Credit Card Number Validator

Validate payment card numbers: Luhn checksum, length, brand (Visa, Mastercard, JCB, Amex, UnionPay, NAPAS…), Vietnamese NAPAS issuing bank and a masked form.

Result

Press “Run” to see the result.

The card check API validates the format of a payment card number before you send it to a payment gateway. It runs the Luhn checksum, detects the brand from the number’s prefix (Visa, Mastercard including the 2-series, American Express, JCB, Discover, Diners Club, UnionPay, Mir, Maestro and NAPAS domestic cards starting with 9704) and checks the length expected for that brand.

For Vietnamese NAPAS cards the issuing bank is read from the 6-digit BIN (970436 → Vietcombank, 970415 → VietinBank…), using the same bank list as the VietQR API. The response also gives the masked number (first 6 and last 4 digits) for display and logs, and the CVC length of the brand.

Format check only: it does not tell whether a card exists, is active or has funds. The number is processed in memory and is never stored, logged or cached. Never send CVC codes or expiry dates. Handling full card numbers on your own servers brings PCI DSS obligations; prefer tokenisation by your payment provider in production.

Use this in your code

curl -X POST "https://apibox.io.vn/v1/card-check" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"number":"9704 3666 1458 1234"}'

const res = await fetch('https://apibox.io.vn/v1/card-check', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "number": "9704 3666 1458 1234"
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/card-check",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"number": "9704 3666 1458 1234"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/card-check');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"number":"9704 3666 1458 1234"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Does a valid result mean the card works?

No. It only means the number is well-formed. Only the card network or your payment provider can authorise it.

Which Vietnamese cards are recognised?

NAPAS domestic debit cards (BIN 9704xx, 16 or 19 digits) with the issuing bank; international Visa / Mastercard / JCB cards issued in Vietnam are detected by brand.

Is it safe to send card numbers?

They are not stored or logged, and responses are not cached. Still, send them only over HTTPS POST, and never send CVC or expiry.