Carding Tools 2026: BIN Checkers & Validators

[Blackhatpakistan]

Every carding workflow starts with the same unglamorous step: deciding whether a piece of material is worth touching. That decision is made by checkers - and the checker landscape splits cleanly into two worlds. Offline validators do the math: Luhn checksum, BIN identification, length, brand rules - pure local logic, no network, no cost, no trace. Live checkers do the probe: they take the number to a payment gateway's API and read the response - approved, declined, do-not-honor, incorrect-CVC - which is where the value (and the risk, and the cost) lives. GitHub hosts both worlds in the open, and the star counts below tell you which repos the scene actually uses versus which are abandoned shells with dead APIs. This is the 2026 map: offline class, live class, bot wrappers, two runnable scripts, why most "working" checkers on forums are rotten, and the self-check that separates someone who understands response codes from someone who just pastes lists into PHP forms.

TL;DR - Offline validation (Luhn + BIN metadata) is free, instant and legal to run against anything - it tells you brand, issuer, country, card type, and whether the number is even structurally real. Live checking goes through gateway APIs (Stripe, PayPal, Braintree, Square patterns all appear in the repos) and returns authorization responses - that is where CPM costs, SCA friction and dead keys come in, and why most forum-shipped checkers work for a week. The GitHub map below: MASS-CC-CHECKER (371 stars, PHP), Aron-Tn/CC-CHECKER (248 stars, Stripe Python), ashleydarosa/CC-Checker-Validator-Generator (197 stars, Luhn/BIN/pattern QA toolkit - actively updated), hexindai/bcbc (162 stars, Go, UnionPay BIN), br0keh/cc-checker (143 stars), CC-CHECKERS-API (125 stars, multi-gateway PHP), plus ten more including the Telegram bot wrapper (Bin-Checker-Bot, 63 stars). Two scripts: a Luhn-plus-BIN-metadata validator with public enrichment, and a batch offline validator that stats a list by brand and BIN range. Hygiene: repos asking for your Stripe secret keys are farming keys, not checking cards - run key-using checkers only against keys you minted yourself, in a VM. Six-question self-check, scoreboard thread below - best fake-checker callout pinned, first fifteen get the BIN reference sheet and response-code triage table.

TAXONOMY: THREE TIERS OF CHECKER

- Tier 1 - offline validator. Luhn algorithm, length table, brand prefix matching. Zero network calls. Answers: "is this number structurally valid and what is it?" A number failing here is a typo, not material.
- Tier 2 - BIN metadata lookup. Takes the first six to eight digits and queries a BIN database (public APIs or local tables): issuer, country, card type (debit/credit/prepaid), bank name. Answers: "does this BIN match the story the list claims?" BIN-country mismatch against a billing address is a guaranteed AVS decline later.
- Tier 3 - live checker. Sends a authorization-shaped request through a gateway API and reads the response code. Answers the expensive question. Response codes are the real language here: approved, incorrect-number, do-not-honor, insufficient-funds, try-later, incorrect-CVC, expired - each tells a different story about the number and the gateway's risk posture, and the mechanics go deep in the related "How CC Checkers Actually Work" guide.

Most burning money happens at tier 3, run by people who cannot read tier 1 output. Run the tiers in order.

THE OFFLINE CLASS: GITHUB MAP

- ashleydarosa/CC-Checker-Validator-Generator - 197 stars, updated this week. Python CLI that generates and validates Luhn-valid numbers by brand, BIN or pattern - a payment-QA toolkit, and the cleanest reference for what "structurally valid" means in code.
- hexindai/bcbc - 162 stars, Go. UnionPay BIN checker - the China-market BIN database most English tools lack.
- OshekharO/KE1-CC-CHECKER - 94 stars, JavaScript. Luhn validation with a bootstrap UI - small enough to read in one sitting.
- Malam-X/Bin-Checker - 43 stars, Python. BIN lookup stripped to essentials.
- securesh3ll/azathot - BIN info and checker utilities in Python.

THE LIVE CLASS: GITHUB MAP

- OshekharO/MASS-CC-CHECKER - 371 stars, PHP. The most-starred repo in the space: modern UI, batch validation. Treat as the canonical example of the PHP checker genre.
- Aron-Tn/CC-CHECKER - 248 stars, Python via Stripe. Reads as a payment-testing script, which is exactly how live checking works mechanically.
- skylar69-wtf/CC-CHECKERS-API - 125 stars, PHP. Multi-gateway: PayPal, Stripe, Braintree, Square patterns in one codebase - useful for comparing how each gateway's API shapes a response.
- srevarun/CC_Checker-Python - 108 stars. Single-request live/dead tester - the "1req checker" pattern that minimizes fingerprinting per number.
- hndko/CCEXTRAP - 95 stars, updated 2025. Auto-generate-and-check from a manual BIN input - the full loop in one PHP API.
- Plasmonix/CC-Checker - 85 stars, PHP via Stripe, explicitly "no SK required" - interesting because it shows the test-key boundary these tools live on.
- br0keh/cc-checker - 143 stars, JavaScript, self-described "for studies" - the open-source disclosure of the same mechanics.
- byL1N3/cc-checker - 45 stars, PHP, marked "dead API" in its own description - a perfect example of tier-3 rot: the code is fine, the endpoint it leaned on is gone.
- ImDenuwan/Bin-Checker-Bot - 63 stars, Python + pyrogram. Telegram bot wrapper: BIN checks arrive as messages, results as replies - how most of the scene consumes tier-2 data now.
- anoopmundathan/cc-check-app - 21 stars, JavaScript. Minimal web app version of the offline-plus-live loop.

TIER ONE PLUS TWO: THE SCRIPT YOU SHOULD OWN

Everything above ships dependencies and PHP you have to trust. The script below needs no trust: local Luhn, brand table, length rules, then optional BIN enrichment from a public metadata endpoint (no keys, no account - the lookup sends eight digits, nothing else). Run it against any list before anything else touches it; it costs nothing and removes the trash that wastes tier-3 requests.

import re, json, urllib.request

BRANDS = [

    ("visa",       r"^4[0-9]{12}(?:[0-9]{3})?$",     (13, 16)),

    ("mastercard", r"^5[1-5][0-9]{14}$",             (16, 16)),

    ("amex",       r"^3[47][0-9]{13}$",              (15, 15)),

    ("discover",   r"^6(?:011|5[0-9]{2})[0-9]{12}$", (16, 16)),

]

def luhn(num):

    digits = [int(c) for c in num][::-1]

    total = 0

    for i, d in enumerate(digits):

        if i % 2:

            d *= 2

            if d > 9: d -= 9

        total += d

    return total % 10 == 0

def brand(num):

    for name, pat, (lo, hi) in BRANDS:

        if re.match(pat, num) and lo <= len(num) <= hi:

            return name

    return None

def bin_meta(bin6):

    req = urllib.request.Request(

        "https://binlist.net/json/" + bin6,

        headers={"Accept": "application/json", "Range": "bins=0"})

    try:

        d = json.load(urllib.request.urlopen(req, timeout=8))

        return "%s | %s | %s" % (

            d.get("scheme", "?"), d.get("type", "?"),

            (d.get("country") or {}).get("name", "?"))

    except Exception:

        return "(offline: no lookup)"

for raw in open("material.txt"):

    num = re.sub(r"\D", "", raw.strip())

    if not num:

        continue

    b = brand(num)

    ok = luhn(num)

    tag = "VALID" if (b and ok) else ("LUHN-FAIL" if not ok else "UNKNOWN-BRAND")

    print("%-11s %s %s  bin=%s %s" % (

        b or "?", num[:6] + "*" * (len(num) - 10) + num[-4:], tag,

        num[:6], bin_meta(num[:6]) if tag == "VALID" else ""))

READING THE RESULTS: TRIAGE LOGGER

Live runs produce one artifact that decides your next move: the response code, per number. The logger below aggregates a results file (number-hash, code, gateway, timestamp) into the picture operators actually act on - which codes dominate, what each implies, and where the run should pivot. Pair it with the triage table promised in the scoreboard reward: each code mapped to "meaning - does it prove - next move."

import csv, collections

# results.csv columns: ref,code,gateway,ts   (ref = masked number or batch line id)

rows = list(csv.DictReader(open("results.csv", encoding="utf-8")))

codes = collections.Counter(r["code"].strip().lower() for r in rows)

total = len(rows) or 1

NEXT = {

    "approved":           "record and move on - gateway is pricing this pattern",

    "incorrect_number":   "tier-1 leak - number should have been filtered offline",

    "incorrect_cvc":      "material variant mismatch - fullz would fix, cvv-only wont",

    "expired":            "dead - discard, BIN age issue on the list source",

    "do_not_honor":       "opaque decline - resubmit once elsewhere before judging",

    "insufficient_funds": "account is real - keep, funding is their problem not yours",

    "try_later":          "transient - retry window, not a verdict",

    "card_not_supported": "gateway/BIN mismatch - wrong rail for this material",

    "sc_required":        "SCA wall - needs 3DS flow, raw auth will never pass",

}

print("batch: %d responses | distinct codes: %d" % (total, len(codes)))

for code, n in codes.most_common():

    pct = 100.0 * n / total

    print("%-20s %5d  %5.1f%%  -> %s" % (

        code, n, pct, NEXT.get(code, "unknown code - log it, research, extend NEXT map")))

# pivot rule: if tier-1 leaks exceed 5% of declines, stop live and rerun offline

leak = codes.get("incorrect_number", 0) + codes.get("expired", 0)

if leak / total > 0.05:

    print("PIVOT: %.1f%% tier-1 leaks - rerun the offline validator before spending more" % (100.0 * leak / total))

WHY LISTS ROT: THE TIER-3 ECONOMICS

Live checking is not a right, it is metered access. Gateways price authorization requests, flag volumes that look like enumeration, and - in the Stripe SCA world - route anything European through 3DS challenges that return responses no checker UI knows how to display. Add key rotation: a checker built around one account's API key dies when that account dies, which is the actual lifecycle behind "checker working 100%" forum posts that stop working in seventy-two hours. The repos that survive (the multi-gateway ones, the 1req pattern) survive by treating endpoints as replaceable adapters. When you evaluate any checker - repo or forum zip - ask one question: where does its key come from? Answer that before you paste anything.

HYGIENE: KEY-FARMING AND FAKE CHECKERS

The carding-specific version of the leaked-bot problem: a checker that asks for your Stripe secret key "to authorize requests" can do anything your account can do - including moving money, creating refunds, reading customers. Mint your own test keys for any code you run, run forum zips only in a VM with no saved sessions, and prefer the open repos above at least because the source exists to read. Quick ritual: clone, grep for outbound endpoints (they should only touch the gateway you configured), check for unexpected crypto wallet strings or webhook URLs, run once in isolation, then decide.

TEST YOURSELF: SIX QUESTIONS

Score honestly: (1) can you write the Luhn algorithm from memory? (2) do you know your material's tier-1 pass rate before any live check runs? (3) can you name three response codes and what each implies? (4) do you verify BIN-country against billing geography before spending CPM? (5) have you read where your checker's API key comes from - and what it can do? (6) when a checker stopped working last, did you diagnose endpoint-rot or assume the list was dead? Zero to one: you are burning material at tier 3 with tier-1 problems underneath. Two to three: functional workflow, add the offline gate. Four plus: you run validation like QA - post the stack.

POST YOUR CHECKER SCOREBOARD

Report in scoreboard format: repo or tool you actually run, tier (offline/BIN/live), approx star count or version, what its key source is, and its tier-1 pass rate on your last batch (percentage, no material). Bonus column: worst fake-checker story - the zip that was a key-farmer or a stealer, what it requested, how you caught it. Best callout gets pinned to the node, first fifteen posters get the BIN reference sheet plus the response-code triage table (decline code - meaning - next move) via PM.

OPERATOR CHECKLIST

- Offline gate first - Luhn, brand, length on every list before any network call. Trash that fails locally is wasting your tier-3 budget.
- BIN story check - issuer, country and card type must match the billing geography of wherever the material is headed, or AVS declines are baked in.
- One request per number where possible - the 1req pattern minimizes the fingerprint each number leaves at the gateway.
- Key isolation - only keys you minted, only in environments you control, never pasted into a forum-shipped form.
- Dead-endpoint detection - when results change, check whether the gateway endpoint or key rotated before blaming the list; keep adapters replaceable.
- Response-code literacy - approved/decline/do-not-honor/incorrect-CVC each imply a different next step; logging raw codes per number is what makes later analysis possible.
- Source hygiene - repo before zip, source before binary, VM before host. The carding node has seen this movie before.

FAQ

- Q: Is offline validation legal?

A: Running a checksum and a prefix table against data you already have touches no system and bills nobody - it is arithmetic. Everything downstream of tier 1 is where permission questions start.
- Q: Why did my forum checker die in a week?

A: Tier-3 economics: the key behind it rotated, the account got flagged, or the endpoint moved. The repos that age well treat gateways as adapters you rewire.
- Q: Do I need paid BIN databases?

A: To start, no - public lookups cover issuer and country fine for batch triage. Paid local databases matter when volume or offline operation matters; the bcbc repo covers the UnionPay gap for free.
- Q: What does do-not-honor actually tell me?

A: Less than people think - it is the gateway declining without disclosing whether the number, funds or risk engine was the cause. The triage table in the scoreboard reward maps each code to what it does and does not prove.
- Q: Telegram bots or local repos - which are safer?

A: Local repos you can read; bots you cannot. A BIN bot that only returns issuer metadata is low-risk convenience, but nothing you cannot audit should sit in the middle of a material flow.
- Q: Best single first step for a new list?

A: Run the tier-1 script above end to end, read the brand and BIN-FAIL breakdown, fix or discard failures, and only then think about which tier-3 adapter is worth its requests.

RELATED

How CC Checkers Actually Work - Response Codes, CPM and Accuracy

BIN Guide 2026 - How to Read, Evaluate and Profit from BINs

CVV vs Fullz vs Logs - The Complete Material Guide

Carding Bible 2026: The Complete Underground Guide