Before you start: test every pattern with examples that should match and examples that should fail.
Formatted CNPJ
Dots, slash, and hyphen are part of the required mask and must be treated literally.
Regex: ^\d{2}\.\d{3}\.\d{3}\/\d{4}-\d{2}$Digits only
After removing punctuation, a simple structural pattern checks for fourteen digits.
Regex: ^\d{14}$Syntax versus fiscal validity
The final two digits follow an algorithm that Regex is not meant to calculate. Use application logic for that step.
Normalize before storage
APIs often remove punctuation, validate the check digits, and store a consistent digits-only representation while formatting only for display.
Next step: test it for real
Use the Playground to experiment with the pattern, then practice in the game with feedback on false positives and false negatives.