Skip to content
CardTools
Tools

EMV chip

TLV parser Bit fields IAC vs TVR CVM list Status words AID lookup EMVCo QR

ISO 8583

MTI decoder Bitmap decoder DE reference POS entry mode AVS & CVV

Card numbers

PAN validator Luhn calculator Track parser ARN decoder

Reference

Minor units Country codes Data converter 3DS codes
About Privacy

Your data stays in your browser

There is nowhere for it to go. That is a property of how this site is built rather than a policy I am asking you to trust.

What this site is

CardTools is a static site. Every page is pre-rendered HTML with JavaScript attached; every parser, decoder and lookup table is compiled into that JavaScript and runs on your machine. There is no server-side code, no database, and no API. Once a page has loaded, it makes no further network requests at all.

So anything you type or paste, whether that is a card number, a chip trace or a message dump, is processed on your machine and discarded when you close the tab. It is never uploaded and never stored.

How to verify it

Don't take my word for it. Open your browser's developer tools, switch to the Network tab, and use any tool on this site. You will see the initial page load and nothing afterwards.

For a stronger check, load a tool page, then disconnect from the network entirely. Everything keeps working. A tool that needed to send your data somewhere could not.

You can also read the source. Every parser is a plain TypeScript function with no network calls anywhere in it.

The strongest check is the Content Security Policy this site is served with, which contains connect-src 'none'. That tells your browser to refuse every outbound request the page could attempt. It covers fetch, XMLHttpRequest, WebSockets and sendBeacon, including requests back to this site's own domain. You can see it in the response headers in the Network tab. What it buys you is that even if I shipped a bug, or a dependency I trusted turned out to be compromised, your browser would block the request before anything left your machine.

What I don't collect

  • No tracking scripts, and no telemetry sent from your browser.
  • No cookies, so nothing that needs a consent banner.
  • No accounts, no sign-in, no email addresses.
  • No third-party scripts, fonts or CDNs. Everything is served from this domain.
  • No error reporting service that might capture the contents of an input field.

The one thing stored locally

Your light or dark theme preference, in localStorage under the key cardtools-theme. It never leaves your browser, and clearing site data removes it. Nothing else is persisted.

About "copy link"

Some tools offer a shareable link that embeds your input in the URL fragment, the part after the #. Browsers never transmit fragments to servers, so this is safe by construction. But it is only ever created when you press the button: no tool writes your data into the address bar automatically, precisely so that a value cannot leak into your browsing history or a screenshot without your say-so.

If you do share such a link, remember that the data travels with it. Do not paste one containing a real card number into a ticket or a chat.

Server logs and visitor counts

This site is hosted on Cloudflare Workers. Like any web host, Cloudflare records standard request metadata for delivery and abuse prevention: IP address, timestamp, and which page was asked for. I do look at the aggregate counts that come out of it, meaning how many visits there were and roughly which countries they came from.

That is measured at the edge, from requests the server already receives. Nothing runs in your browser to produce it. There is no tracking script, no cookie, and no identifier tying one request to the next. It is the same information any web server in the world would have simply by being asked for a page.

It covers the HTML and JavaScript files you download. It cannot include what you type into a tool, because that never becomes a request.

Still, be careful with live card data

Everything above is true, and you should still prefer test data. A real PAN in a browser tab is a real PAN in your clipboard, possibly in a screenshot, and inside a machine that is almost certainly not in your PCI DSS scope. Tools that mask cardholder data on this site do so by default for that reason.

If your organisation has a policy about where cardholder data may be entered, this site is subject to it regardless of how it is built.

Accuracy

The reference data here is compiled from public specifications — EMV 4.x books, ISO 8583:1987, ISO 4217, ISO 3166-1, ISO/IEC 7812 — and from schemes' own published acceptance guides. It is reference information, not advice, and scheme rules change. Confirm against your acquirer or scheme documentation before acting on anything you read here.

← Back to the tools