How to Validate a Credit Card Number Free — Luhn Algorithm (2026)

You can validate credit card numbers with the Luhn algorithm in your browser using brevio Credit Card Validator — the card number never leaves your device. No data is transmitted.

What Does Card Number Validation Tell You?

Client-side card number validation checks format only. A number that passes Luhn validation is correctly formatted for its card type, but this tells you nothing about whether:

• The card account exists
• The card is active and not cancelled
• The card has sufficient funds or credit
• The card is not reported stolen
• The CVC or expiry date is correct

Real payment authorisation requires a live API call to a payment processor (Stripe, Adyen, Braintree). Client-side validation is a UX improvement — catching obvious typos before the user submits — not a security measure.

The Luhn Algorithm

The Luhn algorithm (also called Mod 10) was developed by Hans Peter Luhn of IBM in 1954. It is a simple checksum formula that detects most single-digit errors and all adjacent transpositions (swapping two adjacent digits). It is not a cryptographic hash — it is designed only to catch accidental data entry errors, not deliberate forgery.

How Luhn Works

1. Starting from the rightmost digit (the check digit), move left and double every second digit.
2. If doubling produces a number greater than 9, subtract 9 from the result.
3. Sum all the digits (doubled and undoubled).
4. If the total modulo 10 equals 0, the number is valid.

Example: Card number 4532015112830366 — following these steps produces a sum divisible by 10, so it passes Luhn validation.

Card Number Formats by Type

• Visa: Starts with 4. 13 or 16 digits.
• Mastercard: Starts with 51–55 (original BIN range) or 2221–2720 (new BIN range added 2017). Always 16 digits.
• American Express: Starts with 34 or 37. Always 15 digits. Formatted as 4-6-5 (not 4-4-4-4).
• Discover: Starts with 6011 or 65. 16 digits.
• JCB: Starts with 35. 16 digits.
• Diners Club: Starts with 300–305, 36, or 38. 14 digits. Formatted as 4-6-4.
• UnionPay: Starts with 62. 16–19 digits. Largest card network by number of cards issued.

PCI DSS Notes

The Payment Card Industry Data Security Standard (PCI DSS) governs how payment card data must be handled. Key rules relevant to web developers:

• Never log card numbers. Card numbers (PANs) must not appear in application logs, error messages, or analytics events — not even truncated. The only safe display is the last four digits.
• Never store full card numbers. Unless your application is specifically PCI Level 1 certified (very few are), you must not store full card numbers. Use a payment processor's tokenisation system instead.
• HTTPS is mandatory. Any page that collects card data must be served over HTTPS. HTTP pages cannot be PCI compliant.
• Use hosted fields or redirect. The easiest way to avoid PCI scope is to use a payment processor's hosted payment page or embedded iframe fields (Stripe Elements, Braintree Hosted Fields). These keep raw card numbers out of your infrastructure entirely.

Test Card Numbers

Payment processors provide test card numbers for development and staging environments. Stripe's test Visa number is 4242424242424242; the test failure number is 4000000000000002. These numbers pass Luhn validation but are rejected by the real Visa network. Always use test card numbers in development — never use real card numbers, even for testing.