Credit Card Regex Tester

Credit Card Regex Tester

Test and validate credit-card patterns with this specialized regex tester. Includes tested patterns and real-time matching.

Recommended Credit-card Pattern

``regex ^\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}$ `

Test Examples

Valid matches:

• 4111111111111111
• 4111-1111-1111-1111
• 4111 1111 1111 1111

• 411111111111111
• 4111-1111-1111
• abcd-efgh-ijkl-mnop

1. ^\d{16}$ 2. ^(?:\d{4}[- ]?){4}$

How to Use

1. The pattern above is preloaded—or enter your own 2. Add test strings to validate 3. See real-time match highlights 4. Copy the pattern for your code

Regex Quick Reference

The Pattern

`regex ^(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|3[47]\d{13}|6(?:011|5\d{2})\d{12})$ `

Flags: gm — m makes ^ and $ match at each line break, so the pattern can be tested against a list.

Broken Down

Tested Against Real Input

The Important Caveat

Matching the shape is not validation — run the Luhn checksum as well. And never log, store or transmit a card number you matched; PCI DSS scope follows the data.

Using It

`javascript const pattern = /^(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|3[47]\d{13}|6(?:011|5\d{2})\d{12})$/gm;

// Test a single value — reset lastIndex first if the pattern is global pattern.lastIndex = 0; const isValid = pattern.test(value);

// Or find every match in a block of text const matches = [...text.matchAll(pattern)]; `

A global regex carries lastIndex between calls, so reusing one across test() calls returns alternating results. Either drop the g flag for validation or reset it each time.

Anchors, Greediness and Backtracking

Three behaviours account for most regex surprises, and this pattern shows all three.

Anchors. ^ and $ pin the match to the start and end of the input. Without them, \d{3} matches the 123 inside abc123def. With m in the flags — as here — they pin to each *line* instead, which is what lets one pattern be tested against a list.

Greediness. .* takes as much as it can and gives back only when forced; .*? takes as little as possible. On , the pattern <.*> matches the whole string and <.*?> matches just .

Backtracking. When a match fails, the engine reverses and tries other splits. Nested quantifiers like (a+)+ make that exponential, and a 30-character input can hang a server — a class of denial of service known as ReDoS. Avoid nesting quantifiers, and prefer explicit character classes over . wherever you can.

Testing It Properly

`javascript const pattern = /^(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|3[47]\d{13}|6(?:011|5\d{2})\d{12})$/gm;

// A global regex keeps lastIndex between calls, so reusing one across // test() calls returns alternating true/false on the same input. pattern.lastIndex = 0;

// Named groups make the result readable const named = /(?\d{4})-(?\d{2})/; const { groups } = '2026-08'.match(named); `

Write the failing cases first. A pattern that accepts everything valid is easy; one that also rejects everything invalid is the hard half, and it is where the bugs are.

When Not to Use a Regex

Structured formats have parsers, and the parser is always more correct: new URL() for URLs, DOMParser for HTML, JSON.parse` for JSON, a date library for dates. Reach for a regex to *find* things in unstructured text, not to validate something a parser understands.