Test card number generator and checker

What makes a card number look valid to a form is two things: a recognised prefix and a correct Luhn check digit. The prefix identifies the brand. 4 for Visa, 51–55 and 2221–2720 for Mastercard, 34 and 37 for American Express, and the last digit is a checksum over the rest. A form’s client-side validation checks both and nothing else, because it cannot check anything else without talking to the network. Generating a number and checking one are therefore the same arithmetic run in opposite directions, which is why they sit on one page.

The Luhn algorithm exists to catch typing mistakes, not fraud. It was designed in the 1950s to detect the two errors humans actually make: a single wrong digit, and two adjacent digits swapped. It catches every single-digit error and almost every transposition, the exception being 09 swapped to 90, and it does it with arithmetic simple enough to have been done by a mechanical device.

What it emphatically does not do is tell you a card is real. Any number ending in the right check digit passes, and roughly one number in ten does by chance. Passing means "nobody mistyped this", not "this card exists": only the issuer can answer the second question, and only through an authorisation request. That is also why generated numbers are harmless — one reaching a real gateway is declined at the network as an invalid account, every time.

Length is the detail people forget, and it varies by brand inside the 12 to 19 digits the standard allows: American Express is 15, Diners Club 14, most others 16. A 16-digit number starting 34 is not a valid Amex card regardless of its checksum, which is why the checker tests length against the brand and not merely against the standard’s range. A generated number takes the length its own prefix implies instead of defaulting to 16, and the expiry and CVV follow the same rule — four digits of CVV for American Express, three for everything else, a real difference that catches out forms with a hard-coded three-digit field.

For testing against a specific gateway, prefer that gateway’s own published numbers; Stripe’s 4242 4242 4242 4242, and the ranges every provider documents. Those are wired into the sandbox to produce specific outcomes: a successful charge, a decline, an expired card, a fraud block. Random Luhn-valid numbers exercise your form’s validation; the published ones exercise your error handling, and you need both.

One practical note about the checker: nothing you paste leaves your browser. That is worth caring about, because a validator that posts the number to a server is a card number in someone else’s logs.