Card Toolkit

Two card tools in one: format & check a card number, or generate dummy test numbers for your payment form. Free, runs in your browser, nothing stored.

Format & brand

Clean, group and brand-detect any card number, with a live Luhn check.

Mask safely

Hide all but the last 4 digits to share a card reference without exposing it.

Test generator

Luhn-valid dummy numbers for 6 schemes, with optional expiry and CVV.

Related: to see the issuing bank and country behind a card use the BIN Lookup; to just verify a number use the Card Validator; for bank accounts use the IBAN tool.

More PAYATE tools

Frequently asked questions

What is the Card Toolkit?

One page with two card utilities. Format cleans a card number, detects the brand from its BIN, groups it correctly (4-4-4-4, Amex 4-6-5), runs the Luhn check and can mask it. Generate creates random, Luhn-valid dummy numbers for testing payment forms. Both run entirely in your browser.

Are the generated numbers real credit cards?

No. They are randomly generated dummy numbers that only satisfy the Luhn checksum and a scheme prefix. They are not linked to any account, hold no money, and cannot buy anything. They exist only to test software and input validation.

What is the Luhn check?

The Luhn algorithm doubles every second digit from the right, sums the digits, and a valid number makes the total a multiple of 10. Nearly every card number satisfies it, so it catches typos — but a passing number is not necessarily a real, active card.

How is the card brand detected?

From the IIN/BIN — the first digits. Numbers starting with 4 are Visa, 51–55 / 2221–2720 are Mastercard, 34/37 are American Express, and so on. For the issuing bank and country behind a card, use our BIN Lookup.

Need real sandbox cards for end-to-end testing?

Use your gateway’s official test numbers in its sandbox — e.g. Stripe’s 4242 4242 4242 4242 in test mode. Using any card number, real or generated, to attempt fraud is illegal; this tool is for development and QA only.

Is anything sent to a server?

No. Both tabs work entirely in your browser. Nothing is uploaded or stored.