Credit Card Validator

Typo or trouble? What a credit card validator really tells you

A credit card validator answers one narrow question: is this card number correctly formed? It does that offline, in a fraction of a second, by running three checks that every major card network builds into its numbers:

• The Luhn (mod 10) checksum. The last digit of a card number is a check digit calculated from all the others. If a single digit is mistyped, the check fails.
• The network prefix. The first digits, known as the IIN or BIN, reveal whether the card belongs to Visa, Mastercard, American Express, Discover, JCB, UnionPay, Diners Club, Maestro, Mir or RuPay.
• The length rule. Each network issues numbers of fixed lengths, for example 15 digits for American Express and 13, 16 or 19 for Visa.

That makes this credit card number validator ideal for catching typos before a payment form is submitted, testing a checkout integration, or checking whether a number in a spreadsheet is plausible. What it cannot do, and what no honest validator can do, is tell you whether a card is real, active or funded. More on that below.

Check a card number in three moves

1. Type or paste the number into the box above. Spaces and dashes are fine, and the digits are grouped automatically the way they are printed on the card: 4-4-4-4 for most cards and 4-6-5 for American Express.
2. Press Validate or hit Enter.
3. Read the verdict. You will see whether the number passes the Luhn check and the length rule, which network it belongs to, its BIN and how many digits its security code should have.

Not sure what to try? Use one of the official test numbers under the box, such as Stripe's Visa test card 4242 4242 4242 4242. Never type a real card's number into a website you do not trust, and never type a real CVV anywhere other than the checkout you are paying at.

Decoding your result, line by line

The 1954 formula hiding in every card number

The check behind every card number validator was invented by IBM engineer Hans Peter Luhn, who filed his "Computer for Verifying Numbers" patent on 6 January 1954. It was granted on 23 August 1960 as US Patent 2,950,048, and the method is now specified in the card numbering standard ISO/IEC 7812-1.

Run it by hand in four steps

1. Starting with the second digit from the right, double every other digit.
2. If doubling gives a two-digit number, add its digits together (or subtract 9). So 7 doubled is 14, which becomes 5.
3. Add up all the digits, doubled and untouched.
4. If the total ends in 0, the number passes.

For the test number 4242 4242 4242 4242, the eight doubled 4s become 8s and add up to 64, the eight untouched 2s add up to 16, and the total of 80 ends in 0. Valid. Change any one digit and the total no longer ends in 0, which is exactly why a single typo is always caught.

What Luhn catches, and what slips through

The last row matters most. For any string of digits, exactly one of the ten possible final digits makes the Luhn check pass, so one random number in ten looks "valid". Luhn was designed to catch accidental errors, not deliberate fakes.

Prefixes and lengths: every network's fingerprint

A card number starts with a Major Industry Identifier (its first digit) and an Issuer Identification Number of 6 or 8 digits, a format the 2017 revision of ISO/IEC 7812 extended from the old 6-digit IIN. Card numbers can be up to 19 digits long. These are the ranges this validator recognises:

Two details trip up older validators. Mastercard numbers starting with 2 (the 2-series) are fully valid, and some UnionPay cards do not use a Luhn check digit at all, as noted in Baymard Institute's card pattern reference. This tool handles both.

Validating cards in Egypt

Alongside Visa and Mastercard, Egyptian banks issue cards on Meeza, the national payment scheme launched in 2019, owned by Egyptian Banks Company and regulated by the Central Bank of Egypt. Meeza's number ranges are not published in an official public list, so this validator may show its network as "Not recognised". The Luhn and length checks still run, and Egyptian Visa and Mastercard cards are detected like any others.

Validating cards in the United States

US cards follow the same international rules, with no extra local format. Validation matters there for another reason: according to the Nilson Report, the US generated 25.29% of the world's card volume in 2023 but 42.32% of its $33.83 billion in card fraud losses.

Why we will never ask for your CVV

Plenty of people search for a "credit card validator with CVV" or a "validator with expiry date and CVV". Here is the honest answer: the security code is not mathematically linked to the card number, so no formula can check it. The CVV2, CVC2 or CID is verified only by the card issuer, during a real authorization.

The payment industry treats the code as so sensitive that the PCI Data Security Standard requires that "the card verification code is not retained upon completion of the authorization process" (PCI DSS v4.0, Requirement 3.3.1.2), even with the customer's consent, as the PCI Security Standards Council confirms in its FAQ. A website that asks you to "validate" your CVV is asking for exactly the data merchants are forbidden to keep. Our validator only tells you how many digits the code should have: 4 on the front for American Express, 3 on the back for the others.

Expiry dates: a format check, not a verdict

An expiry date can be checked for format (a month from 01 to 12 and a date in the future), but whether it matches the card is again something only the issuer knows. Cards are generally valid until the last day of the month printed on them; U.S. Bank, for example, states that its cards are valid through the last day of the listed month.

"Live" card checkers and generators: the part most sites leave out

Searches like "live credit card validator", "real credit card number validator" or "credit card generator and validator" usually come from one of two places: curiosity, or fraud. A Luhn check can never tell you whether a card is live. The only way to find out is to attempt a real payment, and running card numbers through small test payments to find working ones is a recognised fraud technique called card testing or an enumeration attack.

• Visa says enumeration attacks cause about $1.1 billion in fraud losses a year, and that 33% of enumerated accounts suffered fraud within five days (Visa, May 2024).
• Visa recorded a 40% increase in enumeration attacks in the first half of 2023 (Visa Biannual Threats Report).
• In Europe, remote payments made up about 83% of card fraud in 2024, and card fraud losses rose 29% to €1.329 billion (EBA and ECB, December 2025).

Stripe lists "card checking" as another name for the same attack and blocks it with rate limits, CAPTCHAs and velocity rules (Stripe documentation). Numbers from a "generator" pass the Luhn check because the check digit is calculated, but they are not real accounts, and using them to buy anything is fraud. That is why this page has a validator and no generator. If you need a card that actually works online, get a legitimate virtual Visa or Mastercard issued for you.

Real test numbers, straight from the payment processors

Developers and QA testers do not need generated numbers. Every major payment processor publishes official test cards that pass validation and work in its sandbox:

These numbers only work in each provider's test environment, and Stripe's own guidance is simple: don't use real card details when testing.

For developers: card validation that doesn't cost you customers

Checkout friction is expensive. Baymard Institute puts the average online cart abandonment rate at 70.22%; among shoppers who abandoned during checkout, 19% did not trust the site with their card details and 17% found checkout too long or complicated (Baymard, 2025). Card-field design is a direct lever on both:

• Format as the user types. Use 4-4-4-4 spacing, and 4-6-5 for Amex. Baymard found that 15% of sites still don't auto-space the card field (Baymard research), and mistyped numbers are a common cause of failed payments.
• Validate with Luhn and length before submitting, but never treat a pass as proof that the card works. Let the payment gateway's authorization decide.
• Keep entered data on errors. Clearing the card field after a mistake forces the customer to start again.
• Never log or store the CVV, in line with PCI DSS, and prefer your processor's hosted fields or tokenization so card data never touches your servers.
• Rate-limit card attempts and add 3-D Secure, CAPTCHAs and velocity checks to stop card testing, as Visa and Stripe recommend.

Validator or BIN checker: which one do you need?

Your number never leaves this page

This validator runs entirely in your browser in JavaScript. The number you type is not sent to our server or anyone else's, and it is not saved. You can confirm it yourself: open your browser's developer tools, switch to the Network tab and press Validate, and you will see no request. The only time anything leaves the page is if you choose to click the BIN checker link, and then only the first 8 digits are used. There is also no app or APK to install, which is safer: be cautious of downloadable "card validator" apps that ask for full card details.

If your real card keeps getting declined online even though the number validates, the problem is usually the issuer, the card's country or its type rather than the number itself. Our guides on virtual cards for online purchases and the best virtual card providers explain the alternatives.

Sources

• US Patent 2,950,048: Computer for Verifying Numbers (H. P. Luhn, IBM)
• Luhn algorithm and payment card number structure
• Card security code (CVV, CVC, CID)
• PCI DSS v4.0 SAQ D, Requirement 3.3.1.2 and PCI SSC FAQ on storing CVC
• Visa: enumeration attacks, May 2024 and Visa Biannual Threats Report, 2023
• Stripe: card testing and Stripe test cards
• PayPal sandbox test cards and Adyen test cards
• The Nilson Report: card fraud losses 2023
• EBA and ECB report on payment fraud, December 2025
• Baymard: cart abandonment rate, card field auto-formatting and card IIN and spacing patterns
• Meeza (Egypt) and U.S. Bank: card expiration dates