Card number checker
Read a card number the way the schemes publish it: which brand the leading digits belong to, whether the length is one that brand publishes, and whether the check digit is right. Every row cites the document it came from. It runs in your browser — the number is never sent anywhere. Free.
This runs in your browser
Everything on this page is arithmetic over the digits you type, and all of it already loaded with the page. There is no request to make, so there is no endpoint, no log line, no cache and no analytics event carrying the number. It is not written into the URL either, which is the usual way a value like this ends up in a server log or a referrer header by accident.
The check for that is simple: turn off your network and the answers still appear as you type. We would rather you verified the claim than believed it.
What the three checks are
The brand comes from the leading digits, matched against the prefix ranges the card schemes publish. A number outside every published range is reported as not recognised rather than assigned to the nearest brand.
The length is checked against what that brand publishes — and only where the brand is both recognised and publishes one. Where it does not, the length answers nothing at all rather than being measured against a number borrowed from elsewhere.
The check digit is the Luhn formula defined in ISO/IEC 7812-1: working right to left, double every second digit, subtract 9 from any result above 9, and add everything up — a valid number totals a multiple of 10. It exists to catch a mistyped digit or two digits swapped round. It is a typing check, not a fraud check, and it says nothing about whether a card exists.
Brand prefixes and lengths
The table the checker itself reads, so the two can never drift apart. A brand appears here only when its ranges can be cited to a published source; the rest answer "not recognised".
Two entries say "not published" under digits, and that is not an omission. Visa and Mastercard do not publish permitted PAN lengths — their current rules oblige devices to accept any valid number rather than naming their own — so the length is left unevaluated rather than borrowed from somewhere else. Maestro is absent altogether: Mastercard defines it by its routing tables rather than by a prefix, and the prefixes every other checker repeats for it appear in none of Mastercard's published documents.
| brand | leading digits | digits | source |
|---|---|---|---|
| Visa | 4 | not published | Card Acceptance Guidelines for Visa Merchants (Visa, 2015), §2Visa publishes the leading digit but not its permitted lengths: the current Visa Core Rules oblige devices to accept any valid ISO number of 11 to 19 digits rather than naming Visa’s own. Length is left unevaluated here rather than borrowed from a third party. |
| Mastercard | 51–55, 2221–2720 | not published | Mastercard Rules (2 June 2026), §3.17 “BINs”Mastercard publishes its assignment blocks as 22210000-27209999 and 51000000-55999999, which are exactly these prefixes. It does not publish a PAN length: its processing rules require terminals to accept “all valid PAN lengths”, so the length is left unevaluated. |
| American Express | 34, 37 | 15 | American Express Merchant Operating Guide (April 2026), §8.5; Getting Started Guide (UK) |
| Discover | 6011, 644–658 | 16, 17, 18, 19 | Discover Global Network, Global Payment Network IIN Range Summary (2026)Discover’s own table stops at 6589, not 659. The 6440-6589 block also carries BC Card (Korea) and DinaCard (Serbia), so a number here is in Discover’s acceptance range without necessarily being a Discover card. |
| JCB | 3528–3589, 3088–3094, 3096–3102, 3112–3120, 3158–3159, 3337–3349 | 16, 17, 18, 19 | Discover Global Network, Global Payment Network IIN Range Summary (2026), rows marked “JCB IIN Ranges”Cited to another network’s published routing table rather than to JCB: JCB publishes no card-number format document we could find. |
| Diners Club International | 300–305, 3095, 36, 38–39 | 14, 15, 16, 17, 18, 19 | Discover Global Network, Global Payment Network IIN Range Summary (2026)Published lengths conflict: Discover’s range summary says 16-19 while Discover’s own test card is 14 digits. 14-19 is the only span that reconciles them. |
| UnionPay | 62, 81 | 16, 17, 18, 19 | UnionPay International, Merchants & Offers (prefixes); Discover Global Network IIN Range Summary (lengths)UnionPay states only that its cards start 62 or 81. Co-badged UnionPay numbers also exist under other schemes’ prefixes, so 62 and 81 catch the bulk rather than all of them. |
What this checker will not tell you
- The issuing bank.Which bank issued a card is not derivable from the digits alone; it lives in commercial BIN databases.
- The issuing country.Same source, same problem. A prefix says which scheme a number belongs to, not where it was issued.
- Debit, credit or prepaid.Not a property of the leading digits at any length this page can read.
- Whether the card exists, is open, or has funds.Only the issuer knows, and only an authorisation through your payment processor can ask.
- Whether it has been reported lost or stolen.No public source carries that, and any site claiming to answer it is guessing or worse.
Those answers are sold as "BIN lookup", compiled from card data whose provenance is rarely stated, and there is no free, openly-licensed, authoritative source to check them against — the ISO register of issuer identification numbers is not public. Card schemes' own published accuracy work has found third-party BIN databases wrong about the issuer more often than not.
Spaw's four products each answer from open registries and name the dataset and version behind every field. There is no such registry for card issuers, so rather than guess in a way you could not check, this page answers what it can prove and stops.
Questions
Is the card number sent to your server?
No. The whole check is a few dozen lines of JavaScript that loaded with the page, so the number never leaves your browser: there is no request, no endpoint, no log line and no cache. It is not put in the URL either, so it cannot reach server logs or analytics. Disconnect from the network and the page still answers.
Does a valid check digit mean the card is real?
No. The Luhn check digit catches mistyped and transposed digits — nothing more. A number can pass every check on this page and belong to no card at all. Only the issuing bank knows whether a card exists, is open, or has funds, and only an authorisation through your payment processor can ask.
Can you tell me the issuing bank or the country?
No, and that is deliberate. Those answers come from BIN databases compiled from card data of unclear provenance; there is no free, openly-licensed, authoritative source, because the ISO IIN register is not public. Spaw answers from open registries and names them, so where there is no registry to name, it answers nothing rather than guessing.
Should I paste a real card number here?
You can — nothing is transmitted — but the sensible habit on any website is to use one of the published test numbers instead. The example buttons above are scheme-published test numbers that belong to nobody.
Verifying customers, not cards
Spaw does not sell card data. What it does verify is the rest of a signup — email, phone, IP and postal address — from open registries, with every answer naming the source it came from. 10 free lookups a month, no card required.