The UFI printed on a CLP label looks like a random jumble — QNWM-9X6E-E46N-G4GJ. It isn't. Those 16 characters are a compact code that anyone can unpack back into who filed the notification and which formulation it was. Here's what a UFI actually encodes, and how to read one.

A UFI in one line

A UFI — Unique Formula Identifier — is the 16-character code you print on a hazardous product so a poison centre can match the item in front of a caller to the exact formulation you notified. Whether your product needs one at all is a separate question about whether it needs a CLP label. This post is about what the code itself contains.

The 16 characters aren't random

A UFI is printed in four blocks of four, like QNWM-9X6E-E46N-G4GJ. The very first character is a checksum; the remaining 15 carry the actual payload, scrambled into a fixed order and written in base 31.

Base 31 is the tell that legibility was designed in. The alphabet is the ten digits plus 21 letters — and five letters are deliberately left out: B, I, L, O and Z. Those are exactly the characters a person, or a scanner, is most likely to misread as 8, 1, 1, 0 and 2. A UFI has to survive being hand-copied off a small back label, so the characters that cause copying mistakes simply aren't in the set.

What's actually encoded

Unscramble the payload and three things fall out:

  • A company identifier — either an EU/UK VAT number or a numeric company key the notifier assigned itself.
  • A formulation number — a whole number, from 0 up to 268,435,455 (that is, 2²⁸ − 1), that the notifier uses to tell its own formulations apart.
  • A version field — currently always 0 in the ECHA specification.

None of this is looked up in a database. The decoding is pure arithmetic — the code is the data. That's why our UFI decoder works entirely offline, and also why it can only tell you the code is well-formed, not whether a notification was ever actually filed.

So what does a UFI reveal?

It depends on which kind of company identifier the notifier used.

If they encoded a VAT number, the UFI gives up the issuing country and the registered VAT identity. Decode QNWM-9X6E-E46N-G4GJ, for instance, and out comes a Greek VAT number, GR567438921, with formulation number 66,260,700. A VAT number is public and checkable, so a VAT-based UFI is in effect a signature: it says which business, in which country, stands behind the product.

If they encoded a company key instead, the UFI reveals far less — just an opaque number the company chose for itself, with no country attached. Plenty of notifiers use one precisely because it gives nothing away.

Reading someone else's UFI

Because the code is printed openly on the label and decodes with no lookup, nothing stops you decoding a UFI you find on someone else's product — it's public by design. Keep the limits honest, though:

  • A company-key UFI tells you nothing about who they are.
  • The formulation number is an internal identifier, not a running total. Notifiers number however they like, so you can't reliably read it as "how many products they've filed".
  • A valid UFI only means the code is well-formed. It doesn't confirm a poison-centre notification actually exists behind it — nor, on its own, what's in the product.

The checksum: why a mistyped UFI is catchable

That first character earns its place. It's computed from the other 15, so if a single character is wrong — a slip of the pen, an OCR misread — the whole code fails validation. NJC1-671A-UKF3-J0M8 is a valid UFI; change the last character to NJC1-671A-UKF3-J0M9 and it's rejected. (That one, as it happens, is a company-key UFI — decode it and you get a bare number, no country.) A checksum won't catch two errors that happen to cancel out, but it turns the most common single-character slips into an immediate, obvious failure rather than a silent mismatch at a poison centre.

Decode one yourself

Paste any UFI into our UFI decoder to see its issuing country, company identifier and formulation number — worked out locally from the code, with nothing sent anywhere. Building a label rather than reading one? The UFI generator runs the same maths in reverse, turning your VAT number and a formulation number into a valid UFI.