IBAN check — ISO 13616 Mod 97 international bank account validator

What IBAN numbers actually reveal

An IBAN (International Bank Account Number) uniquely identifies a bank account: country code, check digits, and the BBAN (Basic Bank Account Number) including branch and account identifiers. Alone it locates an account precisely enough to receive a transfer. Combined with a name or address, it becomes usable material for social engineering, fraudulent payment instructions, and account impersonation.

In fintech, e-commerce back-ends, and accounting systems, IBANs are collected in bulk from customers and suppliers. Sending those lists to an external validation endpoint in order to check their format hands account numbers to a third party — which is an unusual risk for a task that is pure arithmetic.

The structural problem with online IBAN validation APIs

Many IBAN validation APIs log each request for a retention window. Some terms of service grant the operator rights to use submitted data for analytics or model training. If your application pipes IBANs through a validation API without telling account holders, that transmission may conflict with data-minimisation requirements under GDPR or similar frameworks.

The mismatch is worth pausing on: you are sending sensitive financial identifiers to an external server to verify a checksum that requires no external knowledge. The Mod 97 calculation and the country-length table are both fully public — there is no reason the validation has to leave your machine.

How BigInt arithmetic keeps everything in the browser

IBAN validation is two steps: compare the length against a per-country table (80+ countries are bundled as static data), then run the Mod 97 checksum — move the country code and check digits to the end, convert letters A–Z to 10–35, treat the result as one large integer, and confirm it is divisible by 97. This tool performs both steps with JavaScript’s BigInt inside your browser.

After the initial page load, no further network requests are made. You can verify this by opening DevTools Network while running a batch of IBANs — the tab stays quiet. Internal account lists and customer data stay on your device throughout.

Cleaning a supplier or customer list before payment runs

The most common workflow is validating a list received from a supplier or exported from a registration form. Formatting noise (spaces, dashes, lowercase) is stripped automatically, so no preprocessing is needed. Each invalid row shows a specific failure reason — wrong length, Mod 97 failure, or unrecognised country prefix — so you can triage before the payment run rather than after. Downloading the results as CSV lets you cross-reference against your source data and resolve issues upstream of your bank, avoiding return-payment fees and delays.

The math behind ISO 13616 / Mod 97-10

IBAN’s checksum derives from the Mod 97-10 algorithm in ISO/IEC 7064. The procedure: (a) move the first four characters — two-letter country code plus two check digits — to the end; (b) convert all letters to numbers (A=10, B=11, …, Z=35) and concatenate to form one large integer; (c) divide by 97 and confirm the remainder is 1. For DE89370400440532013000, that becomes 370400440532013000DE89 → 370400440532013000131489, which mod 97 equals 1.

The choice of 97 is intentional: it is prime, and Mod 97-10 catches 100% of single-digit transcription errors and roughly 99.99% of adjacent digit transpositions — the two most common human mistakes when copying a long number. That detection rate is materially better than the luhn-check algorithm (Mod 10) used for credit-card numbers, at the cost of arithmetic over larger integers. This tool uses JavaScript BigInt because IBANs reach 30+ digits, far beyond the safe-integer range of the Number type.

SEPA, SWIFT/BIC, and per-country BBAN structures

IBAN was created by the European Banking Association and is now standardised as ISO 13616. SEPA (Single Euro Payments Area) requires IBAN for all cross-border euro payments. The United States, Canada, and Japan do not use IBAN; payments to those countries combine SWIFT/BIC with a separate, country-specific account number format.

BBAN (Basic Bank Account Number) layouts vary completely across countries. Germany’s BBAN is an 8-digit bank code plus 10-digit account number; the UK uses a 4-character bank code, 6-digit sort code, and 8-digit account number; France adds a 2-digit RIB key to the bank and branch codes. Reading those internals correctly requires per-country specifications. This tool validates the IBAN’s length and Mod 97 checksum, but it does not decompose the BBAN into bank and branch components or look up the institution name. For that, a country-specific bank registry such as ibantools is a useful next step. Pairing the IBAN list with billing-contact checks via email-validate is a complementary hygiene pass.