PDPC NRIC authentication phase-out: 31 Dec 2026
Organisations must stop using NRIC numbers to authenticate people by 31 December 2026. PDPC steps up enforcement from 1 January 2027.
NRIC checksum confirms format, not identity. SingVMS uses Singpass to verify the actual person. PDPC 2026 ready.
No credit card required · PDPA compliant · Powered by Singpass
Check whether an NRIC or FIN checksum is mathematically valid.
Runs entirely in your browser — nothing you type is sent or stored.
The NRIC algorithm is public — anyone can generate fake numbers that pass this check. This is format validation, not identity verification. From 31 December 2026, PDPC rules bar using NRIC numbers to authenticate people.
The NRIC checksum algorithm is public. Anyone can generate a number that passes an NRIC check. Validators confirm that the letter-digit-letter pattern is mathematically correct, but they tell you nothing about whether a real person holds that number. A valid NRIC doesn't mean a verified visitor.
Businesses still collecting NRICs at reception desks, guard houses, and logbooks are doing their own version of NRIC verification. But writing a number in a book isn't verification. And from 31 December 2026, using the NRIC number to authenticate people isn't allowed either, with the PDPC stepping up enforcement from 1 January 2027.
Organisations must stop using NRIC numbers to authenticate people by 31 December 2026. PDPC steps up enforcement from 1 January 2027.
SingVMS replaces NRIC collection with Singpass authentication. Instead of asking visitors to write down their NRIC for you to validate, they scan a QR code and authenticate with Singpass. You get a government-verified identity, not a self-reported number.
| NRIC Checksum | SingVMS | |
|---|---|---|
| Validates format | ||
| Verifies identity | ||
| Prevents fake entries | ||
| PDPA compliant | ||
| No full NRIC stored | N/A | |
| Dec 2026 ready |
Stop validating numbers. Start verifying people.
Singpass confirms the visitor is who they claim to be. No more self-reported NRICs that anyone can fabricate. This isn't NRIC validation; it's person verification.
No full NRIC stored anywhere. No ID photocopying. Data retention is auto-enforced, and consent is handled through Singpass. You don't need to build compliance yourself.
Only the masked format (S****567A) is stored for display. A SHA-256 hash recognises repeat visitors. The full NRIC exists only in memory during authentication, never in any database.
Your dashboard shows S****567A. Your database stores S****567A. Your exports contain S****567A. There's no way to recover the full NRIC from your system, even in a breach.
A PDPC–CSA joint advisory requires organisations to stop using NRIC numbers to authenticate people by 31 December 2026. SingVMS is already built that way. No last-minute migration needed.
Scan QR, tap Singpass. It's the same flow 4 million Singaporeans used with SafeEntry during COVID. No app to download, no forms to fill. Three seconds and done.
SingVMS replaces NRIC logbooks with Singpass verification, wherever visitors check in.
Office lobbies and reception desks. Replace the clipboard and validate NRIC numbers with actual Singpass verification, automatically.
Security guards no longer photocopy NRICs or manually verify NRIC numbers against a list. Singpass does the identity check. Guards focus on security.
Stop exposing residents' and visitors' NRICs in shared logbooks. Each check-in is verified by Singpass, stored as masked NRIC only.
Professional visitor check-in without paper forms. Clients scan a QR code, authenticate, and walk in. Your front desk stays clutter-free.
MAS Technology Risk Management guidelines require strict access logging with verified identity. SingVMS creates an audit trail backed by Singpass.
What a checksum can and cannot tell you.
Yes. The NRIC checksum algorithm is published, so anyone can generate a number that passes any NRIC checker, including this one. A checker confirms the letter-digit-letter pattern is mathematically consistent. It cannot tell you whether the number was ever issued, or whether the person in front of you holds it. Only an identity check against the national digital identity — Singpass — verifies the person.
An NRIC or FIN is a prefix letter, seven digits, and a checksum letter. The seven digits are multiplied by the weights 2, 7, 6, 5, 4, 3, 2 and summed. A prefix-specific offset is added, the total is taken modulo 11, and the result indexes a lookup table of checksum letters. S (citizen or PR, pre-2000) and T (2000 onwards) share one table; F (FIN, pre-2000) and G (FIN, 2000 onwards) share another; M (FIN, 2022 onwards) has its own offset and table.
No. Checksum validation is format validation, and it does nothing for your PDPA obligations. Under the PDPC–CSA advisory, organisations must stop using NRIC numbers to authenticate people by 31 December 2026, with enforcement stepping up from 1 January 2027. Collecting and storing full NRIC numbers also creates retention and disposal obligations. SingVMS avoids both: visitors authenticate with Singpass, and only the masked NRIC (S****567A) is stored.
NRIC validation checks a number. Identity verification checks a person. A validator answers "is this string well-formed?" — an answer anyone can manufacture. Identity verification answers "is this the person who holds that identity?", which requires an authoritative source. SingVMS uses Singpass, so the visitor authenticates with the government-issued digital identity and you receive verified data instead of a self-reported number.
Replace NRIC collection with Singpass verification. Set up in under 5 minutes.
Start FreeQuestions? WhatsApp us