Credit card generator for testing

A card number (PAN) has three parts. The first 6 or 8 digits are the issuer identification number (IIN, often called BIN), which says which network and bank issued the card. The middle digits identify the account. The last digit is a check digit computed with the Luhn algorithm, so that typos are caught before the number is sent anywhere.

The generator picks a prefix from the brand's IIN range, fills the account digits at random, then appends the Luhn digit. To compute that digit:

1. Start from the rightmost digit of the number without its check digit, and double every second digit going left, starting with that one.
2. If doubling gives more than 9, subtract 9 (the same as adding its two digits).
3. Add up all the digits. The check digit is whatever brings the total to a multiple of 10.

Example: for 7992739871 the sum is 67, so the check digit is 3 and the full number is 79927398713. To validate a full number, run the same sum over all its digits, doubling every second digit from the right, starting with the second-to-last; the total must end in 0.

These are the ranges the generator uses and the validator recognises. When ranges overlap, the longer prefix wins: 6011 is Discover, the rest of 60 is RuPay. RuPay also issues cards starting with 65, the same prefix as Discover, so the validator reads 65 as Discover.

Mastercard started issuing 2-series numbers (2221 to 2720) in 2017, so a validator that only accepts 51 to 55 rejects real Mastercard cards. Visa numbers can be 13, 16 or 19 digits; the generator uses 16 unless you pick another length.

Strip spaces and dashes first, then check the digits. The same loop gives you the check digit when you run it over the number without its last digit.

// true when the number passes the Luhn check (digits only)
function luhnValid(num) {
  let sum = 0;
  for (let i = 0; i < num.length; i++) {
    let d = Number(num[num.length - 1 - i]);
    if (i % 2 === 1) { d *= 2; if (d > 9) d -= 9; }
    sum += d;
  }
  return num.length > 1 && sum % 10 === 0;
}

luhnValid('4242424242424242'); // true

def luhn_check_digit(body: str) -> int:
    """Digit to append to body so the whole number passes Luhn."""
    total = 0
    for i, ch in enumerate(reversed(body)):
        d = int(ch)
        if i % 2 == 0:
            d *= 2
            if d > 9:
                d -= 9
        total += d
    return (10 - total % 10) % 10

import secrets
body = "411111" + "".join(str(secrets.randbelow(10)) for _ in range(9))
print(body + str(luhn_check_digit(body)))  # a 16-digit Visa-format test number

func luhnValid(num string) bool {
	sum := 0
	for i := 0; i < len(num); i++ {
		d := int(num[len(num)-1-i] - '0')
		if d < 0 || d > 9 {
			return false
		}
		if i%2 == 1 {
			d *= 2
			if d > 9 {
				d -= 9
			}
		}
		sum += d
	}
	return len(num) > 1 && sum%10 == 0
}

In tests, a fixed seed gives repeatable fixtures. Libraries such as Faker (faker.finance.creditCardNumber() in JavaScript, fake.credit_card_number() in Python) generate Luhn-valid numbers too.

A generated number tests everything on your side: input masks, brand detection and logos, length and Luhn validation, how numbers are stored and masked, CSV imports and load tests. It does not test a payment gateway. Gateway sandboxes respond to the test numbers they publish, each tied to an outcome such as success, a specific decline or a 3D Secure challenge.

For Stripe, use the Stripe test cards list, and the Stripe fee calculator to see what a real charge would cost. PayPal publishes its own generator for its sandbox.

• Luhn catches any single wrong digit and most swaps of two neighbouring digits, but not a swap of 09 and 90. Passing Luhn says nothing about whether the account exists.
• Accept spaces and dashes in the input and strip them before checking. People paste numbers in groups of four.
• American Express groups digits 4-6-5 and prints a 4-digit code on the front. Don't hard-code a 3-digit CVC field.
• PCI DSS forbids storing the card verification code after authorization. Keep generated CVCs in fixtures, not in a table that mirrors production.
• Store numbers as strings, not numbers: a 16-digit card number can be larger than JavaScript's Number.MAX_SAFE_INTEGER (2⁵³ - 1) and lose digits.

More free tools for building payment flows: JSON formatter for webhook payloads, mock data generator for the rest of your fixtures, the free fake data and testing APIs, and the full list of free developer tools.