Test card number generator

What makes a card number look valid to a form is two things: a recognised prefix and a correct Luhn check digit. The prefix identifies the brand — 4 for Visa, 51–55 and 2221–2720 for Mastercard, 34 and 37 for American Express — and the last digit is a checksum over the rest. A form’s client-side validation checks both and nothing else, because it cannot check anything else without talking to the network.

That is why these are useful and also why they are harmless. Generating a number that satisfies a checksum tells you nothing about whether an account exists; the issuer’s systems are the only thing that knows, and they are not consulted until authorisation. A generated number reaching a real gateway is declined at the network as an invalid account, every time.

For testing against a specific gateway, prefer that gateway’s own published numbers — Stripe’s 4242 4242 4242 4242, and the ranges every provider documents. Those are wired into the sandbox to produce specific outcomes: a successful charge, a decline, an expired card, a fraud block. Random Luhn-valid numbers exercise your form’s validation; the published ones exercise your error handling, and you need both.

The expiry and CVV are random and structurally correct — a four-digit CVV for American Express, three for everything else, which is a real difference and one that catches out forms with a hard-coded three-digit field.