💳 Credit Card Validator (Luhn Check and Brand Detector)
By Shihab Mia · Updated 2026-07-04
This tool performs a mathematical format check (the Luhn checksum) and prefix-based brand detection only. It does not verify that a card exists, is active, is in date, or has available funds, and it is not a fraud or security check. Do not enter cards you do not own. For any real transaction, authorisation must be confirmed by the card network and issuing bank.
This tool checks the number's maths only. A “valid” result means the digits pass the Luhn checksum, not that the card is real, active, or has funds. Use test numbers here, never a number you do not own. Nothing is stored or sent anywhere.
- Detected brand
- Digits entered
- Luhn checksum
- Checksum total
Enter a card number above and press Check number.
A credit card validator checks whether a card number is well-formed and tells you which brand it belongs to. Paste the number (spaces and dashes are fine) and this tool runs the Luhn checksum to say pass or fail, then reads the leading digits to detect the brand: Visa, Mastercard, American Express, or Discover. It is a format check for developers and testers, not an account lookup: it only proves the maths add up, not that the card is real, active, or has any money on it. Everything runs in your browser, so nothing you type is stored or sent anywhere.
What is the Credit Card Validator?
Almost every credit and debit card number carries a built-in error-detecting digit. The final digit (the check digit) is chosen so that the whole number satisfies the Luhn algorithm, a mod-10 checksum published by IBM's Hans Peter Luhn in 1960. When you mistype or transpose a digit, the checksum almost always fails, which lets a payment form catch the slip before it ever reaches the bank. That is exactly what this credit card validator replicates: it is a format check, not a live account query.
The algorithm works from the rightmost digit leftwards. Every second digit is doubled, and if doubling produces a value above 9 you subtract 9 (which is the same as adding the two resulting digits together). You then add up every digit. If that total is a multiple of 10, the number passes the Luhn check. Because the test is purely arithmetic, this credit card validator can run entirely on the client with no network call, which is why the page never transmits anything you enter.
Brand detection is a separate step from the checksum and relies on the Issuer Identification Number (IIN), historically called the Bank Identification Number (BIN): the first six to eight digits. Visa cards start with 4. Mastercard uses 51 to 55 plus the newer 2221 to 2720 range. American Express begins with 34 or 37 and is 15 digits long. Discover starts with 6011, 65, 644 to 649, or 622126 to 622925. A number can pass the Luhn check yet still show an unknown brand, because Luhn validity and brand prefixes are two independent properties.
It is worth being precise about what a passing result does and does not mean. Passing tells you the digits are internally consistent and the length looks plausible for a card. It does not tell you the account exists, is open, has a valid expiry, or has funds available. Only the card network and the issuing bank can confirm those things, and they do so through an authorisation request, not a checksum. That is why fraud checks in a real payment flow always go far beyond Luhn: they add address verification (AVS), the CVV, 3-D Secure, and issuer authorisation.
The Luhn check is deliberately simple, and that simplicity has limits. It reliably catches every single-digit error and almost every transposition of two adjacent digits, which covers the mistakes humans make most often when typing a long number. It cannot catch a transposition of the digit pair 09 to 90 (a known blind spot), and it cannot detect two independent errors that happen to cancel out. For form validation this is more than enough: use this credit card validator to reject obvious typos instantly on the client, then let the payment gateway do the authoritative check server-side.
Because the whole process is client-side arithmetic, this credit card validator is also a safe teaching aid. You can paste the published test numbers from any payment sandbox, watch them pass, change a single digit, and watch them fail, all without touching a real account or sending data across the network. That makes it useful for learning how card numbering, the IIN, and the check digit fit together, as well as for day-to-day input validation.
When to use it
- Testing a checkout or payment form with known-good and known-bad numbers before going live.
- Validating card-number input on the client so users catch typos instantly, before submitting.
- Checking published sandbox test card numbers (Visa, Mastercard, Amex, Discover) during development.
- Debugging why a specific number fails, using the checksum total and digit count the tool reports.
- Teaching or learning how the Luhn algorithm, the IIN/BIN, and the check digit actually work.
- Screening pasted or imported data for malformed card numbers before further processing.
How to use the Credit Card Validator
- Paste or type the card number into the field. Spaces and dashes are allowed and ignored.
- Press Check number, or just keep typing, because it validates as you go.
- Read the verdict: whether it passes the Luhn checksum and which brand the prefix matches.
- Use the reported checksum total and digit count to debug a number that fails.
- Only enter test numbers or a card you own, never someone else"s details.
Formula & method
Worked examples
Validate the Visa test number 4539 1488 0343 6467.
- Strip spaces: 4539148803436467 (16 digits).
- From the right, double every second digit and subtract 9 if over 9:
- 4 to 8, 5 to 5, 3 to 6, 9 to 9, 1 to 2, 4 to 4, 8 to 7, 8 to 8, 0 to 0, 3 to 3, 4 to 8, 3 to 3, 6 to 3, 4 to 4, 6 to 3, 7 to 7
- Add them up: 8+5+6+9+2+4+7+8+0+3+8+3+3+4+3+7 = 80
- 80 mod 10 = 0, so the checksum passes.
- First digit is 4, so the brand is Visa.
Result: Passes the Luhn check, brand Visa, checksum total 80.
Compute the missing check digit for the partial number 4539 1488 0343 646?.
- Take the 15 known digits 453914880343646 and append a placeholder 0 as the last digit.
- Run Luhn on 4539148803436460 and note the total is 73.
- The next multiple of 10 above 73 is 80, so you need 7 more.
- The check digit that makes the total reach a multiple of 10 is 7.
- Confirm: 4539 1488 0343 6467 now passes the Luhn check.
Result: The correct check digit is 7, giving 4539 1488 0343 6467.
Check the short string 4539 to see why length and checksum both matter.
- Strip spaces: 4539 (only 4 digits).
- From the right: 9 stays, 3 to 6, 5 stays, 4 to 8.
- Sum = 9 + 6 + 5 + 8 = 28.
- 28 mod 10 = 8, not 0, so the checksum fails.
- It is also far shorter than the 13 to 19 digits a real card uses.
Result: Fails the Luhn check (total 28) and is too short to be a card number.
Brand detection by prefix and length
| Brand | Starts with | Typical length | CVV length |
|---|---|---|---|
| Visa | 4 | 13, 16 or 19 | 3 |
| Mastercard | 51-55 or 2221-2720 | 16 | 3 |
| American Express | 34 or 37 | 15 | 4 |
| Discover | 6011, 65, 644-649 | 16 | 3 |
Common sandbox test numbers (development only, all pass Luhn)
| Number | Brand | Luhn |
|---|---|---|
| 4111 1111 1111 1111 | Visa | Pass |
| 5555 5555 5555 4444 | Mastercard | Pass |
| 3714 496353 98431 | American Express | Pass |
| 6011 0009 9013 9424 | Discover | Pass |
What a Luhn pass does and does not prove
| Question | Luhn answers? |
|---|---|
| Are the digits internally consistent? | Yes |
| Is the length plausible for a card? | Partly (check separately) |
| Does the account actually exist? | No |
| Is the card active and in date? | No |
| Are there funds available? | No |
Common mistakes to avoid
- Thinking a "valid" result means the card is real. The Luhn check only proves the digits are internally consistent. It says nothing about whether the card was ever issued, is active, or has funds. Only the card network and issuing bank can confirm that, and this tool never contacts them.
- Trusting brand detection as proof of issuer. Prefix ranges identify the likely brand but are not airtight. New ranges (like Mastercard 2221-2720) are added over time, and some prefixes overlap, so treat the brand as a best guess from the leading digits, not a guarantee.
- Forgetting to strip spaces and dashes. Numbers are often written in groups (4539 1488 0343 6467). If your own code runs Luhn on the raw string without removing separators, every number will fail. This tool strips spaces and dashes before checking.
- Running Luhn on the wrong number of digits. A truncated or padded number can sometimes still pass by coincidence. Always check the length too: 15 digits for Amex, 16 for most others, and 13 to 19 overall.
- Storing or logging real card numbers. Handling live card data brings you into PCI DSS scope. This tool never stores or transmits anything, but if you paste real numbers into your own logs or a database you take on a serious compliance and security burden. Use test numbers instead.
- Treating Luhn as a fraud or security check. Luhn catches typos, not fraud. It cannot detect a stolen but valid card, and any attacker can generate a passing number. Real protection comes from AVS, CVV, 3-D Secure, and issuer authorisation, not the checksum.
Glossary
- Luhn algorithm
- A mod-10 checksum that doubles every second digit (subtracting 9 when over 9) and checks the total is a multiple of 10. Also called the modulus 10 algorithm.
- Check digit
- The final digit of a card number, chosen so the whole number satisfies the Luhn check. It catches most single-digit typos and adjacent transpositions.
- Issuer Identification Number (IIN)
- The first six to eight digits of a card number that identify the network and issuing institution. The leading digits decide the brand.
- Bank Identification Number (BIN)
- The older name for the IIN, still widely used. It refers to the same leading digits that identify the issuer and card scheme.
- Brand
- The card network, such as Visa, Mastercard, American Express or Discover, identified here by the prefix.
- Transposition error
- Swapping two adjacent digits when typing. The Luhn check detects almost all such mistakes, which is its main purpose.
- PAN (Primary Account Number)
- The full card number printed on the card, typically 13 to 19 digits, made up of the IIN, an account section, and the check digit.
- PCI DSS
- The Payment Card Industry Data Security Standard, the ruleset that governs how real cardholder data must be stored, processed, and transmitted.
Frequently asked questions
What does this credit card validator actually check?
It runs the Luhn (mod-10) checksum to confirm the digits are mathematically consistent, and it reads the leading digits to detect the likely brand. It does not check whether the card exists, is active, or has any balance. It is a format validator, not an account lookup.
What is the Luhn algorithm?
The Luhn algorithm is a simple checksum used by almost all card numbers. Starting from the right, you double every second digit (subtracting 9 if the result is over 9), add all the digits together, and the number is valid only if the total is a multiple of 10. It catches most typos and transposed digits.
Can a number pass the Luhn check but still be a fake card?
Yes. The Luhn check only proves the digits are well-formed. Anyone can construct a number that passes it, including the standard test numbers used by payment sandboxes. Whether a card is genuine and usable can only be confirmed by the card network and issuing bank.
How does the tool detect the card brand?
It looks at the leading digits (the IIN). Visa starts with 4, Mastercard with 51-55 or 2221-2720, American Express with 34 or 37, and Discover with 6011, 65, or 644-649. If the prefix matches none of these, the brand is shown as Unknown.
Is it safe to enter a card number here?
The tool runs entirely in your browser using plain JavaScript, with no network requests and no storage, so nothing you type leaves your device. Even so, you should only enter test numbers or a card you own, never someone else"s card details.
Why does my real card fail the check?
The most common cause is a typo or a transposed pair of digits, which is exactly what the Luhn check is designed to catch. Re-enter the full number carefully, including all 15 or 16 digits, and make sure no digit is missing or duplicated.
How do I calculate the check digit myself?
Take the number without its last digit, append a 0 in that position, and run the Luhn sum. Subtract that total mod 10 from 10 (and take the result mod 10). The answer is the check digit that makes the full number pass. For example, 453914880343646 gives a check digit of 7.
What is the difference between an IIN and a BIN?
They refer to the same leading digits of a card number. BIN (Bank Identification Number) is the older term and IIN (Issuer Identification Number) is the current ISO term. Both identify the card network and issuing institution and are used for brand detection.
How many digits should a credit card number have?
Card numbers range from 13 to 19 digits. American Express is 15 digits, Visa is usually 16 (sometimes 13 or 19), Mastercard and Discover are 16. If your number falls outside 13 to 19 digits it is almost certainly incomplete or mistyped.
Is this credit card validator PCI compliant to use?
The tool itself stores and transmits nothing, so using it with test numbers raises no PCI concerns. PCI DSS scope is triggered by how you handle real cardholder data in your own systems. If you never store, log, or transmit live card numbers, you avoid that burden entirely, which is why testing with sandbox numbers is recommended.
Sources
- ISO/IEC 7812-1: Identification cards, Numbering system , International Organization for Standardization (2017)
- Computer for Verifying Numbers (US Patent 2,950,048, the Luhn algorithm) , United States Patent and Trademark Office (1960)
- PCI DSS: Payment Card Industry Data Security Standard , PCI Security Standards Council (2024)