How to Validate an IBAN (MOD-97 Check Digit, Explained)

rosario vitale — Sun, 05 Jul 2026 08:23:59 +0000

You typed your IBAN, hit send, and the bank threw it straight back: invalid IBAN. The number looks exactly right — same letters, same digits you copied off the invoice — but the transfer won't go through. Before you blame the bank, know this: every IBAN carries a built-in self-check, and it just did its job. Those two digits right after the country code are a checksum whose whole purpose is to catch a single typo or two swapped characters before your money moves to the wrong account. If you just need the payment to work, the fix is usually one mistyped character. If you're a developer wiring up validation, here's exactly how the MOD-97 algorithm does it.

What are the IBAN check digits?

An IBAN is a country code, two check digits, then the BBAN — your domestic bank and account number. Those two check digits (positions 3 and 4) aren't part of your account. They're computed from the rest of the number using an algorithm called MOD-97, formally ISO 7064, mod 97-10. To validate an IBAN, you run the same math and confirm the result comes out to exactly 1. If it doesn't, something in the number is wrong.

One caveat worth stating up front: passing MOD-97 only proves the number is internally consistent and the correct length. It does not confirm that the bank, branch, or account actually exists or is open. That requires a separate bank-directory or account-verification lookup — not the check-digit arithmetic.

The MOD-97 algorithm, step by step

Normalize. Strip spaces and uppercase every letter. Check the length matches the fixed length for the country code (Germany is 22, UK 22, France 27, Norway 15, Malta 31).
Rotate. Move the first four characters — country code plus check digits — from the front to the back.
Letters to numbers. Replace each letter with two digits: A=10, B=11, … Z=35 (that's ord(L) - 55). Digits stay as they are. You now have one long numeric string.
Mod 97. Read that string as a single huge integer and take its remainder modulo 97. It's far bigger than a 64-bit int, so use a bignum, or compute the remainder piecewise, left to right.
Decide. A remainder of 1 means valid. Anything else means the number is corrupted.

A worked example — DE89370400440532013000

Take DE89370400440532013000 (Germany, so it must be 22 characters — it is).

Rotate: move DE89 to the end → 370400440532013000DE89.
Convert letters: D=13, E=14, so the tail DE89 becomes 131489. The full numeric string is 370400440532013000131489.
Mod 97: as one big integer, 370400440532013000131489 mod 97 = 1.

No bignum? Do it in chunks, prefixing each running remainder onto the next digits:

370400440 mod 97 = 23
235320130 mod 97 = 70 (the previous 23 in front of the next digits 5320130)
700013148 mod 97 = 38
389 mod 97 = 1

Both roads land on 1, so DE89370400440532013000 is valid.

In code (Python)

import re

def validate_iban(iban: str) -> bool:
    iban = re.sub(r"[^A-Za-z0-9]", "", iban).upper()
    rearranged = iban[4:] + iban[:4]
    digits = "".join(
        str(ord(ch) - 55) if ch.isalpha() else ch
        for ch in rearranged
    )
    return int(digits) % 97 == 1


print(validate_iban("DE89370400440532013000"))  # True

Python integers are arbitrary-precision, so the bignum path just works — no chunking needed. The re.sub also strips any stray spaces or punctuation left over from a copy-paste, so "DE89 3704 0044 0532 0130 00" validates too. For production, add a per-country length check before this test.

Two things that trip people up

Invisible junk from copy-paste. Leading or trailing spaces, non-breaking spaces, soft hyphens, and line breaks pasted out of a PDF or email survive the copy and break validation. Stripping plain spaces isn't always enough — strip anything that isn't A-Z or 0-9.
O/0 and I/1/l confusion. Reading an IBAN off a printed statement, people type the letter O for zero, or capital I / lowercase l for the digit 1. One wrong character flips the remainder off 1 — exactly what MOD-97 is built to catch. A wrong length or a mistyped country code (DR for DE) fails the same way.

The fast way (no math)

Don't want to run the arithmetic? Paste the number into the IBAN checker, which validates the MOD-97 checksum and the per-country length right in your browser. Need to do this at scale — cleaning a payee list, or checking form input server-side? The JSON API takes up to 100 IBANs per call and also handles GTIN, EU VAT, VIN, ISIN, and more. Same input, same output, no AI guessing.

How to Validate a GTIN / EAN-13 Barcode Check Digit (GS1 Mod-10, explained)

rosario vitale — Sun, 05 Jul 2026 05:06:06 +0000

If you have ever uploaded a product feed to Amazon, Google Merchant Center or Shopify and been rejected with "invalid GTIN," the culprit is almost always the check digit — the last digit of the barcode. It is not random: it is calculated from all the other digits, and if it does not match, the platform rejects the code.

Here is exactly how the check digit works, with a worked example you can follow by hand.

What is a GTIN check digit?

GTIN (Global Trade Item Number) is the umbrella term for the barcodes on products: GTIN-8, UPC-A (12 digits), EAN-13 (13 digits) and GTIN-14. The final digit of every one of them is a check digit computed with the GS1 Mod-10 algorithm. Its job is to catch typos: change one digit and the check digit almost always stops matching.

The GS1 Mod-10 algorithm, step by step

Take all the digits except the last (the check digit), then:

Starting from the rightmost of those digits, multiply every second digit by 3 and the rest by 1.
Add up all the results.
Find what you must add to reach the next multiple of 10. That number (0-9) is the check digit.

Formally: check = (10 − (sum mod 10)) mod 10.

A worked example — EAN-13 `400638133393?`

The first 12 digits are 4 0 0 6 3 8 1 3 3 3 9 3. Working right to left, alternate the weights ×3 and ×1:

digit:   4  0  0  6  3  8  1  3  3  3  9  3
weight:  1  3  1  3  1  3  1  3  1  3  1  3
product: 4  0  0 18  3 24  1  9  3  9  9  9

Sum = 4+0+0+18+3+24+1+9+3+9+9+9 = 89.
89 mod 10 = 9, so check = (10 − 9) mod 10 = 1.

The full valid barcode is therefore 4006381333931. If a feed lists 4006381333930, it is wrong — and that is exactly the kind of error that gets a listing rejected.

In code (Python)

def gtin_check_digit(body: str) -> int:
    total = 0
    for i, ch in enumerate(reversed(body)):
        total += int(ch) * (3 if i % 2 == 0 else 1)
    return (10 - total % 10) % 10

print(gtin_check_digit("400638133393"))  # -> 1

The same algorithm works for UPC-A (12), EAN-13 (13), GTIN-8 and GTIN-14 — only the length changes.

Two things that trip people up

Excel eats leading zeros. A UPC like 036000291452 becomes 36000291452 the moment Excel treats the cell as a number, which changes the length and breaks validation. Format the column as Text before pasting.
Wrong length. UPC-A is 12 digits, EAN-13 is 13. Padding a UPC with a leading zero turns it into a valid EAN-13 — that is normal, not an error.

The fast way (no math)

If you just need to check or generate a check digit right now, paste the code into a free GTIN / UPC / EAN check-digit calculator — it validates GTIN-8 / UPC-A / EAN-13 / GTIN-14 in the browser and tells you the correct digit when it is wrong.

For bulk work — validating a whole product feed, or wiring this into your own app — there is a deterministic JSON API that checks up to 100 codes per call (and also handles IBAN, EU VAT, VIN, ISIN and more). Same input, same output, every time — no AI guessing.

DEV Community: rosario vitale

How to Validate an IBAN (MOD-97 Check Digit, Explained)

What are the IBAN check digits?

The MOD-97 algorithm, step by step

A worked example — DE89370400440532013000

In code (Python)

Two things that trip people up

The fast way (no math)

How to Validate a GTIN / EAN-13 Barcode Check Digit (GS1 Mod-10, explained)

What is a GTIN check digit?

The GS1 Mod-10 algorithm, step by step

A worked example — EAN-13 400638133393?

In code (Python)

Two things that trip people up

The fast way (no math)

A worked example — EAN-13 `400638133393?`