nullcipher

Payment card numbers

13–19 digits that pass the Luhn check and start with a real issuer prefix at that issuer's length. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Payment card number

What an AI chat would receive after masking

[CARD_1]

1 × Payment card number found and masked.

How nullcipher recognises it

13 to 19 digits (single spaces or dashes allowed) that pass the Luhn check and start with a real issuer prefix at that issuer's length (Visa 4…, Mastercard 51–55/2221–2720, Amex 34/37, Discover, JCB, Diners, UnionPay, Maestro).

This is the rule text of the “Payment card number” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

4242 4242 4242 4242

nullcipher replaces it with [CARD_1]. This is the Visa test card number Stripe publishes for sandbox testing. It passes the Luhn check, which is why nullcipher masks it, but it cannot pay for anything.

Why it matters in an AI chat

A card number with its expiry date can be enough to pay at merchants that do not ask for the security code, and a pasted order log or payment payload often has all three on neighbouring lines.

nullcipher masks the number. It does not recognise an expiry date or a three- or four-digit security code on their own, so read the lines around a masked card before you paste.

The Luhn check keeps false alarms down: an order ID or a tracking number that happens to be 16 digits long almost never passes it and also starts with a real issuer prefix.

If it already leaked

  1. Call the number on the back of the card, or use your bank's app, to block the card and ask for a replacement with a new number.
  2. Go through recent transactions with the issuer and dispute any you did not make.
  3. Update the new number wherever the old one was stored for subscriptions and saved payments.

Sources

  1. Testing — Stripe Documentation (test card numbers) — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 16 secret types and how to delete a chat you already sent.