Credit Card Number Validator
Comprehensive validation: brand, length, Luhn checksum and format.
How this tool works
A card number validator runs a stack of checks, each of which rules out a different class of mistake, and stops at the first one that fails. The order matters: the cheapest checks come first, because they catch the most. Shape and length come before the checksum, and the checksum comes before any lookup.
The checks are: the number contains only digits, its length is one the brand allows, its first digit or two identify a brand whose length rule it satisfies, and its last digit is a valid Luhn checksum. A number that passes all four is internally consistent. None of the four says anything about the account behind the number, and that distinction is the one most worth being precise about.
The validation stack
| Check | Catches |
|---|---|
| Digits only | Pasted text, stray letters, a missing separator |
| Length 12-19 | A truncated or concatenated number |
| Brand and length agree | A number whose prefix does not match its length |
| Luhn checksum | A mistyped digit, and most transpositions |
The last check catches about 90% of single-digit errors, which is why it is worth running last rather than first.
When to use it
- Validate a number at the edge of a form, before any transaction
- Clean a data set of card numbers and report the failures
- Reject obviously malformed input cheaply and offline
- Decide whether a number is worth sending to a lookup or a transaction
Frequently asked questions
What does a card number validator actually check?
That the number contains only digits, that its length is valid for its brand, and that its last digit is a correct Luhn checksum. It does not contact the issuer and does not check the account.
Why is the Luhn check the last step?
Because it is the most informative single check, not the cheapest. Running it last means the cheap structural checks have already rejected the obvious failures, and a failure at that point is meaningful.
Does a passing validation mean the card is real?
No. It means the number is internally consistent. A number can be perfectly valid and belong to an account that was closed years ago.
What should I do with a number that fails?
Treat it as an input error rather than a fraud signal. In most cases it is a typing mistake, and asking the customer to re-enter is the correct response.
Is it safe to validate card numbers in the browser?
Yes, and it is better than doing it on the server. The check is arithmetic over the digits, no number needs to be transmitted for it, and validating in the browser means a malformed number never reaches your logs.
How many checks does a good validator need?
Four, in the order above. A validator that only checks the length will accept a large share of mistyped numbers, and one that only checks the checksum will accept numbers that are not cards at all.