Card Validator
Validate card numbers with Luhn checks, detect the card brand and format the grouping.
This tool checks number format only (Luhn + prefix). It cannot tell whether a card actually exists, is active, or has funds.
How to use it
- Paste one or more card numbers into the box, one per line - spaces and dashes are fine.
- Click Validate (validation also runs as you type).
- Each number gets a verdict: valid or invalid, with the detected brand underneath.
- Valid numbers are shown again in their standard grouping, with all but the last four digits masked in the reference line.
- Click Sample to load public test numbers, or Clear to start over.
Common use cases
- Checkout testing - confirm your payment form rejects malformed numbers before it ever calls a gateway.
- Data cleanup - find obvious typos in stored or imported card-like records.
- Educational demos - show how the Luhn checksum and prefix ranges work with public test numbers.
- Input masking design - copy the grouping rules (4-4-4-4 for most brands, 4-6-5 for Amex) into your UI.
Why it stays private
The Luhn check and prefix lookup run entirely in your browser. Numbers are never sent anywhere, so pasting a card number here does not transmit it to any server. It never appears in logs we do not control.
FAQ
Q: Does a valid result mean the card is real? A: No. The tool checks format only: a correct Luhn checksum and a known prefix. It cannot tell whether the card exists, is active, or has funds - only the issuing bank can confirm that.
Q: What do the sample numbers come from? A: They are the public test numbers documented by payment providers for integration testing. They do not correspond to any real account.
Q: Which brands can it detect? A: Visa, Mastercard (including the 2-series range), American Express, Discover, JCB, Diners Club and UnionPay, based on each brand's published prefix ranges. Unknown prefixes still pass or fail the Luhn check but show no brand.
Your data stays on this device
Card Validator runs 100% locally. Everything you paste or drop is processed by your own browser and never transmitted. Nothing is stored on our servers — close the tab and it is gone.
Nothing you type is sent to a server, logged, or used for analytics. The page works even with your network disconnected after first load.