Short answer

A CVV is three digits on Visa, Mastercard, Discover, and most other card networks. American Express uses four digits. A length test has to accept both 3 and 4 digits and tie the expected length to the card brand, because a fixed rule either rejects valid cards or lets bad input pass.

What the code actually is

The three or four digits are a card verification value. Visa calls it CVV2, Mastercard calls it CVC2, and American Express calls it CID. The code is printed on the card but is not encoded in the magnetic stripe or the chip. It exists to prove the person entering the number has the physical card in hand, which is why it matters for card not present transactions.

Length by network

• Visa: 3 digits, printed on the back, right of the signature strip.
• Mastercard: 3 digits, printed on the back, right of the signature strip.
• Discover: 3 digits, printed on the back.
• American Express: 4 digits, printed on the front, above the card number.

Some regional and private label cards follow the same pattern as the network they run on. When a brand is unknown, accept 3 or 4 digits and let the issuer decide during authorization.

How to validate a CVV in a payment form

1. Read the card number field first and detect the brand from the leading digits.
2. Set the CVV input to accept 3 or 4 characters rather than a fixed count.
3. Restrict the field to digits with a numeric keyboard on mobile.
4. Trim spaces and strip non digit characters before you measure length.
5. Compare the measured length to the length expected for the detected brand.
6. Show one plain error message when the length does not match, and do not say which digits failed.
7. Transmit the value over TLS and keep it out of application logs, analytics, and error traces.

What a length test does not prove

Length is a format check, not a validity check. Any three digits pass it. Only the issuing bank can confirm the code matches the account, and that confirmation happens during authorization. Running real card numbers you do not own against a live gateway is card testing, it is fraud, and networks watch for the pattern and block it.

Storage and legal notes

PCI DSS forbids storing the card verification code after authorization, so no system should keep a CVV longer than the transaction needs it. Buying or selling card data, including CVVs, is a federal crime in the United States under 18 U.S.C. 1029 and comparable laws elsewhere. Test forms with sandbox numbers from your processor, never with live card data.