Before you start: test every pattern with examples that should match and examples that should fail.
Formatted CPF
Use anchors and escape literal dots to require exactly three groups of three digits followed by two digits.
Regex: ^\d{3}\.\d{3}\.\d{3}-\d{2}$Digits only
If your application normalizes punctuation first, an eleven-digit structural check may be enough for the Regex layer.
Regex: ^\d{11}$Format is not official validity
A value can fit the pattern while failing the CPF check-digit algorithm. Perform semantic validation in code when CPF validity matters.
A practical application flow
Normalize input, confirm the expected number of digits, run the check-digit algorithm, and store a consistent representation. Regex handles the textual structure well.
Next step: test it for real
Use the Playground to experiment with the pattern, then practice in the game with feedback on false positives and false negatives.