Reference material for developers who test payment flows
Building a checkout is the easy part. Making sure it behaves correctly when a card number is mistyped, when a BIN is routed to the wrong network, when a gateway returns a soft decline, or when an auditor asks where your test data came from — that is where most payment integrations actually break. These guides cover the mechanics behind those situations, written for the engineers and QA analysts who have to reproduce them on purpose.
Every article here is about test data and test environments. Nothing on this site produces a usable payment instrument: the numbers our generators create are structurally valid but are not issued by any bank, are not linked to an account, and will be declined by every real processor. That distinction is the point — you want data that satisfies your validation layer without ever touching a live authorization network.
Card number anatomy
How the 12–19 digits of a payment card decompose into a Major Industry Identifier, an issuer identification number, an account identifier and a check digit — and why length and prefix alone are not enough to identify a network reliably.
- What Every Digit in a Card Number Means — the pillar page: PAN structure under ISO/IEC 7812, and how to store one safely
- The Luhn Algorithm — the mod-10 checksum, worked twice, with the errors it misses and the seven bugs implementations ship with
- Luhn Algorithm Code in Four Languages — executed implementations in JavaScript, Python, PHP and Ruby, with shared test vectors
- BIN and IIN: What Card Prefixes Tell You — allocation, BIN sponsorship, the six-to-eight-digit migration, and what a lookup reliably returns
- How Many Digits Is a Credit Card Number? — lengths by network and the validation and database bugs each one causes
- Card Brand Detection with Regex — boundary-tested patterns for nine networks, plus the detection order that matters
- What Is a CVV and Why Can’t It Be Calculated? — CVV1, CVV2, iCVV and dCVV, and why no formula derives any of them
Card networks
One network at a time, in full: prefixes, lengths, security codes, and the integration mistakes each one causes.
- Visa Card Number Format — why every Visa starts with 4, and the 13 and 19-digit formats most validators reject
- Mastercard Number Format — the 51–55 and 2221–2720 ranges, and the arithmetic behind those exact boundaries
- Amex Card Number Format — 15 digits, 4-6-5 grouping, a four-digit CID on the front, and why each deviation exists
Payment testing
Why our generated numbers are the wrong tool for testing an approval, a decline or a 3-D Secure challenge, and what to use instead.
- Payment Form Testing Checklist — 93 items across 13 sections, with the test data each one needs
- Stripe Test Card Numbers — every decline code, the 3-D Secure matrix, webhook verification and test clocks
- PayPal Sandbox Testing — sandbox accounts, the rejection triggers that force declines, and how Braintree differs
- Testing 3-D Secure and SCA — frictionless and challenge flows, the PSD2 exemptions, and the webhook race condition
- Why Test Cards Fail on Real Payment Systems — the four layers of card validation, and which one a generated number can never clear
Compliance and security
What the rules actually require when your test fixtures look like card data, and what the numbers on this site can and cannot do.
- PCI DSS for Developers — what you may store, what is prohibited outright, and where card data leaks by accident
- Card Tokenization Explained — gateway versus network tokens, and why a token does not zero your PCI scope
- Test Data Management for QA Teams — four approaches compared, the masking trap, and making test runs reproducible
- Is Generating Test Card Numbers Legal? — where the line falls, with statutes across nine jurisdictions
- How Card Fraud Works, and How to Stay Safe — where stolen card data comes from, and the steps that reduce your exposure
- Do Credit Card Numbers That Work Exist? — the seven conditions an authorisation requires, none of which a generator satisfies
- What Credit Card Generators Actually Do — the whole algorithm in fifteen lines, and how to tell a test tool from a malware front
- Why a Card Number Cannot Carry a Balance — authorisation, settlement, and where the money actually sits
- Free Trial Cards: What Actually Works — why generated numbers fail at signup, and the alternatives that do not
Each guide is dated and revised when payment network rules change. If you need the data rather than the theory, the tool directory lists every generator on the site, and the FAQ covers the questions that come up before you have read any of this.