CVV length: the direct answer
Most cards carry a 3-digit code. American Express carries 4 digits. Visa names it CVV2, Mastercard names it CVC2, and American Express and Discover name it CID. The digit count is fixed by the network. No issuer prints a 5-digit code.
Digit count by network
- Visa: 3 digits, back of the card, inside the signature panel.
- Mastercard: 3 digits, back of the card, inside the signature panel.
- Discover: 3 digits, back of the card.
- American Express: 4 digits, front of the card, above the account number on the right side.
- UnionPay: 3 digits on most cards.
CVV1 compared with CVV2
CVV1 sits on the magnetic stripe and is not printed anywhere on the plastic. CVV2 is the printed value typed into a checkout form. Both come from the account number, the expiration date, and a service code run through a keyed cryptographic function. The derivation key and the algorithm are not public.
Why American Express uses 4 digits
American Express does not publish a reason for the 4-digit format. The value is printed on the front rather than the back, so the field sits near the account number it verifies.
What a length test does and does not cover
A length test counts digits in the field. It does not verify the card. The Luhn check digit applies to the primary account number, not to the security code. A CVV has no internal check digit, so any 3-digit string is structurally valid to a form parser.
Form builders handle the mismatch in different ways. Some checkout pages hard-code 3 digits and reject American Express. Others switch the field length after the card number passes the network prefix check. American Express numbers start with 34 or 37.
Storage rules
PCI DSS Requirement 3.2 bars storage of sensitive authentication data after authorization. That set includes the full track, the card verification code, and the PIN block. A merchant may not keep the CVV in a database, a log file, or a printed receipt.
Quick reference
- Locate the code. Back for Visa, Mastercard, Discover. Front for American Express.
- Count the digits. 3 for most cards, 4 for American Express.
- Do not confuse the code with the 4-digit card PIN. The PIN is never printed.