★ Identity & contact · regex

Regex for Credit Card Number Format

Checks the shape of a card number as typed: 16 digits optionally grouped by spaces or hyphens, or a 15-digit American Express number grouped 4-6-5. It does not run the Luhn checksum and says nothing about whether a card is real.

Runs in your browser
No signup

Try the credit card number format pattern

Read it in plain English (best-effort)

^start of a line
(?:start a group (not captured)
(?:start a group (not captured)
\da digit (0–9)
{4}exactly 4 of the previous
[ -]one character from: space, '-'
?the previous is optional
)end of group
{3}exactly 3 of the previous
\da digit (0–9)
{4}exactly 4 of the previous
|or
3the character '3'
[47]one character from: '4', '7'
\da digit (0–9)
{2}exactly 2 of the previous
[ -]one character from: space, '-'
?the previous is optional
\da digit (0–9)
{6}exactly 6 of the previous
[ -]one character from: space, '-'
?the previous is optional
\da digit (0–9)
{5}exactly 5 of the previous
)end of group
$end of a line

Test text

One sample per line works well with the m flag on anchored patterns.

Waiting for a pattern

The pattern, piece by piece

/^(?:(?:\d{4}[ -]?){3}\d{4}|3[47]\d{2}[ -]?\d{6}[ -]?\d{5})$/

Pattern explanation
Part	What it does
`(?:\d{4}[ -]?){3}\d{4}`	16 digits in four groups, optional space or hyphen between
`\|`	or
`3[47]\d{2}`	Amex starts with 34 or 37
`[ -]?\d{6}[ -]?\d{5}`	then 6 and 5 digits (the 4-6-5 grouping)

What it accepts and rejects

Every sample below is checked automatically in JavaScript and Python. The tester above is preloaded with all of them, one per line.

Should match
Should match
`4111111111111111`	✓
`4111 1111 1111 1111`	✓
`5500-0000-0000-0004`	✓
`378282246310005`	✓
`3782 822463 10005`	✓
`6011000990139424`	✓

Should not match
Should not match
`4111 1111 1111 111`	✗
`411111111111111a`	✗
`1234`	✗
`4111_1111_1111_1111`	✗
`3782 8224 6310 005`	✗
`41111111111111111`	✗

Copy it into your code

RE2-safeNo lookarounds or backreferences, so the same pattern works in Go's RE2 engine and in Rust's regex crate.

Language

const creditCardFormatRe = /^(?:(?:\d{4}[ -]?){3}\d{4}|3[47]\d{2}[ -]?\d{6}[ -]?\d{5})$/;

export function isValidCreditCardFormat(value) {
  return creditCardFormatRe.test(value.trim());
}

When not to use regex for this

Don't build card validation yourself. Use your payment provider's hosted fields (Stripe Elements, Razorpay Checkout): they validate, detect the brand and keep raw card numbers off your servers, which keeps you out of most PCI scope.

Questions engineers actually ask

Does it check the Luhn digit?

No. Luhn is arithmetic, not a pattern; run it in code after the format check, or let your payment provider do it.

Should I store card numbers?

No. Let the payment provider tokenise them; storing raw numbers brings heavy PCI DSS obligations.

What is catastrophic backtracking?

Some patterns, usually nested quantifiers like (a+)+, make a backtracking engine try an exponential number of paths on input that almost matches. The tester stops any run after 300ms, so a bad pattern can't freeze your tab. In production, that same pattern can take down a server (a ReDoS attack).

More identity & contact patterns

Or browse the full regex library.

More from the workbench

09 · Dev utilitiesJSON to TypesPaste JSON, get TypeScript, Zod, Pydantic, Go, Rust, JSON Schema, Prisma or GraphQL.10 · Dev utilitiesCron Expression BuilderBuild or explain a cron expression, with the next run times and platform quirks.07 · AI & LLMsToken CounterToken counts per model, cost per call and how much of the context window you are using.

Fine print

Tools: on the house.
Engineer: by the hour.

The regex was free. Code that doesn't need one is the upgrade: typed schemas, validated once at the edge, trusted everywhere after.

I'm Himanshu, an AI and full-stack engineer. I build MVPs, AI agents and the growth plumbing around them for early-stage startups.

Hire me →My projects