IBAN Validator

About IBAN Validator

IBAN Structure

An IBAN consists of four parts, always in the same order:

Part	Length	Content	Example (GB)
Country code	2 letters	ISO 3166-1 alpha-2	GB
Check digits	2 digits	Mod-97 checksum	29
BBAN	Country-specific	Bank code + account number	NWBK 6016 1331 9268 19

The full IBAN is written in groups of four characters with a space between each group for readability: GB29 NWBK 6016 1331 9268 19. When transmitted electronically, spaces are removed.

How the Mod-97 Checksum Works

The validation algorithm has four steps:

Step	Action	Example (GB29NWBK60161331926819)
1	Move first 4 characters to end	NWBK60161331926819GB29
2	Convert letters to numbers (A=10, B=11...Z=35)	232311601613319268191611 29
3	Compute remainder: number mod 97	232311601613319268191611 29 mod 97
4	Valid if remainder = 1	Remainder = 1 (valid)

The mod-97 check detects all single-character substitution errors, all single transpositions of adjacent characters, and most other common typos. The error detection rate is approximately 97 in 100 for random errors.

IBAN Lengths by Country

Country	Code	IBAN Length	BBAN Format
United Kingdom	GB	22	4-char bank code + 6-digit sort code + 8-digit account
Germany	DE	22	8-digit bank code + 10-digit account
France	FR	27	5-digit bank + 5-digit branch + 11-char account + 2-digit key
Spain	ES	24	4-digit bank + 4-digit branch + 2-digit check + 10-digit account
Italy	IT	27	1-char check + 5-digit bank + 5-digit branch + 12-char account
Netherlands	NL	18	4-char bank code + 10-digit account
Switzerland	CH	21	5-digit bank + 12-char account
Belgium	BE	16	3-digit bank + 7-digit account + 2-digit check
Austria	AT	20	5-digit bank + 11-digit account
Portugal	PT	25	4-digit bank + 4-digit branch + 11-digit account + 2-digit check
Saudi Arabia	SA	24	2-digit bank + 18-char account
Brazil	BR	29	8-digit bank + 5-digit branch + 10-digit account + 1-char type + 1-char owner

Over 80 countries use the IBAN system. The shortest IBANs are 15 characters (Norway) and the longest are 34 characters (Saint Lucia, Jordan). The United States and Canada do not use IBANs - they use ABA routing numbers and account numbers instead.

IBAN vs Other Banking Identifiers

Identifier	Purpose	Format	Used In
IBAN	Identifies a specific bank account	Country code + check digits + BBAN	Europe, Middle East, parts of Africa/South America
SWIFT/BIC	Identifies a bank (not an account)	8 or 11 characters (e.g., NWBKGB2L)	Worldwide
ABA Routing Number	Identifies a US bank	9 digits	United States
Sort Code	Identifies a UK bank branch	6 digits (XX-XX-XX)	United Kingdom, Ireland
BSB Number	Identifies an Australian bank branch	6 digits	Australia

For international wire transfers, you typically need both the IBAN (to identify the account) and the SWIFT/BIC code (to identify the bank). Within the SEPA zone (EU + EEA + UK), the IBAN alone is sufficient for euro transfers.

Common IBAN Errors

Most invalid IBANs come from five recurring mistakes, all catchable by either the length check or the mod-97 algorithm.

Error	Example	How to Fix
Wrong length	GB29NWBK601613319268 (too short)	Check all digits are included - UK IBANs are 22 characters
Transposed digits	Two adjacent digits swapped	The mod-97 check will catch this - re-enter carefully
Spaces in wrong places	Spaces break electronic processing	Remove all spaces when entering into banking systems
O/0 or I/1 confusion	Letter O read as digit 0	IBANs start with 2 letters (country code), rest varies by country
Invalid country code	XX29NWBK...	First 2 characters must be a valid ISO 3166-1 country code

Worked Example: Validating GB82 WEST 1234 5698 7654 32

The canonical GB test IBAN from the ISO 13616 specification walks through every step cleanly. Take GB82WEST12345698765432 and work it by hand:

Step 1 - Move the first four characters to the end. GB82WEST12345698765432 becomes WEST12345698765432GB82.

Step 2 - Replace each letter with two digits using A=10, B=11, ..., Z=35. W=32, E=14, S=28, T=29, G=16, B=11. The string becomes 3214282912345698765432161182.

Step 3 - Compute the 28-digit number mod 97. Because the number exceeds the 64-bit integer range, the standard trick is to process it left-to-right, taking the running remainder mod 97 after each digit: 3 mod 97 = 3, 32 mod 97 = 32, 321 mod 97 = 30, ..., final remainder = 1.

Step 4 - A remainder of 1 means the IBAN is valid. Any other remainder means at least one digit is wrong. This is the exact algorithm the tool uses, implemented in a single streaming loop so arbitrarily long IBANs (up to 34 characters for Saint Lucia and Jordan) never overflow.

How Reliable Is the Mod-97 Check?

The mod-97 check catches all single-digit substitution errors and all single transpositions of adjacent characters, which together account for the majority of keying mistakes in published error-pattern research on account numbers. For random two-error combinations it fails about 1 time in 97, giving an overall error-detection rate above 98% on realistic typo distributions. That is strong but not absolute - a valid IBAN means the number is well-formed and internally consistent, not that an account at that number actually exists. Only the receiving bank can confirm that. Payment-initiation standards such as ISO 20022 pain.001 still require IBAN validation at submission time because the cost of a rejected SEPA transfer (typically EUR 5-20 plus a 1-3 business day delay) is far higher than running the check.

IBAN vs US Routing and Account Numbers

The United States and Canada do not use IBAN. US domestic payments use a 9-digit ABA routing number plus a variable-length account number. The ABA routing number has its own checksum: weight digits 1, 4, 7 by 3; digits 2, 5, 8 by 7; digits 3, 6, 9 by 1; the weighted sum must be divisible by 10. This is weaker than mod-97 and catches fewer transposition errors, which is one reason the EU moved to IBAN during the SEPA rollout starting in 2008. For international wires from a US sender to an IBAN-using country, the Federal Reserve and SWIFT require both the IBAN and the recipient bank's BIC in the beneficiary field of the FedWire or SWIFT MT103 message.

SEPA, SWIFT, and Why IBAN Alone Is Sometimes Enough

Inside the SEPA zone (36 countries as of 2024 - the 27 EU member states plus the UK, Iceland, Liechtenstein, Norway, Switzerland, Monaco, San Marino, Andorra, Vatican City), an IBAN alone is sufficient for euro-denominated credit transfers and direct debits. Banks derive the BIC from the IBAN automatically using the IBAN Plus directory maintained by SWIFT. Since February 2016 the European Payments Council has banned "IBAN discrimination" - a business inside SEPA must accept a valid IBAN from any SEPA country on the same terms as a domestic one, per EU Regulation 260/2012.

Outside SEPA, or for non-euro currencies, you usually still need the BIC. A SWIFT MT103 message to a Saudi Arabian SAR account, for example, carries the beneficiary IBAN in field 59 and the beneficiary BIC in field 57A. For related-account lookups, our UUID Generator produces identifiers for internal systems, and the Hash Generator can SHA-256 an IBAN for privacy-preserving database lookups without storing the plaintext number.

Storing and Transmitting IBANs Safely

IBANs are classified as personal financial data under GDPR Article 4(1) in the EU and under the Data Protection Act 2018 in the UK. The ICO treats an IBAN as capable of identifying an individual when combined with a name, so its storage requires a lawful basis and appropriate safeguards. In practice this means encrypting IBANs at rest (AES-256 is the PCI DSS standard carried over), masking them in UIs (showing only GB29 **** **** **** **** 19), and never logging them in plaintext. The PCI DSS v4.0.1 handling rules for PANs apply by analogy to IBANs when processed by payment service providers. For quick format-level checks that do not require transmitting the number, client-side tools like this validator are preferable to server round-trips.

Validating IBANs in Code

Every major language has a battle-tested IBAN library that wraps the ISO 13616 rules:

Language	Library	Notes
JavaScript/TypeScript	ibantools	Per-country BBAN regex, mod-97, BIC extraction
Python	python-stdnum	Validates IBAN plus 200+ other identifiers
Java	iban4j	Builder API, country registry, mod-97
Ruby	iban-tools	Lightweight validator, no external calls
PHP	php-iban	Maintained fork of the original Globalcitizen library
Go	jbub/go-iban	Minimal, zero dependencies

All of these follow the same pattern: strip whitespace, uppercase, check length against the per-country registry, rearrange, letter-to-digit map, mod 97. Rolling your own is straightforward but the libraries keep the country registry up to date - new countries have been added as recently as 2022 (Burundi BI, 27 characters) and 2023 (Djibouti DJ, 27 characters), so a hard-coded list will drift. For related validation workflows, the Credit Card Validator uses the Luhn algorithm on PANs, which is weaker than mod-97 (single-digit detection but only catches 9 of 10 transposition types).

Sources

• ISO 13616-1:2020 - Financial services - IBAN, Part 1: Structure
• SWIFT - IBAN Registry and country BBAN formats
• European Payments Council - SEPA Credit Transfer scheme
• EU Regulation 260/2012 - SEPA end-date and IBAN non-discrimination
• US Federal Reserve - ABA Routing Number Directory
• ICO - What is personal data under UK GDPR
• PCI Security Standards Council - PCI DSS v4.0.1