IBAN Validator: Verify & Bulk-Check Bank IBANs

Validate any IBAN offline against the official ISO 13616 algorithm — the mod-97 checksum plus each country's own length and BBAN structure — and get back a clear, typed reason the moment one fails.

What it does

Every IBAN encodes a country-specific length and structure, plus a 2-digit checksum computed from the rest of the number (ISO 7064 MOD 97-10). This server checks both, entirely offline: no bank API, no network call, no data leaves the request. It is deterministic — the same input always returns the same result — and instant, since the whole check is arithmetic plus a lookup against a bundled public reference table covering roughly 76 countries.

Who it's for

Finance teams. Before a SEPA payment run, validate the supplier IBAN column and get a per-row reason, so a transposed digit is caught before the bank rejects the batch.

Compliance and KYB. Confirm a counterparty's stated IBAN is structurally genuine and note whether the country is a SEPA participant, as one input to an onboarding file.

Developers and AI agents. Call validate_iban in a vendor-onboarding form and return the specific failure — wrong country, wrong length, failed checksum — rather than a generic "invalid".

When to use it, and when not to

Use it to check that an IBAN is correctly formed for its country: checksum, length, structure and SEPA membership, offline and instantly.

Do not use it to confirm an account exists or belongs to a particular person. No offline check can establish that, and this one does not try. It also does not look up bank names or BICs — that needs a licensed bank directory this server deliberately does not claim to have.

Why it's built this way

• Honest about why it failed — most checkers return one flat true/false. This one reports a status naming the exact failure: INVALID_CHECKSUM (right shape, wrong check digits — likely a typo), INVALID_STRUCTURE, INVALID_LENGTH, INVALID_COUNTRY, or INVALID_INPUT.
• Offline and instant — no bank API, no rate limits, no per-provider dependency. A 1,000-IBAN batch is arithmetic, not network calls.
• Input-tolerant — accepts messy real-world formatting (gb29 nwbk 6016 1331 9268 19, mixed case) and normalizes it automatically.
• Bulk-ready — validate up to 1,000 IBANs in one call, one typed result per input, in order. A single bad entry never fails the batch.
• Nothing stored — every check is computed in memory against the bundled registry and discarded; nothing is logged or retained between calls.

Tools

validate_iban — validate one IBAN against the ISO 13616 checksum and its country's BBAN structure.

{ "iban": "GB29NWBK60161331926819" }

{
  "input": "GB29NWBK60161331926819",
  "valid": true,
  "countryCode": "GB",
  "checkDigits": "29",
  "structureValid": true,
  "checkDigitsValid": true,
  "sepaCountry": true,
  "printFormat": "GB29 NWBK 6016 1331 9268 19",
  "status": "VALID"
}

status is one of VALID, INVALID_CHECKSUM, INVALID_STRUCTURE, INVALID_LENGTH, INVALID_COUNTRY, or INVALID_INPUT — never collapsed into one generic failure.

bulk_check_iban — validate up to 1,000 IBANs in one call; returns one result per IBAN plus a status-count summary.

{ "ibans": ["GB29NWBK60161331926819", "DE89370400440532013000"] }

Returns { results: [...], summary: { total, valid, invalid_checksum, invalid_structure, invalid_length, invalid_country, invalid_input } }.

FAQ

Is this IBAN valid? Call validate_iban. valid: true (and status: "VALID") means it passed every check. Read status, not just valid — it tells you exactly what is wrong when it is not.

What is an IBAN check digit? The 2 digits right after the country code (the 29 in GB29...). They are computed from the rest of the IBAN via ISO 7064 MOD 97-10. A single mistyped character almost always breaks this — exactly what checkDigitsValid: false catches, offline.

Does it cover SEPA? Yes — every result includes sepaCountry, flagging whether the country is one of the 36 official SEPA scheme participants.

Trust & limits

Every check runs entirely offline against a bundled, public reference table — no bank API, no external service, nothing stored beyond the response. This is validation only: it confirms an IBAN's structure and checksum are correct, not that the account exists, is open, or belongs to a particular name — that requires the receiving bank itself.