codekitto

Test credit card generator

Pick a brand, generate one or many Luhn-valid card numbers with expiry and CVV for sandbox checkouts. Everything stays in your browser — these are not real cards.

Each brand uses typical length and IIN prefixes.

From 1 to 500 at a time.

Result

Click Generate cards to see numbers here.

These numbers are fictitious and exist only to test payment forms, gateways and sandboxes. They pass the Luhn check but are not real cards, are not issued by any bank, and will not authorize a purchase. Do not use them to buy anything or to impersonate a cardholder.

Runs in your browser. What you paste never leaves your device.

How to use

  1. On the Generate tab, choose a brand (Visa, Mastercard, American Express, Discover, Elo, or Hipercard), how many cards you need (1 to 500), and whether the card number should show spaces.
  2. Click Generate cards. Each line shows a number, an expiry date (MM/YY), and a CVV.
  3. Use Copy to put the batch on the clipboard, or Download TXT / Download CSV to save it. CSV columns are brand, number, expiry, and cvv. In Excel, a number without spaces turns into scientific notation and loses its last digit, and a CVV starting with 0 loses that zero: keep Number with spaces checked and import the cvv column as text.
  4. On the Validate tab, paste a number (with or without spaces) and click Validate to check the Luhn digit.

Everything runs in your browser. Generated values are not uploaded and are not put in the page URL — analytics and ads only see the address you visited.

What it is for

Payment forms, gateway sandboxes, and QA checklists almost always ask for a card that “looks valid”: correct length for the brand, a Luhn check digit, a future expiry, and a CVV of the right size. Using a personal card in staging is a bad habit; using a number from a random website without understanding the disclaimer is worse. This page is built for developers and testers who need disposable, algorithmically valid test data and nothing else.

You can generate a single Visa for a manual click-through, or a CSV of fifty Mastercard numbers for a load script. Elo and Hipercard are included because Brazilian checkouts often branch on those brands. American Express uses 15 digits and a four-digit CVV; the tool follows that so your UI validation is exercised properly.

Important: every number here is fictitious. It passes the Luhn checksum that most front-ends and many gateways run before talking to a bank, but it is not a real card, was not issued by any bank, and will not authorize a purchase. Do not use these numbers to buy anything, open accounts, or impersonate a cardholder. They exist only to test software.

How it works

Card networks identify issuers with an IIN/BIN prefix and a fixed PAN length. This tool picks a typical prefix for the brand you selected, fills the remaining digits with the browser’s cryptographic random source (crypto.getRandomValues), and appends a Luhn check digit so the full number sums correctly under the doubling rule used industry-wide.

Expiry dates are drawn a few months into the future so “card expired” errors do not fire during a normal test. CVV length is three digits for most brands and four for American Express. Spacing in the display (4-4-4-4 or Amex’s 4-6-5) is optional and only affects how the number is shown, copied, or exported — validation always strips non-digits first.

The Validate tab runs the reverse check: strip punctuation, require a length between 13 and 19 digits, then verify Luhn. It does not contact a bank, a fraud network, or any card scheme. Closing the tab clears what was in memory.

Frequently asked questions

Are these real credit cards?

No. They are random numbers with a correct Luhn digit and plausible brand prefixes. They cannot charge a real account.

Will a payment gateway accept them?

Many sandboxes accept any Luhn-valid number (or a published list of test PANs). Live/production gateways will decline them because no issuer stands behind the PAN. Always use your provider’s documented test cards when you need specific decline/success codes.

Is my data sent to a server?

No. Generation, validation, copy, and download happen on your device. Nothing from the result is placed in the URL.

Why include Elo and Hipercard?

Brazilian e-commerce often shows brand-specific fields or installment rules. Having local brands next to Visa and Mastercard makes checkout QA closer to production without inventing numbers by hand.

Can I use these numbers in production?

No. Use them only in development, staging, or automated tests. Production payments require a real instrument from the cardholder.

What does Luhn check?

It is a simple checksum: from the right, double every second digit, adjust values over nine, sum everything, and require a multiple of ten. It catches typos; it does not prove a card exists or has funds.