Turkish Identity Number Validator for C

A minimal numeric validator for the mathematical check-digit rules of the Turkish Republic identity number (T.C. Kimlik Numarası).

Scope

This project performs mathematical format/checksum validation only.

A VALID result means that an 11-digit number satisfies the arithmetic check-digit rules. It does not prove that:

• the number has been assigned to a citizen;
• the number currently exists in the population registry;
• a person presenting the number is its holder;
• any associated name, birth date, or other identity information is correct.

No registry, government service, network endpoint, or personal-data database is queried.

The project is published for lawful software validation, web-form pre-validation, educational, and interoperability purposes. Applications that collect or process real T.C. identity numbers must independently comply with applicable personal-data law and security requirements, including the Turkish Personal Data Protection Law (KVKK).

Why long instead of string

The core API deliberately accepts a numeric value:

bool valid = TurkishIdentityNumberValidator.IsValid(identityNumber);

Its public contract is:

public static bool IsValid(long number)

Many public implementations validate a string, split it into characters, use regular expressions, or accept numeric input and immediately convert it back to text. This implementation keeps the validation path numeric from beginning to end.

Digits are extracted with integer division and modulo operations. The core validator therefore:

• does not allocate a digit string;
• does not use Substring, regex, char[], or per-character parsing;
• keeps the validation API explicit and small.

This is an implementation choice, not a claim that identifiers should generally be modeled as numbers. String representations are often preferable for identifiers with meaningful leading zeros or formatting. T.C. identity numbers are a special case because the defined representation has 11 decimal digits and the first digit is non-zero.

The CLI necessarily receives operating-system arguments as strings, but parses the single argument once to long; the validator itself remains numeric.

Mathematical validation

The first nine digits are the payload. The last two digits are check digits.

For digits d1 ... d9, the validator calculates:

d10 = ((d1 + d3 + d5 + d7 + d9) * 7
       - (d2 + d4 + d6 + d8)) mod 10

d11 = (d1 + d2 + ... + d9 + d10) mod 10

The supplied final two digits must equal the calculated pair.

The implementation performs the complete calculation directly on long values without converting the number to text.

CLI

tcid-validate <11-digit-number>

Successful arithmetic validation prints:

VALID
Mathematical checksum/format validation only. A VALID result does not prove that the number is assigned to a citizen or identify a person.

A failed arithmetic check prints:

INVALID
Mathematical checksum/format validation only. A VALID result does not prove that the number is assigned to a citizen or identify a person.

Exit codes:

• 0: mathematically valid;
• 1: mathematically invalid;
• 2: command-line usage or parse error.

The CLI intentionally does not echo the supplied identity number in its result line, reducing accidental disclosure in terminal logs.

Web-form use

A typical server-side pre-validation flow can reject malformed values before business processing:

if (!TurkishIdentityNumberValidator.IsValid(request.IdentityNumber))
{
    return BadRequest();
}

This is only an input-validation layer. If the business process requires proof that a number belongs to a real person, mathematical validation must be followed by an authorized identity-verification process appropriate to that application.

Do not use checksum validation as authentication.

Source reduction

The historical experimental source contained several unrelated operations around candidate enumeration, extraction from text, random mathematically valid values, and relationship experiments.

This publication intentionally retains only the validation function and checksum mathematics. There is no:

• identity-number generation API;
• relative/ancestor/descendant enumeration;
• text scraping/extraction;
• registry lookup;
• identity inference.

That narrower scope is deliberate.

Official context

The Turkish General Directorate of Population and Citizenship Affairs (NVI) explains that a T.C. identity number has 11 digits and that its last two digits are verification digits calculated from the first nine. NVI also provides separate identity-verification services that use additional civil-registry information.

The Turkish Personal Data Protection Authority (KVKK) treats T.C. identity numbers as personal data and recommends minimizing their processing and applying appropriate technical and administrative safeguards.

Official references:

• NVI — T.C. Kimlik No İşlemleri: https://www.nvi.gov.tr/tokat/tc-kimlik-no-islemleri
• NVI — T.C. Kimlik No Doğrulama: https://tckimlik.nvi.gov.tr/Modul/TcKimlikNoDogrula
• KVKK — Türkiye Cumhuriyeti Kimlik Numaralarının İşlenmesi Hakkında Rehber: https://www.kvkk.gov.tr/Icerik/7798/Turkiye-Cumhuriyeti-Kimlik-Numaralarinin-Islenmesi-Hakkinda-Rehber

Comparison with public implementations

Public examples commonly use string-oriented validation. JavaScript/TypeScript examples often normalize the value to String, split/index characters, or expose a string parameter. Some C# examples accept a long but convert it to text before checking length and digits.

This repository intentionally avoids that representation in the core validator and performs the complete check arithmetically on a long.

This is a small implementation distinction, not a claim of originality over the T.C. identity-number checksum algorithm itself.

License

Apache License 2.0.

Author

Muhammet Ali Köker
https://alikoker.com.tr/