What does this credit card validator actually check?

It verifies two things from the number itself: that the Luhn (mod-10) checksum passes, and that the length matches the detected card brand. It also infers the brand from the leading digits (the IIN/BIN). It never contacts a bank or payment network, so it cannot tell you whether the card is real, active or has funds.

How does the Luhn algorithm work?

Reading the number right to left, every second digit is doubled. If a doubled value is greater than 9, you subtract 9 from it. All the resulting digits are summed, and the number is valid only when that total is a multiple of 10. This single check digit catches almost every single-digit typo and most transpositions.

Why does a number pass Luhn but still show as invalid?

Passing the checksum is necessary but not sufficient. The number must also be the correct length for its brand. For example, an Amex number that passes Luhn but is 16 digits long is rejected, because Amex cards are always 15 digits.

Is it safe to type a real card number here?

The tool runs entirely in your browser with no network requests, so nothing is transmitted. That said, you should only ever test numbers you own, and prefer official test numbers (like 4242 4242 4242 4242) when building software.

Can I use this to validate cards in my own app?

You can use the same logic. The standard order is: strip non-digits, detect the brand by IIN, confirm the length matches that brand, then run the Luhn checksum. Never store full card numbers yourself — use a PCI-compliant processor such as Stripe and validate only for instant user feedback.

Credit Card Validator

Q: How is the card brand detected?

Each network owns a range of leading digits called the Issuer Identification Number (IIN, formerly BIN). Visa cards start with 4, Mastercard with 51-55 or 2221-2720, American Express with 34 or 37, and so on. The validator matches the longest, most specific prefix and reports the brand along with its allowed lengths.

A credit card validator that runs the two checks every payment form relies on for instant client-side feedback: the Luhn (mod-10) checksum and card-brand detection from the number’s leading digits. Paste a number and you immediately see whether it is internally well-formed, which network it belongs to, and whether its length is correct for that brand. Everything happens in your browser — no number is ever uploaded, and no bank or payment API is contacted.

How it works

A card number is not random. The first six to eight digits are the Issuer Identification Number (IIN, historically called the BIN), and each network owns specific ranges: Visa numbers begin with 4, Mastercard with 51-55 or 2221-2720, American Express with 34 or 37, Discover with 6011/65, and so on. This tool matches the most specific prefix to name the brand and look up its allowed lengths and CVV size.

The final digit is a Luhn check digit. Reading right to left, every second digit is doubled (subtracting 9 from any result above 9), all digits are summed, and the number is valid only when that sum is divisible by 10. This catches virtually every single-digit typo and most adjacent transpositions — which is exactly why checkout pages reject a mistyped number before you ever press pay.

A number is reported as valid only when both checks pass: the Luhn checksum is satisfied and the length matches the detected brand. The brand table below is searchable so you can compare IIN ranges across networks at a glance.

Example

Take 4539 1488 0343 6467. The leading 4 identifies it as Visa, the length is 16 digits (allowed for Visa), and the Luhn sum lands on a multiple of 10 — so it is reported as a valid Visa number. Change a single digit, say to 4539 1488 0343 6468, and the Luhn checksum fails: the verdict flips to invalid even though the brand and length are still fine.

Number	Brand	Length	Luhn	Verdict
4242 4242 4242 4242	Visa	16	pass	Valid
5555 5555 5555 4444	Mastercard	16	pass	Valid
3782 822463 10005	Amex	15	pass	Valid
4242 4242 4242 4241	Visa	16	fail	Invalid

Every figure is computed locally — your input never leaves the device.