IBAN Validator

Check an IBAN's mod-97 checksum, country, and formatting — locally.

IBAN

✓ Valid IBAN

Country:: Germany (DE)
Formatted:: DE89 3704 0044 0532 0130 00

How IBAN validation works

An IBAN (International Bank Account Number) is validated with the ISO 7064 mod-97 checksum: move the first four characters to the end, replace each letter with two digits (A=10 … Z=35), then the whole number modulo 97 must equal 1. This runs entirely in your browser — your account number is never sent anywhere.

More validators: credit card, email, and IP address.

Built and maintained by Meet Shah · Last updated 24 July 2026

What this tool is used for

Checking a bank account number from an invoice before setting up a payment.
Confirming the country and length are consistent with the prefix.
Validating a batch of supplier IBANs before importing them into a finance system.
Producing the correctly spaced display form of an IBAN for a document.
Distinguishing a typo from an account the bank simply does not recognise.

How it works in practice

A worked example

An accounts-payable clerk is keying a supplier's IBAN from a PDF invoice into the payment run and wants any typo caught before the money leaves, not after.

Input

printed on the invoice   GB29 NWBK 6016 1331 9268 19
keyed, digits swapped    GB29 NWBK 6016 1331 9286 19
keyed, one digit short   GB29 NWBK 6016 1331 9268 1

Output

printed on the invoice   ✓ Valid IBAN
                         Country: United Kingdom (GB)
                         Formatted: GB29 NWBK 6016 1331 9268 19

keyed, digits swapped    ✗ Invalid
                         Checksum failed — the check digits don't match the account number.

keyed, one digit short   ✗ Invalid
                         Wrong length for United Kingdom (GB) — expected 22 characters, got 21.

The printed line is the example the SWIFT IBAN registry itself gives for the United Kingdom, so it passes. The second swaps two neighbouring digits, 68 for 86, and the check catches that by arithmetic rather than luck: exchanging adjacent digits a and b changes the rearranged number by 9 × (a − b) × a power of ten, and 97 is a prime that divides none of those factors, so the remainder can no longer be 1. The third never reaches that step. The United Kingdom's registered length is 22 characters, the tool counts 21 once the spaces are stripped, and the message names the country and both lengths, which points straight at a dropped digit.

The edge case that catches people

The country table decides the verdict before any arithmetic runs, and it holds all 89 countries in the current SWIFT registry, so the registry's own example for Oman, OM81 0180 0000 0129 9123 456, passes, as do those for Russia, Sudan and Yemen. A prefix outside the registry still fails at that first step, even when its digits add up. Some IBAN sites publish an experimental list of 22 further countries, mostly in Africa, and a Moroccan string such as MA64 0115 1900 0001 2050 0053 4921 passes mod-97, yet this tool reports that MA is not an IBAN country, because ISO 13616 does not list it. For a supplier there, ask the supplier's bank what an international transfer needs, usually an account number and a BIC, rather than trusting either verdict.

When not to use this tool

A pass here proves the characters are consistent, and it cannot tell you whose account they belong to. The check that catches a correct IBAN pointing at the wrong account, the classic invoice-fraud swap, is a name match, and banks now run one: across the euro area, Verification of Payee has been mandatory since 9 October 2025 and compares the name you enter with the holder of the IBAN before you authorise the transfer, while UK banks run Confirmation of Payee on the sort code and account number. When a supplier's details change by email, treat that bank check and a call to a number you already hold as the real validation, and this page as the typo filter in front of them.

Frequently Asked Questions

How is an IBAN checked?: By the mod-97 algorithm from ISO 13616: move the first four characters to the end, convert letters to numbers (A=10 … Z=35), and the resulting integer must leave a remainder of 1 when divided by 97.
Why mod 97 rather than a simpler checksum?: Because it catches essentially every single-character error and every transposition of adjacent characters — far stronger than Luhn. With a 1-in-97 chance of a random string passing, it is genuinely useful validation rather than a formality.
Are all IBANs the same length?: No, and assuming so is a common bug. Length is fixed PER COUNTRY: Norway is 15 characters, Germany 22, the UK 22, Malta 31. A validator must check the country's own registered length, not a single maximum.
Does a valid IBAN mean the account exists?: No. The checksum proves the digits are internally consistent and the country format is right. Whether the account exists, is open, or belongs to whom you think requires a bank-side check this cannot perform.
Should I store the spaces?: No. Spaces are a display convention in groups of four for readability; the canonical stored form has none. Strip whitespace and uppercase before validating or comparing, or identical accounts compare unequal.
Which countries actually use IBAN?: Most of Europe, much of the Middle East, and a growing number of countries in Africa and Latin America: 89 in the SWIFT registry as of 2026. The United States, Canada, Australia and Japan do not, which is why a payment form asking for an IBAN alone cannot handle a US account.
What is the BBAN inside an IBAN?: The Basic Bank Account Number — the country's own domestic format, wrapped by the country code and the two check digits. Its length and structure vary by country, which is why IBAN lengths range from 15 to 34 characters.

Common errors and gotchas

Reading a valid checksum as a valid account. Mod-97 catches transcription errors, not fabricated numbers.
Assuming a fixed length. Each country defines its own, and a correct IBAN can be anywhere from 15 to 34 characters.
Keeping the printed spaces when submitting, which some systems reject and others silently mangle.
Confusing the IBAN with the local account number embedded inside it, which is not interchangeable.
Treating a lower-case IBAN as invalid. It should be normalised to upper case rather than rejected.