Hardware FixRecommendedDevice not working? Your driver may be the problemCheck updates for common hardware issues.Fix DriversOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan Now×
Skip to content
World desk4 min

Pix BR Code in Elixir: How One Cent Exposed a Bank-App Edge Case

An Elixir Pix BR Code library worked in a reported one-cent test, but parsing real Nubank and Itaú codes revealed an uppercase identifier that spec-based tests had missed.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

pix_brcode is an Elixir library for generating and parsing Pix BR Codes—not a complete integration with a bank or payment service provider. Its author, Igor Giamoniano, says a R$ 0.01 test payment through Nubank to his Itaú account confirmed that one generated code worked end to end. The more lasting lesson came before that payment: real bank-generated codes exposed a capitalization difference his specification-based tests had missed.

What the library does—and what it does not

A Pix BR Code is the payment payload that can be presented as a QR code or copied and pasted into a banking app. Giamoniano’s pix_brcode handles generation and parsing of that payload in Elixir. The author describes it as zero-dependency, with a handwritten CRC16 routine and amount handling based on integer cents or exact strings rather than binary floating-point values. He also says generation validates fields such as the merchant name. Those are the author’s descriptions; they should not be read as an independent code audit.

As an Amazon Associate I earn from qualifying purchases.

This scope is narrower than Banco Central’s API Pix. The official API specification defines services a receiving payment service provider can expose for charge management, Pix and refund monitoring, and queries. It is intended to support recipients automating interactions with their PSP; it is not the same thing as constructing a BR Code. See the Banco Central API Pix repository and its Pix information page.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why the first bank-app test failed

Giamoniano says his early attempts to scan generated codes failed because he had supplied a made-up Pix key. After switching to his own Itaú random key, he generated a code for R$ 0.01. According to his account, Nubank displayed his name and the amount, and the payment arrived in his Itaú account. He called it “the best-invested cent of my life.”

That is a useful end-to-end anecdote: it shows one generated payload, with a real key and a specific amount, was accepted in that test. It does not establish compatibility with every bank, every key type, or every Pix payment flow.

The interoperability bug: uppercase in real codes

The test that changed the project was parsing codes produced by bank apps. Giamoniano reports that codes from Nubank and Itaú used the Pix GUI identifier in uppercase, BR.GOV.BCB.PIX. His parser had compared the value exactly against the lowercase form, br.gov.bcb.pix, which he had used in tests written to follow the manual.

He says he changed parsing to compare the identifier case-insensitively while continuing to generate the lowercase form specified by the manual. The distinction is practical: strict, specification-shaped output can coexist with more tolerant parsing of input encountered in the field. He also says the two banks’ payloads differed in details such as postal-code and receiver-name fields, so their layouts should not be treated as one universal bank format.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The episode captures the gap between a written format and deployed systems. As Giamoniano puts it, “The spec is the minimum. Real systems have variations that only show up with real data.” A parser that rejects every deviation may fail on codes users actually receive; a generator that emits inconsistent values can create its own interoperability problems. The appropriate tolerance depends on the field and the format’s rules, not on blindly accepting any payload.

How to think about the payload and its checksum

The article describes Pix BR Code as a tag-length-value (TLV) structure: fields identify data, give its length, and carry its value. Pix account information is nested within that structure, and a CRC16 checksum is used to detect accidental changes to the payload.

CRC16 is an integrity check, not a security control. It can help detect corruption, but it does not authenticate the recipient, prove a code is genuine, or prevent fraud. A matching checksum is not a reason to trust a payment destination; users should still verify the payee and amount in their banking app before confirming.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

How an Elixir developer can use this story

If you are evaluating a BR Code library or building similar payment-format tooling, the project’s experience suggests a few concrete practices:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Use a valid test identity. A made-up Pix key can make an otherwise well-formed code fail at the bank-app stage, as the author’s first attempts did.
  • Test both directions. Generation tests can confirm your output matches expected fields, but parsing needs representative payloads created by real systems as well.
  • Separate output rules from input tolerance. Emit the documented form where appropriate, and decide explicitly which input fields can be compared or normalized without changing their meaning.
  • Keep money exact. The library’s reported use of cents or exact strings avoids binary floating-point representation issues when constructing an amount.
  • Do not confuse a payload library with PSP integration. Creating or parsing a BR Code does not itself provide the charge, monitoring, refund, or query services covered by API Pix.

Giamoniano says the project was inspired by JavaScript’s pix-utils and his view that Hex lacked a maintained equivalent. The article says he released pix_brcode as version 0.1.0, but that does not establish its current version or maintenance status.

BR Code tooling is not API Pix

The Banco Central repository describes API Pix as an OpenAPI 3.0 specification and lists release 2.10.0. That release number belongs to the official API specification, not to pix_brcode. The repository also says security is outside the API specification’s scope and points to separate security and initiation manuals. A service implementing API Pix therefore has additional concerns beyond the structure and checksum of a BR Code.

For a developer, the distinction is about system boundaries: BR Code code handles payment payloads, while API Pix describes services a PSP may offer. A library that creates a QR payload should not be described as a complete Pix payment integration.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.