Real-time ISO 7064 Mod 11,2 checksum analysis
The modern Malaysian Identity Card (MyKad) consists of 12 digits formatted as YYMMDD-PB-###G.
Here, YYMMDD represents the date of birth, PB indicates the place of birth (state or country code), and ###G is a unique identifier where the final digit (G) determines gender (odd for males, even for females).
Unlike some national IDs, the Malaysian government hasn't officially published a checksum algorithm for the MyKad. However, extensive testing suggests it utilizes the ISO 7064 Mod 11,2 algorithm—the exact same standard used in Chinese Resident Identity Cards—to calculate that final digit.
You might wonder how one digit can simultaneously indicate gender and act as a valid mathematical checksum. The prevailing theory is sequential iteration.
When generating an ID, the system likely iterates through sequence numbers and calculates the checksum. If the resulting final digit doesn't match the applicant's gender, it simply skips to the next sequence until a match is found. Interestingly, in a Mod 11 system where a '10' is possible (often represented by an 'X' in other countries), the MyKad system seems to just discard and skip sequences that result in a 10.
The exact reasons remain undisclosed. While other nations openly acknowledge their checksum systems, Malaysia's JPN keeps theirs under wraps. Because of this, treat this validation method as highly probable but not officially confirmed by the government.
This logic has been heavily tested against standard MyKad (Citizen) numbers. While rarer, it is assumed that MyPR (Permanent Resident) and MyKAS (Temporary Resident) cards follow the exact same algorithmic rules.
Algorithms themselves aren't subject to copyright, making structural validation perfectly legal. However, generating or using fabricated IC numbers for fraud, impersonation, or malicious activities is strictly illegal. Use this tool responsibly and solely for structural validation testing.
This tool was built to demonstrate how the ISO 7064 Mod 11,2 checksum applies to Malaysian ICs. It's designed to help developers implement better form validation and prevent typos in software, rather than verifying if an ID actually belongs to a real person. Acknowledging this algorithm officially would greatly benefit the local software engineering community.