Do you still need a BIC?

Inside SEPA, most euro transfers no longer require one: the IBAN alone is enough. You will still be asked for a BIC on many international transfers, older payment forms and some payroll or invoicing systems.

The same thing. BIC is the official name (Business Identifier Code, ISO 9362); SWIFT is the organisation that issues them, so the code is often called a SWIFT code.

Why can’t a BIC be calculated from an IBAN?

An IBAN contains a national bank identifier, not the BIC. The two are linked by directories that each country’s central bank or payments body maintains, which is what this tool looks up.

Privacy.

IBANtoBIC is built to need almost nothing from you. This page says exactly what happens to what you enter, what the site stores, and what it does not.

Last updated 21 August 2026.

The short version

No account needed. Every lookup on this site works without signing up. Only the developer API has an optional account, and it stores nothing but your email address.
IBANs are never stored. An IBAN you enter is validated and looked up in memory; it is not written to our database or our logs.
No analytics, no ads, no tracking cookies. Two technical cookies keep the site secure; that is all.
Your recent lookups and “My bank account” stay in your browser. They are never sent to us.
What we do keep: anonymous counts of bank identifiers we could not resolve, and the problem reports you choose to send.

What happens to an IBAN you enter

The IBAN is sent to our server, checked (country, length, check digits), reduced to its national bank identifier, and that identifier is matched against our copy of the official bank directory. The result comes back and the IBAN is discarded. Our code never writes an IBAN to the database or to a log file, and batch lookups work the same way, line by line — a CSV you choose is read in your browser and only the IBANs in it are sent.

Result links (“Share”) contain the IBAN in the address, so share them only with people who may see that account number. They are marked so search engines do not index them. Opening one sends that address to our server like any page request; we do not store it.

What we store

Three things — and only the last one, which is optional, can identify you:

Unresolved bank identifiers. When a valid IBAN’s bank is not in the directory, we record the country and the bank identifier (for example the three-digit Belgian bank code) with a counter and the date — not the account number, not your IP address. It tells us which registries or banks we are missing.
Problem reports. If you report a wrong or missing BIC, we store the country, the bank identifier, the BIC the result showed, the reason you picked and your note. The form has no field for the IBAN by design. Please do not put personal details in the note.
API accounts. If you create an account for the developer API, we store your email address and fingerprints of your API keys — never the keys themselves, and there are no passwords: signing in works through a link we email you. The IBANs you look up through the API are handled exactly like the ones entered on this site — never stored.
Billing details. To subscribe to a paid API plan you provide your company's legal name, billing address and, optionally, a VAT number (which we verify against VIES, the EU's VAT registry). These appear on your invoices and are shared with our payment provider for that purpose.

Everything else in our database is the bank directory itself — public registry data.

Stored in your browser only

Two conveniences live in your browser’s local storage and nowhere else: the list of recent lookups (your last few valid results) and “My bank account” (one IBAN with its result, if you choose to save it). They are never sent to our server and are not part of any page we deliver. Use “Clear” and “Remove” on the homepage to delete them, or clear the site’s data in your browser.

Cookies

For visitors, the site sets two cookies, both strictly necessary and neither used to track you:

ibantobic-session — an anonymous session identifier that protects the forms against cross-site request forgery. Expires after two hours of inactivity.
XSRF-TOKEN — the matching security token the browser sends back with each lookup. Same lifetime.
remember_web… — only if you sign in to the API dashboard: a long-lived token that keeps you signed in on that browser. Signing out removes it.

There are no analytics, advertising or third-party cookies, which is why there is no cookie banner.

Third parties and server logs

Our body font (Proxima Nova) is served from our own server. The heading font (Poppins) is loaded from Bunny Fonts, a privacy-focused font service: your browser requests the font files from them, and they state that they do not log or track those requests. No other third-party scripts, embeds or CDNs are used, and the bank directories are imported on our server — your browser never contacts the registries. If you create an API account, the sign-in emails are delivered through our email provider (Mailgun), which processes your email address for that purpose. Paid subscriptions are processed by Stripe: your card details go directly to Stripe and never touch our servers, and Stripe receives your billing details to put on invoices.

To limit abuse, requests to the lookup endpoints are counted per IP address for one minute in a short-lived cache; nothing is kept beyond that. Like any website, the servers that run IBANtoBIC keep standard access logs (IP address, requested address, browser, time) for security and troubleshooting; they are rotated after a short period and are not combined with anything else or used to identify visitors.

Your rights and contact

Under the GDPR you can ask what personal data we hold about you and have it corrected or deleted. Unless you created an API account, we hold none that can be tied to you; with an account, it is your email address. For a question or a request, write to the operator named on the imprint. If you think we have not handled your data properly you may also complain to your national data protection authority.