Credit Card Number Format

The four parts of a card number

A payment card number — officially the primary account number or PAN — is defined by the international standard ISO/IEC 7812. It is between 8 and 19 digits long, although almost every card in use has 15, 16 or 19 digits. Every PAN is made of four parts:

1. Major Industry Identifier (MII) — the first digit. It names the industry of the issuer: 4 and 5 are banking and finance, 3 is travel and entertainment, 6 is merchandising and banking.
2. Issuer Identification Number (IIN) — the first six or eight digits, also called the BIN (bank identification number). It identifies the card network and the bank that issued the card, and often the card type (credit, debit, prepaid), level and country. Since 2022 the standard uses 8-digit IINs, so systems should no longer assume 6.
3. Account identifier — the digits between the IIN and the last digit, chosen by the issuer for the individual card. It is not your bank account number.
4. Check digit — the last digit, calculated from all the others with the Luhn algorithm. It lets a form catch typos before the payment is sent.

Card number format by brand

The prefix (IIN range) tells you the brand, and the brand tells you the allowed lengths, the usual grouping and the type of security code:

Other domestic schemes follow the same rules with their own prefixes, for example Mir in Russia (2200–2204) and RuPay in India (mostly 60, 65, 81, 82 and 508). Ranges overlap in places: 622126–622925 is both UnionPay and Discover, and some Maestro ranges sit inside the 5 and 6 ranges. Check the more specific prefix first.

JCB credit card number format

JCB numbers start with 3528 to 3589 and have 16 digits, grouped 4-4-4-4 like 3530 1113 3330 0000 (a Braintree test number). The scheme allows up to 19 digits. The last digit is a Luhn check digit and the three-digit security code, called CAV2, is on the back. Because JCB numbers begin with 35, a validator that treats every number starting with 3 as American Express (15 digits, 4-digit code) rejects them — one of the most common card validation bugs. In the US, JCB cards are processed on the Discover network.

Validation patterns (regex)

These regular expressions check the prefix and length of a number with spaces and dashes removed. Use them together with the Luhn check:

Spacing and display rules

• Display in groups. 16-digit cards are printed in four groups of four. American Express uses 4-6-5 (3782 822463 10005) and 14-digit Diners Club cards 4-6-4. Grouping helps people compare what they typed with the card.
• Accept any spacing. Let users type spaces or dashes and remove them before validating. Don’t block paste.
• Store digits only, never with formatting — and only if you are allowed to store card numbers at all. Most sites let the payment gateway store them and keep a token instead.
• Mask when displaying. PCI DSS allows at most the BIN and the last four digits to be shown, for example 4111 11•• •••• 1111. Receipts usually show only the last four.
• Use the right input attributes. inputmode="numeric" shows a number keypad on phones and autocomplete="cc-number" lets the browser fill the card in.

Expiry date format

The expiry date is printed as MM/YY, for example 08/29. The card is valid until the last day of that month. Payment APIs usually take the month and a four-digit year as separate fields, so your form should convert 08/29 to month 8 and year 2029. Reject months outside 01–12 and dates in the past, and allow dates up to about 20 years ahead.

CVV, CVC and CID formats

The card security code has a different name for each brand but the same purpose: proving that the person paying has the physical card. It is not derived from the card number by any public formula.

• 3 digits on the back for Visa (CVV2), Mastercard (CVC2), Discover (CID), JCB (CAV2), UnionPay (CVN2) and Diners Club.
• 4 digits on the front for American Express (CID), above the card number.
• Some Maestro and debit cards have no code at all, so a form should not always require one.

PCI DSS forbids merchants from storing the security code after authorization, even encrypted. In test data, a random code of the right length is all you need.

Major Industry Identifier values