Does a valid checksum mean the account exists?

No. It means the IBAN is well-formed for its country. Whether an account with that number is open is something only the bank knows.

Which bank does this IBAN belong to?

This page does not say. The bank identifier is inside the IBAN, but mapping it to a name needs a registry this check does not consult.

Which countries are covered?

Seventy-eight, every one with a fixed IBAN length in the ISO 13616 registry. An IBAN from a country outside the table is never matched, and never guessed at.

Can I paste it with spaces?

Yes — groups of four, as your bank prints it, or run together.

FREE TOOL

IBAN checker

Paste an IBAN and see whether its check digits are right under ISO 7064 mod-97 and whether its length matches what the issuing country publishes for its IBANs (ISO 13616). That is the whole check. It does not name the bank, return a BIC, or confirm the account exists — the page reads the number, and nothing is sent to any bank.

How to read the verdict. This checker runs StormDoor's personal-data gate, which treats a valid IBAN as something to find. So suspect with pii.iban means yes, this is well-formed — checksum and country length both pass. clean means no valid IBAN was found. Note the severity: an IBAN is medium, so on this page the "yes" verdict is suspect, not block.

INPUT

IBAN

try

200 OK<1 ms (api)

SUSPECT

IBAN detected

1 check run

Valid — checksum and country length both pass

code: pii.iban
severity: medium
location: 6-33

{
  "ok": true,
  "verdict": "suspect",
  "findings": [
    {
      "code": "pii.iban",
      "severity": "medium",
      "message": "IBAN detected",
      "location": "6-33",
      "source": "rules"
    }
  ],
  "data": {
    "matches": [
      {
        "code": "pii.iban",
        "rule": "iban",
        "start": 6,
        "end": 33
      }
    ]
  },
  "checks_run": [
    "pii.iban"
  ],
  "checks_skipped": [
    {
      "code": "pii.email_address",
      "reason": "plan",
      "available_on": "starter"
    },
    {
      "code": "pii.national_id_de",
      "reason": "plan",
      "available_on": "starter"
    },
    {
      "code": "pii.national_id_dk",
      "reason": "plan",
      "available_on": "starter"
    },
    {
      "code": "pii.national_id_fi",
      "reason": "plan",
      "available_on": "starter"
    },
    {
      "code": "pii.national_id_nl",
      "reason": "plan",
      "available_on": "starter"
    },
    {
      "code": "pii.national_id_no",
      "reason": "plan",
      "available_on": "starter"
    },
    {
      "code": "pii.national_id_se",
      "reason": "plan",
      "available_on": "starter"
    },
    {
      "code": "pii.payment_card",
      "reason": "plan",
      "available_on": "starter"
    },
    {
      "code": "pii.phone_number",
      "reason": "plan",
      "available_on": "starter"
    }
  ],
  "meta": {
    "gate": "pii",
    "ms": 0,
    "ruleset": "reference-a39927da"
  }
}

The full /v1/pii gate also checks

US routing numberEmail addressGerman national IDDanish national IDFinnish national IDUK National Insurance numberDutch national IDNorwegian national IDSwedish personnummerUS Social Security numberCard numberPhone number

Also available through the API.

Join the waitlist /v1/pii docs

Live call to the same /v1 endpoint customers use. Rules only on this page; nothing you type is stored.

Published example IBANs from bank documentation. Do not paste a real IBAN here or anywhere else — the check runs in memory and stores nothing, but the habit is the point.

What it checks

pii.iban — a candidate of two letters, two digits and 10 to 30 more characters is tested against the mod-97 checksum every real IBAN satisfies, then against the fixed IBAN length of the country in the first two letters, from a table of 78 countries. An unknown country prefix is never matched — there is no "guess a range".

This page runs only pii.iban on the text you paste. The rest of the gate (email addresses, phone numbers, payment cards, six national IDs) runs through the API only; the line under the result names them.

What the result means

Verdict	Meaning on this page
`suspect` with pii.iban (medium)	Checksum and country length both pass.
`clean`	No candidate passed both. Wrong check digits, wrong length for the country, or a country the table does not list.

Verdict

Meaning on this page

suspect with pii.iban (medium)

Checksum and country length both pass.

clean

No candidate passed both. Wrong check digits, wrong length for the country, or a country the table does not list.

data.matches[] carries the match's start and end offsets and the rule that fired. The response never echoes the IBAN itself.

Why it matters

The check digits catch a mistyped IBAN before a transfer goes to the wrong account, and mod-97 catches a mistyped or transposed character. The same check is how a support tool notices an IBAN sitting in a ticket: an IBAN is enough on its own to attempt a transfer to, or from, the account it names, which is why it is a finding on the personal-data gate.

From your own code

curl -s -X POST https://api.stormdoor.dev/v1/pii \ -H "Authorization: Bearer sk_live_..." \ -H "content-type: application/json" \ -d '{"text":"IBAN: DE89 3704 0044 0532 0130 00","redact":"mask"}'

redact: "mask" adds data.redacted, the text with the match replaced by asterisks, one per character. The API needs an account — signups open with paid plans, a one-time trial included, no card. Join the waitlist and you will hear first.

IBAN checker

What it checks

What the result means

Why it matters

IBANs,
answered.

From your own code

Read more

Guides about this

IBAN checker

What it checks

What the result means

Why it matters

IBANs,answered.

From your own code

Read more

Guides about this

IBANs,
answered.