There is a particular noise a Norwegian makes when you ask for their fødselsnummer over the phone. A small pause, a lowering of the voice, sometimes a move to a quieter room. We treat these eleven digits the way you would treat a password read aloud in an open-plan office.
Then the same person writes it on a form at the doctor, gives it to a landlord, puts it in an email to an accountant, and hands it to whoever is behind the counter at the pharmacy. Their employer has it. Their bank has it. Their gym might have it. It is printed on payslips that go in the recycling.
Both of those behaviours cannot be correct. Either the number is a secret and we are all catastrophically careless with it, or it is not a secret and the whispering is theatre.
It is not a secret. It was never designed to be one, it cannot be one, and I can show you why with arithmetic instead of opinion.
Everything below is implemented in the fødselsnummer explorer. It decodes a number, shows the check-digit maths in the open, and counts what a birthday actually leaves. It uses synthetic test numbers, the ones with 80 added to the month, so nothing it generates can belong to a real person.
What the eleven digits actually are#
The structure is public, documented by Skatteetaten, and about as mysterious as a postcode.
| Digits | What they are |
|---|---|
| 1–6 | Date of birth, DDMMYY |
| 7–9 | Individual number, which also encodes century and sex |
| 10–11 | Two check digits, computed from the first nine |
Straight away, six of the eleven are your birthday. Your birthday is not a secret. It is on your passport, in your medical record, in the birthday post your colleagues put on the intranet, and quite often on your public social media, where you may have helpfully accepted congratulations from forty people on the correct day.
That leaves five digits. Five digits looks like a hundred thousand possibilities, which is where the feeling of safety comes from. It is also wrong, in two separate ways.
The last two digits are not information#
Digits ten and eleven are check digits, computed with a modulus 11 scheme. Take the first nine digits, multiply each by a fixed weight, add them up, and subtract the remainder from eleven:
k1 weights: 3 7 6 1 8 9 4 5 2
k2 weights: 5 4 3 2 7 6 5 4 3 2
k = 11 - (sum mod 11)The second check digit is computed over the first ten, so it depends on the first. If either calculation lands on ten, the digit cannot be written, and the whole number is simply thrown away and never issued. That is why roughly one in six candidate numbers does not exist: the arithmetic vetoes it.
The important part is not the formula, it is what the formula implies. Those two digits contain no secrecy at all. They are a function of the other nine. Anyone holding the first nine digits can produce them with a pocket calculator. Their entire purpose is to catch a typo when a bored human transposes two digits, which they do well and which is a completely reasonable thing to want.
So the five “secret” digits are really three.
The three in the middle are not free either#
The individual number is not random. It is allocated from ranges that encode which century you were born in:
| Individual number | Birth years |
|---|---|
| 000–499 | 1900–1999 |
| 500–749 | 1854–1899 |
| 900–999 | 1940–1999 |
| 500–999 | 2000–2039 |
And the ninth digit encodes sex: odd for men, even for women.
So if I know your birthday, I know which range your individual number sits in. If I also know whether you are a man or a woman, which is not usually a state secret, I have halved it again.
Run the arithmetic and the number is not a hundred thousand.
The count#
For someone born on 17 May 1990, here is what is actually left:
| What I know | Numbers remaining |
|---|---|
| The last five digits are five digits | 100 000 |
| Their birthday | 496 |
| Their birthday and their sex | 247 |
Four hundred and ninety-six. Half a percent of the space people imagine. And it is not a search space in any meaningful sense, because you do not have to guess: you have a list, and lists can be checked.
The shape holds across birth years. Anyone born from 1940 to 1999 has about 600 permitted individual numbers, of which roughly 83% survive the check digits, giving somewhere just under 500 candidates. Older and newer cohorts sit closer to 410. There is no birthday that leaves you a hundred thousand, and there never was.
And then it gets much worse#
I thought that was the end of it. It is not, and the next part is the bit I had not seen written down anywhere.
Go and read Folkeregisterforskriften § 2-2-1, the regulation that actually defines how numbers are handed out. Every series is allocated in descending order:
serien 999–500 anvendes i synkende rekkefølge for personer født 2000–2039
Descending. From the top. Every series: 749 down to 500 for the nineteenth century, 499 down to 000 for the twentieth, 999 down to 500 for people born from 2000.
So the numbers for a given date are not scattered across the range. They are eaten from the ceiling downward, in the order births get registered. Which means the only thing standing between an attacker and a very short list is how many people were born in Norway that day.
That number is published. Statistics Norway’s table 05531 gives live births per month back to 1966. May 1990 had 5,275 births, about 170 a day. So 17 May 1990 consumed roughly the top 170 numbers of its series: 330 to 499.
| What I know | Numbers remaining |
|---|---|
| The last five digits are five digits | 100 000 |
| Their birthday | 496 |
| Their birthday and their sex | 247 |
| That they were born in Norway that day | 69 |
Sixty-nine. That is not a keyspace. That is a page of a notebook.
The lower end of each range is not wasted, it just fills up slowly afterwards: immigrants and late registrations with the same date of birth draw from the bottom of the same series for decades. So the band is a strong prior for “born here on that date” rather than a hard fence. It is quite strong enough.
The obvious next step is to narrow by time of birth: born just after midnight, take the first number. It does not work, and the reason is worth knowing. The order runs downward, so “first” would mean the highest. More importantly the number is assigned when the birth is registered, through the hospital’s birth-message system, not at the moment of delivery. Two babies born minutes apart in different hospitals are numbered in whatever order their paperwork is processed. There is probably a weak correlation between being born early in the day and being registered early, but it is far too weak to turn into a position, and inventing that precision would be exactly the kind of thing this site exists to complain about.
Nothing here helps you use a fødselsnummer, and I would not publish it if it did. Knowing someone’s number does not move money, log into anything, or authenticate you as them, because BankID and its friends exist and they are built on something you hold rather than something you know. That is exactly the point. The number is an index into a register. The security lives somewhere else, and it always should have.
The bit that actually annoys me#
If the number cannot be secret, then every organisation that treats it as proof of identity is running authentication on a public value.
You have met this. The call centre that reads back your fødselsnummer and considers you identified. The web form where the number plus a name is enough to change an address. The small business that uses it as a customer ID and emails it around in spreadsheets. None of those people think they are doing authentication. All of them are.
The failure mode is not dramatic hacking. It is the boring, grinding kind: someone opens an account, redirects post, or gets a credit check run in your name, because a system asked a question whose answer is derivable from a birthday and a published birth-rate table.
And here is the part that makes the whispering actively harmful. Treating the number as a secret tells people the wrong thing to defend. They get nervous about saying it out loud, and relaxed about a company that uses it as a password. The energy goes into hiding a value that cannot be hidden, instead of into asking why anyone accepted it as evidence.
The state agrees, it just took until 2032#
From 1 January 2032, Norway issues new fødselsnummer and d-nummer under different rules, because the current series is running out. The changes are worth reading as an admission.
- Sex is no longer encoded. You will not be able to read it out of digit nine. Systems that do this today will break, and there are a lot of them.
- Century is no longer encoded. The individual number stops telling you which hundred years you were born in.
- The first check digit gets looser. Instead of one valid value, the calculation will accept up to four, which is how they fit more people into eleven digits.
- Numbers will be allocated counting down from 999.
Existing numbers keep working exactly as they do now. Nobody gets reissued.
Look at what is being removed: the semantics. The state is stripping meaning out of the identifier because meaning in an identifier is a liability. That is the correct lesson, arrived at for capacity reasons rather than privacy ones, but arrived at.
It also means every system that quietly reads sex out of the number, or assumes there is exactly one valid check digit, has about six years to stop. Some of them will find out in January 2032.
What to actually do#
Not “hide your number”, because you cannot and it would not help.
- Stop accepting it as proof of anything. If you build systems: the fødselsnummer identifies a row. It does not authenticate a human. Use BankID, or a token, or anything that is not a public value.
- Push back when it is asked for pointlessly. Plenty of organisations collect it out of habit. A gym does not need it. Norwegian law is stricter here than most people assume, and asking why is free.
- Watch the outcomes rather than the number. Credit freezes, address-change alerts, and reading the post that comes for you. Those catch the misuse, which is the thing you actually care about.
- If you write code that touches these: validate both check digits, handle d-numbers (day plus 40), do not read sex from digit nine, and do not assume 2032 will not happen to you.
The number was designed in the sixties as a way to point at a person in a register. It is very good at that. It was never an authenticator, we started using it as one because it was there, and in 2032 we get to find out how many systems quietly depended on that mistake.
Say it out loud on the phone. It genuinely does not matter. Then go and ask your bank what else they wanted.
/Henrik
