IBAN / Luhn Card Generator
Generate syntactically valid demo IBANs and Luhn card numbers.
Overview
The IBAN / Luhn Card Generator produces syntactically valid demo IBAN account numbers and Luhn-passing credit-card numbers using clearly fake bank codes and test BINs. The output is shaped exactly like a real IBAN or PAN and will satisfy client-side validation libraries, but it is not tied to any real account and cannot be used to move money.
The generator is aimed at developers testing payment forms, QA engineers seeding test data and trainers running PCI-DSS workshops. Long-tail searches like "valid test IBAN for sandbox", "Luhn-check passing credit card number generator" and "fake card numbers that pass validation" all resolve here.
How it works
An IBAN follows ISO 13616: a two-letter country code, two check digits and a country-specific Basic Bank Account Number (BBAN). The tool picks the BBAN structure for the requested country, fills it with random digits, then computes the check digits by treating the string as a base-36 integer and taking it modulo 97. The result is rearranged so IBAN mod 97 == 1, which is the official validation rule.
Card numbers follow ISO/IEC 7812. The generator starts with a known test BIN (Visa 4, Mastercard 5, Amex 34/37, plus the public test BINs published by Stripe and Adyen), pads with random digits to the correct length and computes the trailing Luhn checksum. The Luhn algorithm doubles every second digit from the right, sums the resulting digits and chooses the final digit so that the total is divisible by ten.
Examples
IBAN (DE) → DE89 3704 0044 0532 0130 00
IBAN (GB) → GB29 NWBK 6016 1331 9268 19
Visa test card → 4242 4242 4242 4242 · expiry 12/30 · CVC 123
Mastercard test card → 5555 5555 5555 4444
FAQ
Will these IBANs work in a real bank transfer?
No. They satisfy the mod-97 checksum but they reference fake bank codes and account numbers. A real bank will reject them as unknown accounts.
Are the card numbers safe to publish?
Yes — they come from publicly-documented test BINs that are universally rejected by real payment networks but accepted by sandbox processors.
Why do I need check digits at all?
Most form validators run a Luhn or mod-97 check before submission. A purely random number would fail before it ever reached the server.
Can I target a specific country IBAN?
Yes. Pick the country code (DE, GB, FR, NL, etc.) and the generator applies the right BBAN length and structure.
Does it generate matching expiry and CVC?
It emits a future expiry and a three- or four-digit CVC. These are not validated against any database; they are shaped purely to satisfy form parsers.