Test IBANs

Before IBAN, sending money across a border was close to guesswork. Every country had grown its own way of naming an account — sort codes in Britain and Ireland, the Bankleitzahl in Germany, the RIB in France — and the formats had nothing in common, so the routing information a payment needed often went missing altogether. The codes banks exchanged under ISO 9362, the BIC or SWIFT code, carry no check digits at all, which meant a mistyped account number could not be caught before the money moved. Payments were delayed or returned, repairs were done by hand, and the cost came back to the banks and their customers.

ISO published a first answer, ISO 13616:1997. The European Committee for Banking Standards judged it too permissive to work and produced a slimmed-down version: upper-case letters only, and one fixed IBAN length per country. That version prevailed. ISO 13616:1997 was withdrawn in favour of ISO 13616:2003, the standard was split into two parts in 2007 — with part 2 naming SWIFT as the registration authority that maintains the IBAN Registry — and the current edition is ISO 13616:2020.

What makes the format work is a check-digit scheme borrowed from ISO/IEC 7064:2003, MOD 97-10. Move the first four characters to the back, replace every letter with a number from 10 to 35, read the result as a single integer, and divide by 97: a correct IBAN always leaves a remainder of 1. That one step is guaranteed to catch any character omitted, duplicated or mistyped, and any transposition of two characters.

European regulation did the rest. Regulation (EU) No 260/2012 set the technical and business requirements for euro credit transfers and direct debits, and in February 2014 the SEPA credit transfer scheme replaced the national schemes it had run alongside since 2008. Adoption spread well past the EU: by December 2024, 89 countries were using IBAN. The United States and Canada are not among them, which is why a payment there still needs an ABA routing or transit number.

Key properties

• An IBAN is at most 34 characters: a two-letter ISO 3166-1 country code, two check digits, then a Basic Bank Account Number of up to 30 country-specific alphanumeric characters.
• The check digits use ISO/IEC 7064 MOD 97-10. Move the first four characters to the end, replace each letter with a number (A = 10 … Z = 35), read the result as one integer, and a valid IBAN leaves a remainder of 1 when divided by 97.
• That rearranged integer runs past thirty digits — far beyond the 2^53−1 exact-integer range of a JavaScript number — so this page computes the remainder with arbitrary-precision arithmetic.
• Each country has exactly one IBAN length. For the countries here: Netherlands 18, Austria 20, Luxembourg 20, Switzerland 21, Germany 22, Ireland 22, United Kingdom 22.
• The mod-97 step is guaranteed to detect any single character that has been omitted, duplicated or mistyped, and any transposition of two characters.
• Only the digits 0–9 and the Latin letters A–Z are ever permitted, even in countries that do not write with the Latin alphabet. Whether letters appear in the BBAN is up to each country: the UK and Irish formats open with a four-letter bank identifier, the German BBAN is all digits.
• An IBAN is traditionally printed in groups of four characters and transmitted electronically without spaces. Burundi, Egypt, Libya and El Salvador are the registered exceptions to the grouping convention.
• Format validity says nothing about existence: a perfectly formed IBAN can correspond to no account at all, which is exactly what the values on this page are.

Where they turn up

• SEPA credit transfers and direct debits are addressed by IBAN; the credit transfer scheme replaced the national euro schemes in February 2014, and as of 2025 SEPA spans 41 countries.
• Payroll, invoicing and vendor-master forms validate IBANs client-side, so a typo is caught at the keyboard rather than after a failed payment.
• EPC QR codes — the scan-to-pay squares on European invoices, and the Swiss QR-bill — carry an IBAN as the payee field.
• Test suites and demo environments: because IBAN has no reserved test range, teams fall back on structurally valid, never-issued numbers like these for fixtures and screenshots.
• Invoice-redirection fraud works precisely because mod-97 cannot help. An attacker who swaps the IBAN on a PDF invoice supplies a perfectly valid one; the check digits prove only that the number was typed correctly, not that it belongs to your supplier.