Credit Card Validator

Validate card numbers with the Luhn check and detect the brand.

Card Number

Valid

Passes the Luhn checksum. Brand: Visa

How card validation works

Every credit card number ends with a check digit computed by the Luhn algorithm: doubling every second digit from the right (subtracting 9 when the result exceeds 9) and confirming the total is divisible by 10. This catches most typos. The brand is inferred from the leading digits (Visa starts with 4, Amex with 34/37, and so on). Note that passing Luhn only means the number is well-formed — not that it's a real, active account. All checks run locally in your browser.

Built and maintained by Meet Shah · Last updated 19 July 2026

What this tool is used for

Catching a mistyped digit in a test card number before blaming the payment gateway.
Confirming which brand a number belongs to from its prefix during an integration.
Checking that a form's client-side validation matches the Luhn rule it claims to implement.
Validating a batch of test numbers for a fixture set.
Distinguishing a format problem from a declined authorisation.

Frequently Asked Questions

What does Luhn validation actually prove?: That the digits are internally consistent — it catches single-digit typos and most adjacent transpositions. It says nothing about whether the card exists, has funds, or belongs to the person entering it.
How do I identify the card network?: From the leading digits: 4 is Visa, 51-55 and 2221-2720 Mastercard, 34 and 37 American Express, 6011 and 65 Discover, 35 JCB. Amex is 15 digits where most others are 16 — a length check alone rejects valid Amex cards.
Is it safe to validate a card in the browser?: Here yes, because nothing is transmitted — the check is arithmetic on the digits. But storing or logging a real card number anywhere in your own systems triggers PCI-DSS obligations, which is why payment forms use a processor's iframe.
Should I validate before submitting to a gateway?: Yes, as a courtesy — catching a typo client-side is faster and cheaper than a declined authorisation. It is a UX improvement, never a substitute for the gateway's own verification.
What is the CVV for?: Proving physical possession, since it is printed rather than embossed and is not stored in the magnetic stripe. It must NEVER be stored after authorisation — that prohibition is one of the strictest rules in PCI-DSS.
Are test card numbers real?: They are structurally valid and pass Luhn, but they are reserved by the networks and never route to a real account. Gateways recognise them in sandbox mode — and reject them in production, which is a useful sanity check.
What does PCI DSS require of a page handling card numbers?: Broadly, that you avoid touching the number at all. Using a gateway's hosted field or tokenisation keeps the digits out of your systems entirely, which reduces the compliance scope from an audit to a questionnaire.

Common errors and gotchas

Reading a Luhn pass as a real card. The check is arithmetic and says nothing about whether the account exists.
Assuming all card numbers are 16 digits. Several brands use 13, 15 or 19.
Pasting a real card number into a form to test it, when a published test number does the same job.
Stripping the spaces a card is printed with and losing a digit in the process.
Expecting the brand prefix to be enough. Ranges overlap and change, so prefix alone can mislead.