Loading page
About this tool
Card number format regex by network — Visa, Mastercard, Amex, RuPay, Discover, JCB, Diners — for formatting and masking, not verification.
This library provides card number format regular expressions by network — Visa (13/16/19 digits, prefix 4), Mastercard including the 2221–2720 series added in 2016, American Express (15 digits, 34/37), RuPay, Discover, JCB and Diners Club — for input formatting, masking and network badges, explicitly not verification. It also demonstrates ISO 7813-style display grouping (4-4-4-4, Amex 4-6-5, Diners 4-6-4) and PCI-style masking that shows only the last four digits.
Open Regex Library for Card Formats on AltFTool — it loads instantly in your browser.
Paste your code or data sample into the workspace.
Pick the format, conversion, or analysis you need.
Copy the polished result straight back into your project.
The 2221–2720 range is encoded precisely — patterns that only check 51–55 reject millions of real cards.
Grouping follows the embossing convention per length, and masking shows only the last 4 digits.
The RuPay/Discover 65-prefix collision is surfaced instead of silently resolved wrong.
^4[0-9]{12}(?:[0-9]{3})?(?:[0-9]{3})?$ — a leading 4 followed by 12 more digits, optionally extended to 16 or 19 digits. It identifies the format only; it does not run a Luhn check or confirm the card exists, so use it for UI hints, not validation of payment ability.
Match the leading digits against each network's IIN ranges: 4 is Visa, 51–55 and 2221–2720 are Mastercard, 34/37 are Amex, 6011/65 are Discover, 3528–3589 are JCB, 300–305/36/38 are Diners, and RuPay uses 508, 60, 65, 81 and 82. Some ranges collide — 65 is both RuPay and Discover — so a regex gives a hint while an up-to-date BIN database gives the answer.
Because format-valid numbers are trivially fake: a regex cannot run the Luhn checksum, look up the issuer, or know whether the account is open. Real validation happens at authorisation time through a PCI DSS-certified payment gateway; client-side patterns should only drive formatting, masking and network badges.
PCI DSS Requirement 3.3 allows displaying at most the first 6 and last 4 digits; the common safe default is last-4 only, rendered with the network's grouping, like •••• •••• •••• 1111 for a 16-digit card or •••• •••••• •0005 for a 15-digit Amex. Everything else should be masked at rest and in logs.