IBAN Validator and Parser

A national account number with a wrapper

An IBAN is not a new kind of account number. It is the existing domestic account number, called the BBAN, with four characters bolted onto the front: a two-letter ISO 3166 country code and two check digits. Everything after those four characters is whatever the national banking system already used, which is why length varies so much. A Norwegian IBAN is 15 characters and a Maltese one is 31, and both are perfectly correct.

That variability is the first real validation step, and the one people most often skip. Each country registers an exact total length with SWIFT, and the length is fixed rather than a maximum. A German IBAN is always 22 characters. If you receive a 21-character string starting with DE, it is wrong no matter what the checksum says, because a transposition that shortens the string cannot be caught by a checksum that never sees the missing character. Checking the country length first also produces a far more useful error message than a generic checksum failure.

The MOD 97-10 checksum

The checksum comes from ISO 7064 and is elegantly simple. Move the first four characters to the end, replace every letter with a number where A is 10 through Z is 35, then read the whole thing as one enormous integer. If that integer leaves a remainder of exactly 1 when divided by 97, the IBAN passes.

The catch is that the resulting number is far larger than any language's native integer type, often eighty digits or more. Rather than reach for a bignum library, implementations reduce it piecewise: walk the string left to right, and after each digit keep only the running value modulo 97. Because modular arithmetic distributes over the digit-by-digit construction, the final remainder is identical to what you would get from the full number, and it costs a single pass with no allocation. That is exactly what this tool does.

MOD 97-10 was chosen because it is unusually strong for a two-character check. It catches every single-character substitution, every transposition of two adjacent characters, and the overwhelming majority of longer scrambles. The error modes it cannot see are rare enough that the remaining risk is dominated by the account simply not existing.

What a valid IBAN does not tell you

Structural validity is not existence. A checksum-correct IBAN can point at a closed account, an account that was never opened, or a bank that has since merged out of existence. The only way to know that money will arrive is to attempt the transfer or use a bank-provided verification service. Treat validation as a way to catch typos at the point of entry, not as confirmation that a payee is real.

Formatting also deserves care. The registry defines the electronic form as one unbroken string with no spaces, and that is what you must send in a payment file or store in a database. The grouped form in fours exists only for printing on paper, where it helps humans copy long strings accurately. Normalise on input, store flat, and add the spaces back only for display.