Test Credit Card Numbers

How a card number is built

Card numbers follow ISO/IEC 7812 and have 12 to 19 digits. The first 6 or 8 digits are the issuer identification number (IIN, usually called the BIN), which identifies the network and the issuing bank. Then comes the account number, and the last digit is the Luhn check digit. So the numbers aren't random: only the account part is.

These are the prefixes and lengths the generator and validator use. Generated numbers have 16 digits, except American Express (15) and Diners Club (14).

• Visa: starts with 4. 13, 16 or 19 digits.
• Mastercard: 51 to 55, or 2221 to 2720. 16 digits.
• American Express: 34 or 37. 15 digits.
• Discover: 6011, 644 to 649, or 65. 16 to 19 digits.
• Diners Club: 300 to 305, 36, 38 or 39. 14 to 19 digits.
• JCB, from Japan: 3528 to 3589. 16 to 19 digits.
• UnionPay, from China: 62. 16 to 19 digits.
• Maestro, a debit brand common in Europe: 5018, 5020, 5038, 5893, 6304, 6759 or 6761 to 6763. 12 to 19 digits.

Regional card networks

Many countries have their own networks, such as RuPay in India, Elo in Brazil, Mir in Russia, Cartes Bancaires in France and Troy in Turkey. The generator doesn't make numbers for them, and since some of their ranges overlap the brands above, the validator may name the wrong brand (the Luhn result is still right). If you sell in those markets, take test numbers from your payment provider's documentation for that country.

The Luhn algorithm, step by step

Hans Peter Luhn, an IBM scientist, patented the check in 1960, and ISO/IEC 7812-1 specifies it. It catches typing mistakes. It isn't a security feature.

• Start at the rightmost digit (the check digit) and move left.
• Double every second digit: the 2nd, 4th, 6th and so on from the right.
• If a doubled digit is more than 9, subtract 9 (16 becomes 7).
• Add up all the digits. The number is valid when the total is a multiple of 10.
• Example: in Stripe's Mastercard test number 5555 5555 5555 4444, the digits from the right become 4, 8, 4, 8, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1. They add up to 60, so the number is valid.

Security code, expiry date and what a validator can't tell

Each network has its own name for the security code: CVV2 at Visa, CVC2 at Mastercard, CID at American Express (4 digits, printed on the front) and Discover, CAV2 at JCB and CVN2 at UnionPay. Forms usually just say CVV or CVC. Expiry dates are written MM/YY, and a card stays valid until the last day of that month.

A passing Luhn check, a known prefix and the right length only prove that a number is well formed. Whether it was issued, blocked or funded, only the issuing bank knows.

Stripe and other payment sandboxes

Stripe's test numbers work only with your test API keys. Use any future expiry date (such as 12/34) and any 3-digit CVC, or 4 digits for American Express. 4242 4242 4242 4242 succeeds and 4000 0000 0000 0002 gives a generic card_declined; both are on the Stripe tab. Stripe's documentation also has cards for specific cases, such as 4000 0000 0000 9995 for insufficient funds and 4000 0000 0000 3220 for a payment that needs 3D Secure.

PayPal, Adyen, Braintree and other providers publish their own lists, often with numbers for local brands and for each decline reason. Use those in their sandboxes, and use generated numbers for your own validation code and UI.

Keep real card numbers out of testing: PCI DSS v4.0 (requirement 6.5.5) doesn't allow live card numbers in pre-production environments unless they're protected like production. And rate-limit your public checkout, because criminals use open payment forms to check which stolen numbers still work.

Luhn check in code

To create a check digit, try 0 to 9 and keep the digit that makes the number valid. For 411111111111111 it's 1, which gives 4111 1111 1111 1111. Luhn catches every single wrong digit and almost every swap of two neighboring digits, but it misses 09 swapped with 90.

function luhnValid(number) {
  const digits = number.replace(/\D/g, "");
  let sum = 0;
  for (let i = 0; i < digits.length; i++) {
    let d = Number(digits[digits.length - 1 - i]);
    if (i % 2 === 1) {
      d *= 2;
      if (d > 9) d -= 9;
    }
    sum += d;
  }
  return digits.length > 0 && sum % 10 === 0;
}

luhnValid("4242 4242 4242 4242"); // true

def luhn_valid(number: str) -> bool:
    digits = [int(c) for c in number if c in "0123456789"]
    total = 0
    for i, d in enumerate(reversed(digits)):
        if i % 2 == 1:
            d *= 2
            if d > 9:
                d -= 9
        total += d
    return len(digits) > 0 and total % 10 == 0

luhn_valid("4242 4242 4242 4242")  # True