IBAN validator
An IBAN carries two check digits computed over the whole number modulo 97. Those two digits catch essentially every typo and transposition — which is exactly why a bank transfer form should test them before anything leaves.
Spaces are ignored. Any of the 30+ countries in the ISO 13616 register is accepted.
How the check works
- 1
Country and length are read first
The first two letters give the country; each country has one fixed IBAN length — 22 for Germany, 27 for France, 24 for Spain, 27 for Italy. A wrong length is rejected before any arithmetic.
- 2
The number is rearranged and converted
The first four characters move to the end, then every letter becomes a number (A=10 … Z=35). What remains is one very large integer.
- 3
That integer must be congruent to 1 modulo 97
This is ISO 7064 mod-97-10. Any single wrong character, and almost any pair of swapped characters, breaks the congruence.
A valid IBAN is not an open account
The check digits prove the number is internally consistent. They say nothing about whether the account exists, whether it is open, or whose name is on it. Only the receiving bank knows — and under SEPA rules a transfer is executed on the IBAN alone, the account name is not checked in most countries.
That gap is exactly what invoice-fraud attacks exploit: a plausible IBAN in a modified invoice passes every format check on the way.
SEPA is not the same as the European Union
The SEPA zone covers the 27 EU member states plus Norway, Iceland, Liechtenstein, Switzerland, Monaco, San Marino, Andorra and the United Kingdom. A Swiss IBAN is therefore a SEPA IBAN even though Switzerland is outside the EU — which changes the fees and the execution deadline, not the format.
Frequently asked questions
How are the two check digits computed?
Move the country code and the two check digits to the end, replace them with '00', convert letters to numbers (A=10 to Z=35), read the result as one integer, and take 98 minus that integer modulo 97. The result, padded to two digits, is the key.
Why do IBAN lengths differ by country?
Because the IBAN wraps each country's pre-existing national account number, the BBAN. Norway's fits in 11 characters, Malta's needs 31. The IBAN standard did not unify national formats; it added a country code and a check on top of them.
Can an IBAN contain letters after the country code?
Yes, and it is normal. Dutch, Irish and British IBANs embed a four-letter bank code; French IBANs may carry a letter inside the account number. Only the two check digits at positions 3 and 4 are always numeric.
Is checking the IBAN enough to secure a payment?
No. It rules out typos, not fraud. For an invoice from a new supplier, confirm the account by a channel other than the one that carried the invoice — a phone call to a known number, not the one printed on the document.
The same check over API
This tool runs in your browser. To run the same check from your code, in bulk or server-side, the API answers in JSON.
Read the documentation