Credit Card Validator
Luhn check and issuer detection
Card numbers are not arbitrary. The first six to eight digits identify the issuer, the digits after that are the account number, and the last digit is a checksum computed with the Luhn algorithm — double every second digit from the right, subtract nine from anything over nine, and the total must be divisible by ten.
That checksum exists to catch typing errors, not fraud. It reliably detects a single mistyped digit and most transpositions, which makes it worth running in a form before a payment request is sent. It says nothing whatsoever about whether a card exists, has funds or belongs to the person entering it — only a payment processor can answer that.
How to use it
- Paste the numberSpaces and hyphens are ignored. Use test numbers from your payment provider’s documentation, never a real card.
- Read the Luhn resultA pass means the digits are internally consistent. A failure means at least one digit is wrong, which in a form is the moment to prompt rather than after a declined transaction.
- Check the detected issuerThe network is inferred from the leading digits and the length, which is what a checkout form uses to show the right card logo as you type.
Frequently asked questions
Does passing the Luhn check mean a card is real?
No. Luhn only verifies that the digits are arithmetically consistent, and a valid-looking number can be generated in seconds. It catches typos. Whether a card exists, is active and has funds is knowable only through the payment network, which is why validation in a form is a usability feature, not a security control.
How does the Luhn algorithm work?
Starting from the rightmost digit, double every second digit; if a doubled value exceeds nine, subtract nine. Add every digit together, including the ones you did not double. If the total is divisible by ten, the number passes. It was patented by Hans Peter Luhn at IBM in the 1950s and is now used well beyond payment cards.
How are card networks identified?
By the leading digits and the total length. Visa begins with 4 and runs to 16 digits, Mastercard uses 51–55 and 2221–2720, American Express uses 34 or 37 with 15 digits, and Discover mostly begins 6011 or 65. Those ranges are assigned, not guessed, though issuers do add new ones.
Is it safe to type a card number into a web page?
Into this one, in the sense that nothing is transmitted — the check runs in your browser. But the habit is a bad one, and PCI DSS exists precisely because handling card data creates obligations. Use your provider’s published test numbers, which are designed for exactly this and are worthless to anyone.
What is a BIN or IIN?
The Bank Identification Number, more properly the Issuer Identification Number, is the leading block of digits identifying the issuing institution. It was six digits and has been moving to eight. Commercial BIN databases map it to a specific bank, country and card type, which is how a checkout can tell a debit card from a corporate credit card before authorisation.