Test Credit Card Generator
Generate valid test credit card numbers for development and testing purposes.
100% private100% private
Generate card numbers that pass Luhn-check validation (the algorithm that catches typos at the form-submit step) but are not connected to any real account. Pick the network — Visa, Mastercard, American Express, or Discover — to match the test scenario, and copy a batch with matching CVV and expiry. Useful for filling out checkout forms during QA without burning real cards. The numbers are generated by your browser and never reach an issuer or processor.
Next steps
Fake Data Generator
RecommendedCreate realistic names, emails, and addresses for testing.
UUID Generator
RecommendedGenerate v4 (crypto-random) or v1 (time-based) UUIDs instantly — copy one or generate a batch.
Password Generator
Create strong, random passwords that are virtually uncrackable.
JSON Mock Generator
Quickly generate realistic mock JSON data for API tests.
Runs right inside your browser tab. No uploads. Your files stay private.
What Are Test Credit Card Numbers?
Test credit card numbers are synthetic 15- or 16-digit strings constructed so that the final digit satisfies the Luhn checksum (ISO/IEC 7812-1) and the leading digits match a real Issuer Identification Number (IIN) prefix. They look exactly like real cards to client-side validators but are not registered with any issuing bank, so a payment processor will reject them at the authorization step.
This generator builds each number directly in the browser using Math.random for the body digits, then computes the Luhn check digit with a small TypeScript implementation you can read in the source above. The Luhn pass works by doubling every second digit from the right, summing the digits of any result greater than 9, and choosing the final digit so the total is a multiple of 10.
Each card type uses a real IIN range: Visa starts with 4 (16 digits), Mastercard starts with 5 (16 digits, ranges 51-55), American Express starts with 34 or 37 (15 digits), and Discover starts with 6011 (16 digits). These ranges are public information published by ISO and the card networks - they identify the issuing system, not any individual account, so generating a number in the range cannot match a live card.
The CVV (Card Verification Value, sometimes CVC or CID) is a 3-digit code on Visa, Mastercard, and Discover, or a 4-digit code printed on the front of an American Express card. The real CVV is computed from the card number, expiry, and a bank-held secret using a DES-based MAC; this tool just generates a random number of the right length, which is sufficient for client-side form validation but will fail any actual processor check.
Expiry dates are randomized to a month within the next 1-5 years, formatted MM/YY, which is how processors expect them on the wire. The tool deliberately avoids generating past dates because most payment SDKs reject expired cards before the network call, which would defeat the purpose of a smoke-test fixture.
Where this is useful: testing the visual states of a payment form, exercising your input mask, smoke-testing a checkout flow against a sandbox like Stripe's testmode (where Stripe's own dedicated test numbers - 4242 4242 4242 4242, etc. - are usually a better fit), and populating UI mockups so your screenshots don't leak real PANs. Where it is not useful: anything beyond the format validation gate. Real authorization, AVS, fraud scoring, and 3DS will all reject these numbers immediately.
Important legal note: generating a number that happens to match a real account is not fraud, but attempting to charge any card you don't own is. Use these strictly for development, automated tests, and demos. For real production-style testing, every major payment provider (Stripe, Adyen, Braintree, Square) publishes a small set of dedicated test numbers that interact correctly with their sandbox - prefer those when integrating against a specific gateway.
Common Use Cases
01
Form validation smoke tests
Quickly verify a checkout form's Luhn check, card-type detection, and field masking without typing a real number.
02
Populating UI mockups
Generate realistic-looking PANs for screenshots and design comps so the imagery doesn't accidentally show a real card.
03
Stripe Elements local testing
Have a quick supply of valid-format numbers for testing client-side card components before you switch to Stripe's dedicated test numbers.
04
Cypress / Playwright fixtures
Seed end-to-end tests with deterministic-looking card data while you stub out the network layer entirely.
Frequently Asked Questions
No. They satisfy the Luhn checksum and use real IIN prefixes, so naive client-side validators accept them, but they are not registered with any bank. Any actual authorization request - sandbox or production - will return a decline almost immediately.
Visa (prefix 4, 16 digits), Mastercard (prefix 5, 16 digits), American Express (prefix 37, 15 digits), and Discover (prefix 6011, 16 digits). Other networks like JCB, Diners Club, and UnionPay use different IIN ranges; they aren't exposed in the UI but the Luhn logic is identical.
No. Real CVVs are derived from the card number, expiry, and a bank-held key via a DES-based MAC. This tool generates a random 3- or 4-digit number that satisfies length validation only. Stripe and other gateways will reject it on submission.
It's a checksum defined in ISO/IEC 7812-1 (originally Hans Peter Luhn at IBM, 1954). Walk the digits right-to-left, double every second one, sum the resulting digits, and the total must be a multiple of 10. The last digit of the card is the value that makes the sum work out - that's why it's called the check digit.
Amex uses ISO 7812 prefix 34 or 37 with a 15-digit account format, while Visa, Mastercard, and Discover all settled on 16 digits. Some newer networks (Maestro, UnionPay) actually allow 13-19 digits. Your form validator should treat length as card-type-dependent, not a fixed constant.
Theoretically the namespace overlaps - generating a number in IIN range 4xx... could collide with a Visa account that exists somewhere. The probability is vanishingly small (one in ~10^14 across the full network) and does not matter because the number lacks the matching CVV, expiry, and AVS data. Don't attempt to charge generated numbers regardless.
Sandboxes like Stripe testmode use specific magic numbers to simulate decline reasons, 3DS challenges, and risk scoring. 4242 4242 4242 4242 always succeeds; 4000 0000 0000 0002 always declines as 'card_declined'. For testing real gateway logic you want those, not random Luhn-valid numbers.
No. Generation runs directly in your browser - the digits never leave the page. There's no analytics or telemetry on this generator either, so what you generate stays in your tab and is gone when you close it.
Not from the UI today - the prefixes are hardcoded per network. If you need a specific BIN (for example to test a co-branded card from a particular issuer), you can edit the prefixes object in the source or paste your prefix into the body and run a manual Luhn pass.
Generation itself is not illegal - the math is in published standards and the format is public. What is illegal is using any card number you don't own to attempt a charge or to misrepresent yourself. Use these strictly for development and automated testing where no real authorization happens.
Advertisement