Luhn validator and test card number toolkit
Check a Luhn digit and see the arithmetic, identify the card network from its IIN, and look up published sandbox cards.
Runs in your browser — nothing you paste is sent to a server
Spaces and hyphens are ignored. Use test data — see the reference tab.
What the Luhn check actually does
Starting from the rightmost digit and working left, every second digit is doubled. Any doubled value above 9 has 9 subtracted from it. All the resulting values are added, and the number passes if that total is divisible by 10.
It was designed in the 1950s to catch keypunch errors, and that is still all it does. It detects every single-digit mistake and most transpositions of adjacent digits — though famously not 09 for 90. It involves no secret, no lookup and no issuer. Validating a number client-side saves your customer a pointless round trip to a decline; it is not a fraud control and cannot be used as one.
Scope and limits
- Network detection is prefix matching against published IIN ranges. Those ranges overlap between networks, so more than one match is often the honest answer. Authoritative routing needs a BIN table from your acquirer.
- The sandbox card reference is a curated snapshot with links to each gateway's documentation. Gateways revise these; the docs win.
- Everything runs in your browser — no storage, no transmission, no logging. Use test data regardless: a real number in your clipboard or a screenshot is a PCI problem this page cannot solve for you.
Worked example
The classic test number, and the same number with its final digit changed. Everything below is computed by the same code the tool above runs.
Valid
4111 1111 1111 1111
- Digit sum:
- 30
- Divisible by 10:
- yes
- Networks matched:
- Visa
One digit changed
4111 1111 1111 1112
- Digit sum:
- 31
- Divisible by 10:
- no
- Networks matched:
- Visa
Published IIN ranges
What the detector matches against. Note how many of them overlap.
| Network | Starts with | Length | Code |
|---|---|---|---|
| Visa | 4 | 13, 16, 19 | 3 |
| Mastercard | 51–55, 2221–2720 | 16 | 3 |
| American Express | 34, 37 | 15 | 4 |
| Discover | 6011, 622126–622925, 644–649, 65 | 16, 19 | 3 |
| JCB | 3528–3589 | 16, 17, 18, 19 | 3 |
| Diners Club | 300–305, 3095, 36, 38–39 | 14, 16, 19 | 3 |
| UnionPay | 62, 81 | 16, 17, 18, 19 | 3 |
| RuPay | 60, 6521, 6522, 508, 353, 356 | 16 | 3 |
| Maestro | 5018, 5020, 5038, 5893, 6304, 6759, 6761–6763 | 12, 13, 14, 15, 16, 17, 18, 19 | 3 |
Frequently asked questions
- Does a Luhn-valid number mean the card is real?
- No, and this is the most important thing to understand about it. Luhn is a checksum designed to catch typing errors — a single wrong digit, or most transpositions of adjacent digits. It is arithmetic over the digits themselves, with no secret and no lookup. A number that passes has no issuer record, no expiry, no security code and no balance behind it. Passing the check tells you the number was probably typed correctly, and nothing whatsoever about whether it can be charged.
- Why do two networks match my card number?
- Because the published IIN ranges genuinely overlap. RuPay issues on 60, which sits inside the range Discover uses; UnionPay's 62 overlaps a Discover range too. Prefix matching cannot separate them, and any tool that shows you a single confident answer is hiding the ambiguity. This one shows every match. If you need an authoritative answer — for routing, interchange or surcharging — you need a BIN table from your acquirer, not a regex.
- Why isn't my Mastercard starting with 2 detected as a Mastercard?
- It should be here, but a lot of code still misses it. Mastercard added the 2221 to 2720 range in 2017, and BIN regexes written before then only match 51 to 55. If your checkout rejects a valid Mastercard beginning with a 2, that stale regex is almost certainly why. There is a test card for exactly this case in the reference below.
- Is it safe to paste a real card number here?
- Everything runs in your browser and nothing is transmitted, stored or logged — you can verify that by disconnecting from the network and watching the tool keep working. Even so, use test data. A real card number in your clipboard, browser history or a screenshot pulls you into PCI scope in ways that have nothing to do with this page, and no tool can undo that for you.