DEV Community: SpellzCode

Vetting TikTok and Threads creators with exact numbers: engagement rate, likes per video and the traps in rounded counts

SpellzCode — Sat, 14 Nov 2026 15:30:10 +0000

Before paying a creator, most teams look at the follower count on the profile and maybe scroll a few posts. Both TikTok and Threads make that misleading in different ways. This post covers the numbers worth computing, how to compute them, and where they lie. Disclosure: SpellzCode, the brand behind this account, sells the two scrapers used in the code (links at the end); the formulas work with any data source.

Trap 1: rounded counts

TikTok shows "27.4M followers" on the profile. Fine for a glance, useless for tracking: a creator can gain 49,999 followers and the number does not move. If you track growth week over week, you need the exact count. TikTok's own page data carries it (27,483,982 in that example), so any tool you use should return that, not the rounded label.

Trap 2: lifetime likes

TikTok's "Likes" is a lifetime total across all videos. A creator with one viral video three years ago looks strong forever. Divide by the number of videos to get average likes per video, and compare it with followers:

const avgLikesPerVideo = likes / videos;
const likesPerFollower = likes / followers;

Some real numbers from public profiles (November 2026):

Account	Followers	Videos	Avg likes / video
@nasa	2,183,007	66	177,239
@nba	27,483,982	25,105	47,141

NASA has less than a tenth of the NBA's followers but gets nearly four times the likes per video, because it posts rarely and each post lands. For a sponsored video, the per-video number is what you are buying.

Trap 3: engagement on Threads

Threads shows followers and the latest posts, each with likes, replies, reposts and quotes. The usual engagement rate is:

// posts: the account's recent posts
const avg = (k) => posts.reduce((s, p) => s + (p[k] ?? 0), 0) / posts.length;
const engagementRatePercent = ((avg('likes') + avg('replies') + avg('reposts')) / followers) * 100;

Real examples, computed from each account's latest public posts:

Account	Followers	Avg likes	Engagement rate
@mosseri	1,058,672	942	0.136%
@zuck	5,777,936	2,157	0.047%
@nasa	12,797,207	1,822	0.016%
@nytimes	4,782,467	22	0.001%

The account with the fewest followers has by far the highest rate. Big brand accounts that post links all day sit near zero. Two cautions: a handful of recent posts is a small sample, and one viral post skews the average. Look at the median too if you have enough posts.

Trap 4: inactive accounts

A big follower count on an account that last posted months ago is worth little. Always check the date of the newest post.

Doing it for a list of handles

The two Apify actors below return these fields directly, one row per account. TikTok gives exact counts, avgLikesPerVideo, likesPerFollower, plus business-account and TikTok Shop seller flags. Threads gives recent posts with likes, replies, reposts and quotes, plus engagementRatePercent and lastPostedAt.

// npm i apify-client
import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });

const handles = ['nasa', 'nba', 'duolingo'];

const tt = await client.actor('spellzcode/tiktok-profile-data').call({ usernames: handles });
const th = await client.actor('spellzcode/threads-profile-data').call({ usernames: handles });

const tiktok = (await client.dataset(tt.defaultDatasetId).listItems()).items;
const threads = (await client.dataset(th.defaultDatasetId).listItems()).items;

for (const h of handles) {
  const a = tiktok.find((x) => x.username === h);
  const b = threads.find((x) => x.username === h);
  console.log(h, {
    tiktokFollowers: a?.followers,
    tiktokAvgLikes: a?.avgLikesPerVideo,
    threadsFollowers: b?.followers,
    threadsEngagement: b?.engagementRatePercent,
    threadsLastPost: b?.lastPostedAt,
  });
}

Both cost $2 per 1,000 profiles; missing accounts are free, and Apify's free $5 monthly credit covers about 2,500 profiles. They read public pages as a logged-out visitor, without logins or proxies, so they return account-level data and the recent posts the public profile shows, not full video or post histories.

Your PDF-to-text pipeline is silently returning empty pages: detecting scanned PDFs and when OCR is worth it

SpellzCode — Sat, 14 Nov 2026 14:38:17 +0000

If you feed PDFs into search, a RAG pipeline or an LLM, some of them come back with almost no text and nothing errors. Those are scanned PDFs: each page is a picture of text, with no text stored in the file. This post shows how to detect them, what OCR settings matter, and what to expect from the result. Disclosure: SpellzCode, the brand behind this account, sells a PDF-to-text tool (linked at the end); the code below uses free open-source libraries.

Detecting a scanned page

A normal PDF page stores its text. A scanned one stores an image. So: extract the text per page and look at how much came back.

// npm i unpdf
import { getDocumentProxy, extractText } from 'unpdf';

const buf = new Uint8Array(await (await fetch(url)).arrayBuffer());
const pdf = await getDocumentProxy(buf);
const { text: pages } = await extractText(pdf, { mergePages: false });

const empty = pages.map((t, i) => ({ page: i + 1, chars: t.replace(/\s/g, '').length }))
  .filter((p) => p.chars < 20);

const looksScanned = empty.length >= pages.length * 0.9;
console.log({ pages: pages.length, emptyPages: empty.map((p) => p.page), looksScanned });

Three cases come out of this:

No empty pages: a normal PDF. Do not OCR it; the stored text is exact and OCR would only add errors.
Every page empty: a scan. OCR it or reject it.
Some pages empty: the common, annoying one. A typed contract with a scanned signature page, or a report with a scanned appendix. OCR only the empty pages.

Mark rows instead of guessing: a downstream system should know a document's text came from OCR.

OCR settings that actually matter

Using Tesseract (free, via tesseract.js in Node):

Resolution. Render pages at 300 dpi (about 2,480 pixels wide for A4). In our tests at 150 dpi, digits in tables were misread regularly; at 300 dpi ordinary typefaces were read without error.
Language. Set the document's language. With the English model, Swedish å, ä, ö or German ß come out wrong.
Page segmentation. The default automatic mode (PSM 3) is right for normal pages. Tables come out one row per line, in reading order, not as a table.
Confidence. Tesseract reports a confidence from 0 to 100 per page. Store it, and send low-confidence pages to a human.

// npm i tesseract.js unpdf @napi-rs/canvas
import { createWorker } from 'tesseract.js';
import { renderPageAsImage } from 'unpdf';

const worker = await createWorker('eng');
for (const { page } of empty) {
  const png = await renderPageAsImage(buf, page, {
    canvasImport: () => import('@napi-rs/canvas'),
    width: 2480,
  });
  const { data } = await worker.recognize(Buffer.from(png));
  pages[page - 1] = data.text;
  console.log(`page ${page}: confidence ${data.confidence}`);
}
await worker.terminate();

What to expect

Clean printed text is read reliably.
Check numbers. In one of our test pages, a typeface whose digits vary in height (old-style figures) had a 9 read as 0. If amounts matter, as on invoices, validate them (totals should add up).
Handwriting, and phone photos of pages taken at an angle or in bad light, are not worth running through Tesseract.
OCR is slow: seconds per page on a normal CPU. That is why OCRing every page "to be safe" is a bad default.

Using the tool instead

PDF Text Extractor & OCR on Apify does the detection and selective OCR above for a list of PDF links. It returns the text, optional per-page text marked as text or ocr, looksScanned, ocrPageCount, ocrConfidence, and the document's metadata:

// npm i apify-client
import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });

const run = await client.actor('spellzcode/pdf-to-text-extractor').call({
  pdfUrls: ['https://arxiv.org/pdf/1706.03762'],
  includePages: true,
  ocrScanned: true,
  ocrLanguage: 'eng',
  maxOcrPages: 50,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items[0].pageCount, items[0].looksScanned, items[0].text.slice(0, 200));

It costs $5 per 1,000 PDFs, plus $8 per 1,000 pages that actually needed OCR. Broken links and password-protected files are free. Apify's free $5 monthly credit covers 1,000 ordinary PDFs or about 600 scanned pages.

Getting the contact email from 500 company websites: hidden addresses, junk matches and dead domains

SpellzCode — Sat, 14 Nov 2026 14:26:23 +0000

"Find the contact email on each of these websites" sounds like one regex. In practice a naive scraper gets a third of the emails wrong or misses them. This post walks through the four problems that cause most of the misses, with code for each. Disclosure: SpellzCode, the brand behind this account, sells a tool that does all of this (linked at the end), but the techniques below stand on their own.

1. The email is not on the home page

Most companies put their address on a Contact, About, Team or Imprint page. Look at the home page's links and open the few most likely ones, including other languages:

const CONTACT_WORDS = /contact|kontakt|about|om-oss|team|imprint|impressum|mentions-legales|contacto|contatti|yhteystiedot/i;

function likelyContactPages(html, baseUrl, max = 4) {
  const links = [...html.matchAll(/href="([^"#]+)"/g)].map((m) => new URL(m[1], baseUrl));
  const same = links.filter((u) => u.hostname === new URL(baseUrl).hostname);
  return [...new Set(same.filter((u) => CONTACT_WORDS.test(u.pathname)).map(String))].slice(0, max);
}

Four or five pages per site finds the address on nearly every site that publishes one.

2. The email is hidden by Cloudflare

Sites behind Cloudflare often have "email address protection" on. The HTML then contains <a data-cfemail="...">[email protected]</a> instead of the address. It is a simple XOR: the first byte is the key.

function decodeCfEmail(hex) {
  const key = parseInt(hex.slice(0, 2), 16);
  let out = '';
  for (let i = 2; i < hex.length; i += 2) {
    out += String.fromCharCode(parseInt(hex.slice(i, i + 2), 16) ^ key);
  }
  return out;
}

const hidden = [...html.matchAll(/data-cfemail="([0-9a-f]+)"/gi)].map((m) => decodeCfEmail(m[1]));

Also read name [at] company [dot] com spellings, which many small sites use.

3. Your regex matches junk

An email regex over raw HTML returns things like logo@2x.png, Sentry and error-tracking addresses, you@example.com placeholders in forms, and firstname.lastname@company.com from instructions. Filter them:

const JUNK = [
  /\.(png|jpe?g|gif|svg|webp)$/i,          // retina image names
  /@(sentry|wixpress|example)\./i,          // tracking and placeholders
  /^(you|your|name|firstname|email)[.@]/i,  // form hints
];
const clean = (emails) => [...new Set(emails.map((e) => e.toLowerCase()))].filter((e) => !JUNK.some((r) => r.test(e)));

Then rank what is left: an address at the site's own domain beats a Gmail address or the web agency's address in the footer, and info@ or contact@ beats a named person for a first message.

4. The domain cannot receive mail

Old addresses on old pages point at domains that no longer have a mail server. One DNS lookup catches them before they bounce:

import { resolveMx } from 'node:dns/promises';

async function domainAcceptsMail(email) {
  try {
    const mx = await resolveMx(email.split('@')[1]);
    return mx.length > 0;
  } catch {
    return false;
  }
}

This confirms the domain takes mail, not that the mailbox exists. Checking a mailbox means talking SMTP to the server, which many servers now refuse or answer falsely, so treat the MX check as the reliable part.

Phones and socials

Take phone numbers from tel: links and from the site's JSON-LD ("telephone") rather than regexing digits out of text, which picks up VAT numbers and dates. Social profiles are just links to linkedin.com/company, facebook.com, instagram.com and so on.

Using the tool instead

Contact Details Scraper on Apify does all of the above, returning one row per website with primaryEmail, every email with its type and source page, phones, social links and the contact page URL:

// npm i apify-client
import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });

const run = await client.actor('spellzcode/website-contact-extractor').call({
  websites: ['apify.com', 'letsencrypt.org'],
  maxPagesPerSite: 5,
  onlyDomainEmails: true,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
for (const s of items) console.log(s.domain, s.primaryEmail, s.phones?.[0] ?? '');

You pay $4 per 1,000 websites where contacts were found; sites with nothing, or that refuse the request, are free. Apify's free $5 monthly credit covers about 1,250 sites with contacts. It reads the HTML a site serves, so contacts that only appear after JavaScript runs can be missed.

Before you send anything

Addresses of named people are personal data under GDPR, and many countries restrict unsolicited e-mail even to businesses. Prefer role addresses, have a lawful basis, honour opt-outs, and respect each site's terms and robots.txt (the tool does by default).

Every new Swedish company from the last 30 days as a spreadsheet, from Bolagsverket's open data

SpellzCode — Sat, 14 Nov 2026 14:25:47 +0000

About 4,500 to 6,000 companies are registered in Sweden every month. If you sell accounting, banking, insurance, payments, web design or office space, those first weeks are when a new company picks its suppliers. Sites like Allabolag show the data one company at a time; this post shows how to get the whole list from the official source instead, what is in it, and what is not.

Disclosure: SpellzCode, the brand behind this account, makes a paid tool that does this (linked at the end). Everything before that section works without it.

The source: Bolagsverket and SCB open data

The Swedish Companies Registration Office (Bolagsverket) and Statistics Sweden (SCB) publish their company registers as open data under the EU high-value datasets rules ("värdefulla datamängder"). That means:

free to download and free to reuse commercially
a weekly bulk file, not a live API
every registered company: name, organisationsnummer, legal form, registration date, status, SNI industry codes, the business description from the articles of association, and postal address

What it does not contain: phone numbers, e-mail addresses, websites, board members, owners or financial figures. Sole traders (enskild firma) are left out of the company file too.

Freshness: the part people get wrong

A new registration reaches the weekly file roughly one to two weeks after it happened. So "registered in the last 7 days" will look nearly empty. Use 30 days or more and run it weekly, keeping the rows you have not seen before.

Industry codes (SNI) are assigned by SCB some weeks after registration. Of companies registered in the last six weeks, only about one in four has a code yet. For brand-new companies, filter on city, postcode or words in the name or business description instead of SNI.

Checking an organisationsnummer

If you merge this list with your CRM, validate the numbers first. A Swedish organisationsnummer is ten digits with a Luhn check digit, and the third digit is 2 or higher for companies (lower means a personal number).

function isSwedishOrgNr(input) {
  const d = input.replace(/\D/g, '').slice(-10);
  if (d.length !== 10 || Number(d[2]) < 2) return false;
  let sum = 0;
  for (let i = 0; i < 10; i++) {
    let n = Number(d[i]) * (i % 2 === 0 ? 2 : 1);
    sum += n > 9 ? n - 9 : n;
  }
  return sum % 10 === 0;
}

isSwedishOrgNr('556703-7485'); // true (Spotify AB)

The VAT number is then SE + the ten digits + 01.

Useful SNI prefixes

Prefix	Industry
`62`	IT services and consulting
`47`	Retail
`56.1`	Restaurants
`43`	Specialised construction (electricians, plumbers, painters)
`68`	Real estate
`69.2`	Accounting and bookkeeping
`86`	Health care

A company can have several codes; match if any of them starts with your prefix.

Doing it yourself vs. using a tool

Doing it yourself means downloading the weekly files from Bolagsverket and SCB, joining them on organisationsnummer, parsing the addresses and codes, and re-running each week. It is a few hours of work and then a small job to maintain.

If you would rather not, our Apify actor Sweden New Companies & Company Lists does the join and filtering and returns rows like this:

{
  "companyId": "556703-7485",
  "vatNumber": "SE556703748501",
  "name": "Spotify AB",
  "legalFormCode": "AB",
  "registered": "2006-05-10",
  "industryCodes": [{ "code": "60.100" }],
  "businessDescription": "Bolaget har till föremål för sin verksamhet att ...",
  "address": { "street": "Regeringsgatan 19", "postcode": "11153", "city": "STOCKHOLM" },
  "dataAsOf": "2026-11-09"
}

Calling it from Node:

// npm i apify-client
import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });

const run = await client.actor('spellzcode/sweden-new-companies-leads').call({
  registeredLastDays: 30,
  legalForms: ['AB'],
  cities: ['Göteborg'],
  maxResults: 1000,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items.length, 'new limited companies in Göteborg');

It costs $3 per 1,000 companies, and Apify's free $5 monthly credit covers about 1,600. Without code: open the actor page, set the filters, run, and export CSV or Excel. To get a weekly feed, schedule it in Apify and send new rows to a sheet or CRM.

Marketing rules still apply

Company data is not personal data in itself, but for one-person companies the line blurs: an e-mail to the owner of a tiny company can count as marketing to an individual. SCB also keeps an advertising block list (reklamspärr) that is not in the open data. Check the rules for your channel before you send anything.

Keep your CRM's job titles current from LinkedIn profile links, without logging in or using cookies

SpellzCode — Sat, 14 Nov 2026 14:17:26 +0000

People change jobs, and a CRM full of stale titles quietly ruins outreach and account reports. If you already have the LinkedIn profile links of your contacts (most CRMs store them), you can refresh titles and companies on a schedule from the public profile pages, without logging in to LinkedIn and without handing over your session cookie.

This post covers what a public profile actually shows, what goes wrong, and a working script. Disclosure: I make the tool used in the script (a pay-per-result Apify actor from SpellzCode). The approach and the caveats apply whatever tool you use.

Why not use your own LinkedIn session?

Many scrapers ask for your li_at cookie. That works until LinkedIn notices automated traffic on your account, and then it is your personal account that gets restricted. Reading only logged-out public pages keeps your account out of it entirely. The trade-off is less data and some refusals, covered below.

What a public profile shows

Logged out, a profile page usually shows:

name and headline (the job titles)
location and follower count
the "About" text
some experience and education entries, often only the current one or a few

It does not show emails or phone numbers, and many people limit their public profile, so fields can be empty. For "is this person still at Acme, and what is their title now?" it is enough most of the time.

What goes wrong

Refusals. LinkedIn refuses a share of logged-out requests. In our own test 4 of 11 pages were refused. Treat a refusal as "try again later", not as "profile gone".
Partly hidden text. LinkedIn sometimes blurs parts of the public page. A good parser marks those rows instead of returning garbage.
Vanity URL changes. People rename their profile URL. A 404 is a signal to look the contact up again.

So design the refresh as an incremental job: update rows that came back ok, queue refused rows for the next run, and flag not_found rows for a human.

The script

This reads a CSV with a linkedin column, fetches the public profiles, and writes a CSV of changes to review before importing into your CRM.

// npm i apify-client csv-parse csv-stringify
import fs from 'node:fs';
import { parse } from 'csv-parse/sync';
import { stringify } from 'csv-stringify/sync';
import { ApifyClient } from 'apify-client';

const contacts = parse(fs.readFileSync('contacts.csv'), { columns: true });
const links = contacts.map((c) => c.linkedin).filter(Boolean);

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('spellzcode/linkedin-profile-data').call({ profiles: links });
const { items } = await client.dataset(run.defaultDatasetId).listItems();

const byUrl = new Map(items.map((p) => [p.query, p]));
const changes = [];
const retry = [];

for (const c of contacts) {
  const p = byUrl.get(c.linkedin);
  if (!p) continue;
  if (p.status === 'refused') { retry.push(c.linkedin); continue; }
  if (p.status !== 'ok') { changes.push({ ...c, note: p.status }); continue; }

  const current = p.experience?.find((e) => e.to === null);
  const newTitle = p.jobTitles?.[0] ?? '';
  const newCompany = current?.name ?? '';
  if (newTitle !== c.title || (newCompany && newCompany !== c.company)) {
    changes.push({ ...c, newTitle, newCompany, note: p.partlyHidden ? 'partly hidden' : '' });
  }
}

fs.writeFileSync('changes.csv', stringify(changes, { header: true }));
fs.writeFileSync('retry.txt', retry.join('\n'));
console.log(`${changes.length} changes, ${retry.length} to retry next run`);

Run it weekly (cron, GitHub Actions, or Apify's own scheduler) and feed retry.txt back in next time.

No-code version

If you do not want to run code: open the actor's page on Apify, paste your profile links into the Profiles field, run it, and export the results as CSV or Excel. Apify also connects to Make, Zapier and n8n if you want the refresh to write straight into a sheet or CRM.

Cost

The actor charges per profile returned: $2 per 1,000 on Apify's free plan, less on paid plans. Refused and unavailable pages cost nothing, and refused pages get one automatic retry. Apify's free plan includes $5 of monthly credit, which covers roughly 2,500 profiles a month.

Update: the actor now also returns every position with its job title, dates and location, education with degrees, skills, languages and certifications, plus ready-made currentTitle and currentCompany columns.

The legal part

Job titles of named people are personal data. Under GDPR and similar laws you need a lawful basis (keeping data about existing business contacts accurate is a common one), you should keep only what you need, and you must honour objections and deletion requests. Do not use this for spam or for decisions like hiring without meeting the rules that apply. You are also responsible for respecting LinkedIn's terms.

Invoice attachments to spreadsheet rows in n8n, scans included (and why DOCX and XLSX need no library)

SpellzCode — Sat, 14 Nov 2026 09:41:02 +0000

Most "read the invoice" automations break on the same three things: the PDF is a scan with no text in it, the supplier sent a Word or Excel file instead, or the layout changed and the regex died. This post walks through a small n8n workflow that survives all three, then opens the hood on the two parts that are easier than they look: reading office files, and getting page images out of a scanned PDF.

Disclosure: I work on the tool used in the examples (it is made by SpellzCode). The techniques in the second half work without it, and I say where it stops working.

The workflow

Three nodes:

Gmail Trigger, with Download Attachments on and a search such as has:attachment (invoice OR faktura OR rechnung).
Agent Data Tools > Document > Extract Fields (community node n8n-nodes-agent-data-tools), with File Source set to File From an Earlier Node, Input Binary Field attachment_0, and the fields you want:

   supplier, invoice_number, invoice_date, due_date, customer, net_amount, vat_amount, total, currency, bankgiro, ocr_number, org_number

Google Sheets > Append Row, mapping {{ $json.data.supplier }} and the other fields to columns.

The middle node sends the file and the field names in one request and gets one JSON object back. For a Swedish invoice it looks like this:

{
  "type": "pdf",
  "ocr": true,
  "data": {
    "supplier": "Bergslagen Bygg & Trä AB",
    "invoice_number": "58231",
    "invoice_date": "2026-10-28",
    "due_date": "2026-11-27",
    "customer": "Östra Hamnens Café HB",
    "net_amount": 17330,
    "vat_amount": 4332.5,
    "total": 21662.5,
    "currency": "SEK",
    "bankgiro": "712-4589",
    "ocr_number": "5823100047",
    "org_number": "556712-3344"
  },
  "missing": [],
  "truncated": false
}

Two details matter more than they seem:

A field that is not in the document comes back as null and is listed under missing. Map missing to a column and you have a review queue for free. A tool that always returns something for every field will eventually pay the wrong invoice.
Amounts come back as numbers: 21 662,50 on the paper became 21662.5 in the answer.

Without n8n it is one HTTP request with the file as the body:

curl -H "Authorization: Bearer $API_KEY" \
     -H "Content-Type: application/octet-stream" \
     --data-binary @invoice.pdf \
     "https://tools.funwords.eu/document/extract?fields=supplier,invoice_number,due_date,total,currency"

What I tested, and what I did not

I ran that invoice (a made-up one, rendered as an image) through in four forms: a clean PNG, a clean JPEG, a scanned PDF (one JPEG per page, no text layer), and a deliberately bad "scan": rotated 2.6 degrees, 900 pixels wide, low contrast, speckled, JPEG quality 38, with a fold line across the totals. All four returned all twelve fields, the answer shown above. A second invoice, as a PDF with a text layer, returned the eleven fields it stated and null for the IBAN it did not have. Calls that needed OCR took 10 to 40 seconds; text-layer files are much quicker.

What that does not prove: those were renderings of two invoices I wrote myself, not a pile of real supplier scans. I have not tested handwriting, stamps over the totals, or multi-page scans beyond three pages (three is the limit per call). An AI model reads the file, so treat amounts as "check before paying", not as ground truth. That is what the missing column and a human glance are for.

Under the hood 1: DOCX, XLSX and PPTX are ZIP files of XML

You do not need a library to read modern office files, only an unzip and an XML parser. Rename report.docx to report.zip and look inside:

Word: word/document.xml. Paragraphs are <w:p>, text runs are <w:t>, a tab is <w:tab/>, a line break <w:br/>. The paragraph style is in <w:pStyle w:val="Heading1"/>, which is all you need to emit # headings. A list item has a <w:numPr> inside its paragraph properties. Tables are <w:tbl> / <w:tr> / <w:tc>, and a cell holds ordinary paragraphs.
Excel: xl/workbook.xml lists the sheets, xl/_rels/workbook.xml.rels maps each to a file, and xl/sharedStrings.xml holds every distinct string once. A cell <c r="B2" t="s"><v>17</v></c> means "string number 17". Without t="s" the value is the number itself. Two traps: empty cells are simply absent, so place each cell by its reference (B2), not by counting; and dates are stored as day numbers (45,000-something), which only the cell style tells you.
PowerPoint: ppt/slides/slide1.xml, slide2.xml, … with text in <a:t> inside <a:p>. Sort the slides by number, not by file name, or slide 10 lands before slide 2.

Things that will bite you in production:

Deleted text is still in the file when change tracking is on (<w:del> / <w:delText>). Skip it, or your "extracted text" contains what the author removed.
Zip bombs. A 40 KB archive can declare a part that inflates to gigabytes. Never trust the size in the header: stop reading a part when it passes your own limit.
Old .doc, .xls, .ppt are a different, binary format (they start with the bytes D0 CF 11 E0). Detect them and say so, instead of returning garbage.

In a serverless runtime the unzip needs no dependency either: read the central directory at the end of the file, then inflate each entry with the platform's DecompressionStream("deflate-raw").

Under the hood 2: a scanned PDF usually contains its pages as plain JPEGs

OCR normally starts with "render the PDF page to an image", which needs a PDF renderer, which is exactly what you do not have in an edge function. But a scanner does not draw a page. It takes a photo, compresses it as a JPEG, and stores those JPEG bytes in the PDF unchanged, marked with the filter name /DCTDecode:

4 0 obj
<< /Type /XObject /Subtype /Image /Width 1240 /Height 1754
   /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /DCTDecode /Length 105626 >>
stream
ÿØÿà..JFIF...            <- an ordinary JPEG starts here
endstream

So for the common case there is nothing to render: find /DCTDecode, jump to stream, check that the data starts with FF D8 FF, and cut at endstream. What you hold is the page image, ready for any OCR or vision model. Skip tiny images (logos and stamps). This does not work for scans stored with fax compression (CCITT, JBIG2); those really do need decoding, and it is fair to refuse them with a clear message.

One trap worth knowing: PDF.js takes ownership of the buffer you give it. If you first try the text layer and then go looking for images in the same buffer, the buffer is empty. Hand the parser a copy.

When you should not use this

You process thousands of invoices from the same few suppliers and need line items with guaranteed accuracy: a template-based extractor or your accounting system's own import will beat a general model.
The documents are confidential enough that they may not leave your network: run the open-source route (the ZIP and JPEG tricks above, plus a local OCR) instead of any hosted API.
You need more than three pages of a scan read in one call, or files above 10 MB.

Try it

n8n: install the community node n8n-nodes-agent-data-tools and add Document > Extract Fields or Convert to Text. A ready workflow file is in the repository.
HTTP: the tool pages with inputs, prices and a sample answer are document/extract and document/text. Extraction costs $0.03 a document and text conversion $0.005; a failed call is not charged.

If you build the unzip-and-parse route yourself and hit a file that breaks it, I would like to hear which one.

Company numbers in Sweden, Norway, Finland and France: formats, check digits, and the VAT number hiding inside

SpellzCode — Sat, 14 Nov 2026 09:28:48 +0000

Sweden, Norway, Finland and France each give a company one number, and each number ends in a check digit. If you take company numbers in a form (onboarding, invoicing, a CRM import), you can catch most typos before you ever call a register. This post has the format of each number, the check-digit rule, how the VAT number is built from it, and tested JavaScript for all of it.

Disclosure up front: we build a company check API at SpellzCode, and it shows up at the end. Everything before that works without it.

The four numbers at a glance

Country	Name	Format	Check digit	Example
Sweden	organisationsnummer	10 digits, written NNNNNN-NNNN	Luhn (mod 10) over all ten digits	556703-7485
Norway	organisasjonsnummer	9 digits, the first 8 or 9	mod 11, weights 3 2 7 6 5 4 3 2	923609016
Finland	Y-tunnus (business ID)	7 digits, a hyphen, a check digit	mod 11, weights 7 9 10 5 8 4 2	0112038-9
France	SIREN (company), SIRET (establishment)	9 digits; 14 digits	Luhn (mod 10)	552032534

The examples are the public register numbers of Spotify AB, Equinor ASA, Nokia Oyj and Danone.

The check digits in code

const digits = (s) => String(s).replace(/\D/g, "").split("").map(Number);

function luhn(ds) {
  const sum = [...ds].reverse().reduce(
    (acc, n, i) => acc + (i % 2 ? (n * 2 > 9 ? n * 2 - 9 : n * 2) : n), 0);
  return sum % 10 === 0;
}

function mod11(ds, weights) {
  const rest = 11 - (weights.reduce((acc, w, i) => acc + w * ds[i], 0) % 11);
  if (rest === 10) return false; // no valid check digit exists for this body
  return (rest === 11 ? 0 : rest) === ds[weights.length];
}

// Sweden: 10 digits, Luhn over all ten.
const isSwedishOrgNumber = (s) => { const d = digits(s); return d.length === 10 && luhn(d); };

// Norway: 9 digits, mod 11 with weights 3 2 7 6 5 4 3 2.
const isNorwegianOrgNumber = (s) => { const d = digits(s); return d.length === 9 && mod11(d, [3, 2, 7, 6, 5, 4, 3, 2]); };

// Finland: 7 digits + check digit, mod 11 with weights 7 9 10 5 8 4 2.
const isFinnishBusinessId = (s) => { const d = digits(s); return d.length === 8 && mod11(d, [7, 9, 10, 5, 8, 4, 2]); };

// France: SIREN (9 digits) and SIRET (14 digits), both Luhn.
const isSiren = (s) => { const d = digits(s); return d.length === 9 && luhn(d); };
const isSiret = (s) => { const d = digits(s); return d.length === 14 && luhn(d); };

Two details that are easy to get wrong:

Mod 11 can have no answer. When the remainder calls for a check digit of 10, that number body is simply never issued. Return false; do not map 10 to 0.
The Swedish Luhn runs over the 10-digit form. Swedish numbers are sometimes written with a century prefix (12 digits, 16 for companies). Strip it before checking.

From company number to VAT number

In three of the four countries the VAT number is the company number in a wrapper, so you can derive one from the other.

const swedishVat   = (org)   => `SE${digits(org).join("")}01`;      // 556703-7485 -> SE556703748501
const finnishVat   = (id)    => `FI${digits(id).join("")}`;         // 0112038-9   -> FI01120389
const norwegianVat = (org)   => `NO${digits(org).join("")}MVA`;     // 923609016   -> NO923609016MVA
const frenchVat    = (siren) => {
  const n = Number(digits(siren).join(""));
  const key = (12 + 3 * (n % 97)) % 97;                             // 552032534   -> FR27552032534
  return `FR${String(key).padStart(2, "0")}${n}`;
};

Caveats:

Deriving a VAT number does not mean the company is registered for VAT. A Swedish company without VAT registration still has an organisationsnummer. Check the derived number before you rely on it.
Norway is not in the EU, so a Norwegian number cannot be checked in VIES. The Norwegian register itself says whether the company is in the VAT register; the MVA suffix on an invoice means it is.
French keys for newer companies can contain letters. The formula above gives the numeric key that the large majority of companies have.

What a check digit cannot tell you

A number that passes is well formed. It may still belong to nobody, or to a company that was dissolved last year. For that you need the register:

Sweden: Bolagsverket (and SCB for activity data)
Norway: Brønnøysundregistrene
Finland: PRH, the Patent and Registration Office
France: INSEE's Sirene register and the national business register

All four publish their data openly, each in its own format and with its own quirks, which is the tedious part.

If you would rather not integrate four registers

This is where our own tool comes in. One GET request per country, the same shape of JSON back: names, legal form, status, bankruptcy or liquidation, registration date, industry codes and address. Register facts only: no credit scores and no personal data about owners.

curl -H "Authorization: Bearer $API_KEY" \
  "https://tools.funwords.eu/no/company?orgnr=923609016"

There is a page per country with the format, the check digit and a free lookup form: Company register lookup. VAT numbers for every EU country are covered in the VAT number check, and the API with plans is at Company check API.

If you only need the check digits, the code above is all you need. If a rule here is wrong for some class of numbers, say so in the comments and we will fix the post.

EU VAT number formats for every country (with regex), and what a VIES check really tells you

SpellzCode — Sat, 14 Nov 2026 07:48:38 +0000

If you sell to businesses in the EU, sooner or later you have to check a customer's VAT number: at checkout, before you zero-rate an invoice, or when you clean up a customer list. This post is the reference we wanted while building a VAT check: the format of every country's number, a regex for each, and what a live check against the EU's VIES service actually tells you.

Disclosure up front: we build a small VAT and company check API at SpellzCode, and it shows up near the end. Everything before that works without it.

Two different checks

A VAT number can be wrong in two ways.

It is malformed. A digit is missing, or the prefix is wrong. You can catch this offline with a pattern.
It is well formed but not registered. Only the member state's tax database knows. The EU exposes those databases through VIES (VAT Information Exchange System).

Do the first check in your form, so people get instant feedback. Do the second on your server before you rely on the number.

The format of every VIES country

Strip spaces, dots and hyphens and uppercase the input first. People type DE 123 456 789 and se556703-7485 01.

Country	Prefix	After the prefix	Regex
Austria	AT	the letter U and 8 digits	`^ATU\d{8}$`
Belgium	BE	10 digits, the first 0 or 1	`^BE[01]\d{9}$`
Bulgaria	BG	9 or 10 digits	`^BG\d{9,10}$`
Cyprus	CY	8 digits and a letter	`^CY\d{8}[A-Z]$`
Czech Republic	CZ	8, 9 or 10 digits	`^CZ\d{8,10}$`
Germany	DE	9 digits	`^DE\d{9}$`
Denmark	DK	8 digits	`^DK\d{8}$`
Estonia	EE	9 digits	`^EE\d{9}$`
Greece	EL	9 digits	`^EL\d{9}$`
Spain	ES	9 characters: a letter or digit, 7 digits, a letter or digit	`^ES[A-Z0-9]\d{7}[A-Z0-9]$`
Finland	FI	8 digits	`^FI\d{8}$`
France	FR	a 2-character key (digits, or letters other than O and I) and the 9-digit SIREN	`^FR[0-9A-HJ-NP-Z]{2}\d{9}$`
Croatia	HR	11 digits	`^HR\d{11}$`
Hungary	HU	8 digits	`^HU\d{8}$`
Ireland	IE	7 digits and 1 or 2 letters, or the older form: a digit, a letter or + or *, 5 digits and a letter	`^IE(\d{7}[A-Z]{1,2}\
Italy	IT	11 digits	{% raw %}`^IT\d{11}$`
Lithuania	LT	9 or 12 digits	`^LT(\d{9}\
Luxembourg	LU	8 digits	{% raw %}`^LU\d{8}$`
Latvia	LV	11 digits	`^LV\d{11}$`
Malta	MT	8 digits	`^MT\d{8}$`
Netherlands	NL	9 digits, the letter B and 2 digits	`^NL\d{9}B\d{2}$`
Poland	PL	10 digits	`^PL\d{10}$`
Portugal	PT	9 digits	`^PT\d{9}$`
Romania	RO	2 to 10 digits	`^RO\d{2,10}$`
Sweden	SE	12 digits: the 10-digit organisationsnummer followed by 01	`^SE\d{12}$`
Slovenia	SI	8 digits	`^SI\d{8}$`
Slovakia	SK	10 digits	`^SK\d{10}$`
Northern Ireland	XI	9 or 12 digits, or GD or HA and 3 digits	`^XI(\d{9}\

As a JavaScript object:
{% raw %}

const VAT_PATTERNS = {
  AT: /^ATU\d{8}$/,
  BE: /^BE[01]\d{9}$/,
  BG: /^BG\d{9,10}$/,
  CY: /^CY\d{8}[A-Z]$/,
  CZ: /^CZ\d{8,10}$/,
  DE: /^DE\d{9}$/,
  DK: /^DK\d{8}$/,
  EE: /^EE\d{9}$/,
  EL: /^EL\d{9}$/,
  ES: /^ES[A-Z0-9]\d{7}[A-Z0-9]$/,
  FI: /^FI\d{8}$/,
  FR: /^FR[0-9A-HJ-NP-Z]{2}\d{9}$/,
  HR: /^HR\d{11}$/,
  HU: /^HU\d{8}$/,
  IE: /^IE(\d{7}[A-Z]{1,2}|\d[A-Z+*]\d{5}[A-Z])$/,
  IT: /^IT\d{11}$/,
  LT: /^LT(\d{9}|\d{12})$/,
  LU: /^LU\d{8}$/,
  LV: /^LV\d{11}$/,
  MT: /^MT\d{8}$/,
  NL: /^NL\d{9}B\d{2}$/,
  PL: /^PL\d{10}$/,
  PT: /^PT\d{9}$/,
  RO: /^RO\d{2,10}$/,
  SE: /^SE\d{12}$/,
  SI: /^SI\d{8}$/,
  SK: /^SK\d{10}$/,
  XI: /^XI(\d{9}|\d{12}|(GD|HA)\d{3})$/,
};

function looksLikeVat(input) {
  const vat = input.toUpperCase().replace(/[\s.\-]/g, "").replace(/^GR/, "EL");
  const pattern = VAT_PATTERNS[vat.slice(0, 2)];
  return Boolean(pattern && pattern.test(vat));
}

Things that trip people up

Greece is EL, not GR. VIES uses EL. Accept GR from users and convert it.
Northern Ireland is XI. Since Brexit, GB numbers are not in VIES. Only Northern Ireland businesses trading in goods have an XI number.
Germany and Spain return no name or address. A VIES check for a DE or ES number tells you valid or not valid and nothing else. Do not build a flow that needs the company name for those two.
The German Steuernummer is not the VAT number. Invoices often carry both. Only the USt-IdNr. (DE plus 9 digits) can be checked.
Sweden, Finland and France embed the company number. A Swedish VAT number is the 10-digit organisationsnummer plus 01. A Finnish one is the business ID without its hyphen. A French one is a 2-character key plus the 9-digit SIREN, and the key is (12 + 3 * (SIREN % 97)) % 97.
A pattern match is not a registration. DE123456789 matches the German pattern and is not a real company.

The live check

VIES has a SOAP service and, more recently, a REST endpoint. Both work, and both have the same operational quirk: each member state runs its own backend, and they go down or refuse concurrent requests independently. You will see answers like MS_UNAVAILABLE and MS_MAX_CONCURRENT_REQ.

The rule that matters: an error is not "not valid". If Germany's backend is busy, you know nothing about the number. Retry with a short backoff, and if you still have no answer, tell the user you could not check it. Never reject a customer because VIES timed out.

Cache positive answers for a while. A number that was valid ten minutes ago is almost certainly still valid, and VIES is not fast.

If you would rather not run that yourself

This is the part where our own tool comes in. We wrapped the above (normalising input, retrying busy member states, caching clear answers, never turning an outage into "not valid") into one GET request:

curl -H "Authorization: Bearer $API_KEY" \
  "https://tools.funwords.eu/vat/validate?vat=SE556703748501"

{
  "vat": "SE556703748501",
  "country": "SE",
  "number": "556703748501",
  "valid": true,
  "name": "Spotify AB",
  "address": "REGERINGSGATAN 19, 111 53 STOCKHOLM",
  "source": "EU VIES (European Commission)"
}

A failed check answers with a 5xx and is not charged, so your code can treat it as "no answer". There is a free check form and a page per country (format, local name, the quirks above) here: EU VAT number check. The API itself, with Python, Node.js and PHP examples, is here: Company check API. It also looks companies up in the Swedish, Norwegian, Finnish and French registers.

If you only need the format check, the table above is all you need. Corrections are welcome in the comments: tax authorities change formats now and then, and we would rather fix the table than leave a wrong regex on the internet.

DEV Community: SpellzCode

Vetting TikTok and Threads creators with exact numbers: engagement rate, likes per video and the traps in rounded counts

Trap 1: rounded counts

Trap 2: lifetime likes

Trap 3: engagement on Threads

Trap 4: inactive accounts

Doing it for a list of handles

Links

Your PDF-to-text pipeline is silently returning empty pages: detecting scanned PDFs and when OCR is worth it

Detecting a scanned page

OCR settings that actually matter

What to expect

Using the tool instead

Links

Getting the contact email from 500 company websites: hidden addresses, junk matches and dead domains

1. The email is not on the home page

2. The email is hidden by Cloudflare

3. Your regex matches junk

4. The domain cannot receive mail

Phones and socials

Using the tool instead

Before you send anything

Links

Every new Swedish company from the last 30 days as a spreadsheet, from Bolagsverket's open data

The source: Bolagsverket and SCB open data

Freshness: the part people get wrong

Checking an organisationsnummer

Useful SNI prefixes

Doing it yourself vs. using a tool

Marketing rules still apply

Links

Keep your CRM's job titles current from LinkedIn profile links, without logging in or using cookies

Why not use your own LinkedIn session?

What a public profile shows

What goes wrong

The script

No-code version

Cost

The legal part

Links

Invoice attachments to spreadsheet rows in n8n, scans included (and why DOCX and XLSX need no library)

The workflow

What I tested, and what I did not

Under the hood 1: DOCX, XLSX and PPTX are ZIP files of XML

Under the hood 2: a scanned PDF usually contains its pages as plain JPEGs

When you should not use this

Try it

Company numbers in Sweden, Norway, Finland and France: formats, check digits, and the VAT number hiding inside

The four numbers at a glance

The check digits in code

From company number to VAT number

What a check digit cannot tell you

If you would rather not integrate four registers

EU VAT number formats for every country (with regex), and what a VIES check really tells you

Two different checks

The format of every VIES country

Things that trip people up

The live check

If you would rather not run that yourself