]{3}))$";

        if (rfc.match(patternPM) || rfc.match(patternPF)) {
            return true;
        } else {
            alert("La estructura de la clave de RFC es incorrecta.");
            return false;
        }
    }

Thank you very much. This helped me create a validator for PHP, I leave the code in case it helps someone.

    function is_curp( $string = '' ){
// By @JorhelR
// TRANSFORMARMOS EN STRING EN MAYÚSCULAS RESPETANDO LAS Ñ PARA EVITAR ERRORES
        $string = mb_strtoupper($string, "UTF-8");
// EL REGEX POR @MARIANO
        $pattern = "/^([A-Z][AEIOUX][A-Z]{2}\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])[HM](?:AS|B[CS]|C[CLMSH]|D[FG]|G[TR]|HG|JC|M[CNS]|N[ETL]|OC|PL|Q[TR]|S[PLR]|T[CSL]|VZ|YN|ZS)[B-DF-HJ-NP-TV-Z]{3}[A-Z\d])(\d)$/";
        $validate = preg_match($pattern, $string, $match);
        if( $validate === false ){
// SI EL STRING NO CUMPLE CON EL PATRÓN REQUERIDO RETORNA FALSE
            return false;
        }
// ASIGNAMOS VALOR DE 0 A 36 DIVIDIENDO EL STRING EN UN ARRAY
        $ind = preg_split( '//u', '0123456789ABCDEFGHIJKLMNÑOPQRSTUVWXYZ', null, PREG_SPLIT_NO_EMPTY );
// REVERTIMOS EL CURP Y LE COLOCAMOS UN DÍGITO EXTRA PARA QUE EL VALOR DEL PRIMER CARACTER SEA 0 Y EL DEL PRIMER DIGITO DE LA CURP (INVERSA) SEA 1
        $vals = str_split( strrev( $match[0]."?" ) );
// ELIMINAMOS EL CARACTER ADICIONAL Y EL PRIMER DIGITO DE LA CURP (INVERSA)
        unset( $vals[0] );
        unset( $vals[1] );
        $tempSum = 0;
        foreach( $vals as $v => $d ){
// SE BUSCA EL DÍGITO DE LA CURP EN EL INDICE DE LETRAS Y SU CLAVE(VALOR) SE MULTIPLICA POR LA CLAVE(VALOR) DEL DÍGITO. TODO ESTO SE SUMA EN $tempSum
            $tempSum = (array_search( $d, $ind ) * $v)+$tempSum;
        }
// ESTO ES DE @MARIANO NO SUPE QUE ERA
        $digit = 10 - $tempSum % 10;
// SI EL DIGITO CALCULADO ES 10 ENTONCES SE REASIGNA A 0
        $digit = $digit == 10 ? 0 : $digit;
// SI EL DIGITO COINCIDE CON EL ÚLTIMO DÍGITO DE LA CURP RETORNA TRUE, DE LO CONTRARIO FALSE
        return $match[2] == $digit;
    }

A REST API to validate CURP and get basic information about the person. The API is Free (unlimited requests), Fast (200 ms latency on average) and Standardized according to ISO. More information using Postman

Request example:

GET https://domain.com/api/curp/CAHF620818HMNLNL09?apiKey=bpT32rai

Successful response example:

{
    "curp": "CAHF620818HMNLNL09",
    "fatherName": "CALDERON",
    "motherName": "HINOJOSA",
    "name": "FELIPE DE JESUS",
    "gender": "1",
    "birthday": "1962-01-01T00:08:00.000Z",
    "birthState": "MX-MIC"
}

Documentation

Here I leave you a way to execute it in PHP so that you create a function that returns true or false completely roasted in the algorithm that @Mariano left

function validarCURP($cadena) {
    $curp = mb_strtoupper($cadena, "UTF-8");
    $pattern = "/^([A-Z][AEIOUX][A-Z]{2}\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])[HM](?:AS|B[CS]|C[CLMSH]|D[FG]|G[TR]|HG|JC|M[CNS]|N[ETL]|OC|PL|Q[TR]|S[PLR]|T[CSL]|VZ|YN|ZS)[B-DF-HJ-NP-TV-Z]{3}[A-Z\d])(\d)$/";
    $validacionRegex = preg_match($pattern, $curp);
    if ($validacionRegex === 0) {
        #No cumple con un formato válido
        return false;
    }
    #De aquí en adelante se verifica el dígito verificador
    $diccionario = "0123456789ABCDEFGHIJKLMNÑOPQRSTUVWXYZ";
    $lngSuma = 0.0;
    $lngDigito = 0.0;
    $curp17 = substr($curp, 0, 17);
    for ($i = 0; $i < 17; $i++) {
        //lngSuma = lngSuma + diccionario.indexOf(curp17.charAt(i)) * (18 - i);
        //lngDigito = 10 - lngSuma % 10;
        $lngSuma = $lngSuma + mb_strpos($diccionario, mb_substr($curp17, $i, 1)) * (18 - $i);
    }
    $lngDigito = 10 - ($lngSuma % 10);
    if ($lngDigito == 10) {
        $digitoVerificador = 0;
    }
    $digitoVerificador = $lngDigito;
    return $digitoVerificador == $curp[17];
}

It is very important that you use the mb_string functions since it gave me a headache since I did not remember that the Ñ takes two characters internally, the string functions that do not use mb_ at the beginning use positions per byte, not per character

You can validate a CURP and the person's information using this API https://rapidapi.com/acrogenesis/api/curp-renapo .

For example to use it in php it would be like this:

<?php

$client = new http\Client;
$request = new http\Client\Request;

$request->setRequestUrl('https://curp-renapo.p.rapidapi.com/v1/curp/CURP_DE_TU_USUARIO');
$request->setRequestMethod('GET');

$request->setHeaders(array(
    'x-rapidapi-host' => 'curp-renapo.p.rapidapi.com',
    'x-rapidapi-key' => 'api-key'
));

$client->enqueue($request)->send();
$response = $client->getResponse();

echo $response->getBody();

And it would return the information to you like this:

{
  "curp":"CURP_DE_TU_USUARIO"
  "renapo_valid":true
  "paternal_surname":"CALDERON"
  "mothers_maiden_name":"HINOJOSA"
  "names":"FELIPE DE JESUS"
  "sex":"HOMBRE"
  "birthdate":"18/08/1962"
  "nationality":"MEXICO"
  "entity_birth":"MN"
  "probation_document":"ACTA DE NACIMIENTO"
  "probation_document_data":{
    "Entidad":"16"
    "Municipio":"053"
    "Año":"1963"
    "Número de acta":"00145"
  }
  "rfc":"RFC_DE_TU_USUARIO"
  "sat_valid":true
}

You can use the curp library that is in NPM

npm install --save curp

If you don't use npm add it with bundle like this.

<script src="https://bundle.run/curp"></script>

Functional example:

var validarCurp = document.getElementById("validarCurp");

var validarBoton = document.getElementById("validarBoton");

validarBoton.addEventListener("click", function(evt) {
    evt.preventDefault();
    if(curp.validar(validarCurp.value)){
        alert('Es valido ')
    }else{
      alert('No es valido')
    }
});

<script src="https://bundle.run/curp"></script>
<h2 id="valida">Validar CURP</h2>

<p><strong>CURP:</strong>
<input id="validarCurp" type="text" /></p>

<p><input id="validarBoton" type="button" value="Validar" /></p>

One more alternative, without using javascript, validating only the format with the property pattern, has the detail that we cannot check the check digit.

<form>
 <label for="curp">CURP:</label>
 <input id="curp" 
  type="text"
  required="true" 
  placeholder="Ingrese su CURP" 
  pattern="([A-Z]{4}([0-9]{2})(0[1-9]|1[0-2])(0[1-9]|1[0-9]|2[0-9]|3[0-1])[HM](AS|BC|BS|CC|CL|CM|CS|CH|DF|DG|GT|GR|HG|JC|MC|MN|MS|NT|NL|OC|PL|QT|QR|SP|SL|SR|TC|TS|TL|VZ|YN|ZS|NE)[A-Z]{3}[0-9A-Z]\d)"
/>
  <button>Guardar</button>
</form >

In python you can use the CURPSuite library , which performs CURP format validation.

To install it:

python3 -m pip install curpsuite

Example:

from curp import CURP, CURPValueError
try:
  c = CURP("SABC560626MDFLRN01")
except CURPValueError as e:
  # El formato de la CURP es erróneo
  print(e)

After creating a CURP object, you can also get its properties if desired.

>>> c.fecha_nacimiento
datetime.date(1956, 6, 26)

Documentation.

Disclaimer: I am the developer of CURPSuite.

According to a document issued by the SAT , they mention on page 3 the following REGEX pattern, which does not validate the content , but only the format of the text string :

[A-Z][A,E,I,O,U,X][A-Z]{2}[0-9]{2}[0-1][0-9][0-3][0-9][M,H][AZ]{2}[B,C,D,F,G,H,J,K,L,M,N,Ñ,P,Q,R,S,T,V,W,X,Y,Z]{3}[0-9,AZ][0-9]

However, it is incorrect in the penultimate part [0-9,AZ], which should be like this[0-9,A-Z]

At the code level (Java), its validation could be something like this in a Utility class:

import java.util.regex.Matcher;
import java.util.regex.Pattern;

public class Utils {

    public final static String REGEX_CURP = 
        "[A-Z][A,E,I,O,U,X][A-Z]{2}[0-9]{2}[0-1][0-9][0-3][0-9][M,H][A-Z]{2}[B,C,D,F,G,H,J,K,L,M,N,Ñ,P,Q,R,S,T,V,W,X,Y,Z]{3}[0-9,A-Z][0-9]";

    public static boolean validarCurp(String textoCurp){
        boolean curpValido = false;

        Pattern pattern = Pattern.compile(REGEX_CURP;
        Matcher matcher = pattern.matcher(textoCurp);
        curpValido = matcher.find();

        matcher = null;
        pattern = null;

        return curpValido;
    }
}