Credit Card Generator

Most credit card generators hand you one number at a time in whatever layout they picked, and you copy it, paste it, then do it again. This one is built for the job developers actually show up with: pour out a batch of Luhn-valid test numbers in the exact shape your code reads. Pick a network, set a count, and either copy them formatted your way or download a real CSV or JSON file with number, expiry, cvv, and network already split into columns. Up to 10,000 at a time, all generated in your browser.

The custom line format is the part that saves the most fiddling. Say your import script wants pipe-delimited {number} | {cvv}, or a semicolon layout your parser expects. You write that template once with the token buttons, and every card comes out in that shape, ready to paste into a seed file or a sheet, with no find-and-replace afterward.

These are test numbers. They pass a length check and the Luhn checksum, which is the whole point, they let you exercise the "is this a well-formed card?" path in your code. Nothing here can be charged: the expiry and the CVV are rolled at random, so an authorization fails before it gets anywhere near a balance, and you cannot slip past a paid trial that verifies a card.

One thing this page will not tell you, because it would not be true, is that the number itself was never issued to anybody. Read what a generated number can and cannot promise below before you paste one somewhere public.

1. Pick a card network. Visa, Mastercard, American Express, or Discover. The tool applies the correct starting digits (the IIN, sometimes called the BIN) and the right length, so Amex comes out fifteen digits with a four-digit code and the rest come out sixteen.
2. Set how many show on screen with the − and + buttons, from one up to a hundred. This is just the preview. The download can be far bigger.
3. Write your line format (optional). The default is {number} | {expiry} | {cvv}. Tap the token buttons to build your own, mixing in {spaced}, {mm}, {yy}, or {network}. The example under the box updates live.
4. Copy or download. Click any number to copy just that number, hit Copy all for the whole preview in your format, or open the download panel, choose CSV, JSON, or TXT, set a count up to 10,000, and save the file.

Nothing to install, no sign-up, no upload. Refresh the page and the list is gone.

A generator that only spits out grouped numbers makes you reformat before the data is usable, so the output side is where the work went.

Custom line format. The template reads seven tokens. {number} is the raw digits, {spaced} is the grouped display version, {expiry} is MM/YY, {mm} and {yy} are the halves if you keep them in separate fields, {cvv} is the security code, and {network} is the label like Visa or American Express. Any other text in the box stays literal, so you control the delimiters, quotes, and spacing. This same format drives both Copy all and the TXT download.

CSV export. A proper comma-separated file with a header row and four columns, number, expiry, cvv, network, ready to open straight in Excel or Google Sheets. A bare sixteen-digit number is read as a number by both of them, and both keep only fifteen significant digits, so the final digit gets rounded off, and the final digit is the Luhn check digit. So the export writes number, expiry, and cvv in the ="value" form, which Excel and Sheets both read as text. The check digit survives, MM/YY stays MM/YY instead of turning into a date, and a CVV of 007 keeps its leading zeros. The network label is quoted correctly too, so the columns never shift. A script reading the CSV gets that ="..." wrapper exactly as written, so reach for the JSON export when you are parsing it in code.

JSON export. An array of objects, one per card, keyed by number, expiry, cvv, and network. Drop it into a test fixture, a mock API response, or a seed script without parsing anything first.

Bulk volume. Up to 10,000 cards in a single file. Useful for stress-testing a schema, seeding a dev database with realistic-shaped rows, or feeding a fuzzer that wants variety instead of the same string over and over. It runs locally, so even a big export comes back right away.

Every card number ends in a check digit. It is a small built-in error catch, not part of the account, and it exists to catch the everyday typo. The rule behind it is the Luhn algorithm, named after Hans Peter Luhn, an IBM engineer who patented it in the 1950s. Double every second digit from the right, subtract nine from anything over nine, add it all up, and a valid number lands on a multiple of ten. Transpose two digits and the sum breaks, so a form can reject a fat-fingered entry before it ever bothers a bank.

Luhn tells you a number is well-formed. It says nothing about whether the number was ever issued, whether it is active, or whose it is. A string can pass Luhn and still map to no real card at all. Luhn is closer to a spell-check than a bank lookup, and that gap is what makes a generator like this harmless. Every number the tool shows is run back through a full Luhn pass before it appears, so a malformed one never reaches your screen.

The opening digits of a card are not random. They are the Issuer Identification Number, and the first six to eight identify the issuing institution, which is how a checkout can show the Visa or Mastercard logo the moment you have typed a handful of digits. This tool uses the real published ranges:

• Visa, starts with 4, sixteen digits.
• Mastercard, starts with 51 through 55, or the newer 2221 to 2720 range, sixteen digits.
• American Express, starts with 34 or 37, fifteen digits, with a four-digit code.
• Discover, starts with 6011, 65, or 644 to 649, sixteen digits.

Pick Amex and the number is shorter, grouped 4-6-5 instead of 4-4-4-4. That grouping is how Amex numbers are actually laid out.

Those are live ranges, currently issuing. That is deliberate, because a number under a made-up prefix would not exercise the network detection you are trying to test, and it is also the reason for the section that follows.

Read this once and you will know more than most generators will admit.

There is no reserved range. ISO/IEC 7812 sets aside no IIN for testing, and neither Visa, Mastercard, American Express nor Discover publishes a prefix that is guaranteed never to be issued. The first digit 9 is held for national standards bodies rather than for test data, and it carries no promise either. The only card numbers with a real guarantee behind them are the ones a payment processor publishes for its own sandbox, which is why the paragraph closing this section points you at those for gateway work.

So the arithmetic is what it is. A sixteen-digit Visa number is the digit 4, then fourteen free digits, then a check digit the Luhn rule fixes for you. That is exactly one hundred trillion possible numbers. Visa reported close to five billion credentials in force in 2025. Divide one into the other and roughly one generated Visa number in twenty thousand is an account somebody actually holds. American Express is tighter, two prefixes over twelve free digits against about 146 million cards, which lands nearer one in fourteen thousand. Pull a full ten thousand row export and there is around a two in five chance that one row in the file is a live account number.

What that does and does not mean. It does not mean you can charge anything, for the reason in the FAQ below. It does not make the file a data breach either, because a number with no name, no expiry and no CVV attached is not much on its own, and the same digits could as easily have come out of a dice roll. What it does mean is that "guaranteed fake" is a claim to stop repeating. Do not publish a generated number as proof that a number is safe, do not paste one into a public issue or a screenshot as if it could not be somebody's, and treat a large export as test data you keep rather than test data you post. If you need a number that genuinely belongs to nobody, there is only one source: your processor's published sandbox cards.

If you are integrating against a specific gateway, reach for that provider's own test cards rather than these. Stripe's 4242 4242 4242 4242, the classic 4111 1111 1111 1111, Mastercard's 5555 5555 5555 4444. Those are magic strings wired into the sandbox to force a set result, an approval, a decline, a 3-D Secure prompt, which a random valid number cannot trigger. Keep those for end-to-end API testing, and use this generator for your own client-side validation and bulk dummy data.