The Luhn Algorithm: How Card Number Checks Work
The Luhn algorithm is a one-digit checksum on the end of a number. It's on every credit and debit card, every IMEI, many national ID and loyalty numbers, and Canadian Social Insurance Numbers. Its whole job is to catch a mistyped or misread digit before the number is sent anywhere.
How to compute it by hand
Take the number without its last digit (the check digit). Then:
- Starting from the rightmost digit and moving left, double every second digit.
- If a doubled value is more than 9, subtract 9 (equivalently, add its two digits: 14 → 1 + 4 = 5).
- Add up all the digits — the doubled-and-adjusted ones and the untouched ones.
- The check digit is whatever makes that total a multiple of 10. If the sum is 67, the check digit is 3.
To validate a complete number, run the same process including the check digit (doubling every second digit from the right, which now starts one position further along) and confirm the grand total ends in 0.
Worked example
Validate 4539 1488 0343 6467:
Digits: 4 5 3 9 1 4 8 8 0 3 4 3 6 4 6 7
Double every 2nd from the right (positions marked *):
* . * . * . * . * . * . * . * .
8 5 6 9 2 4 16 8 0 3 8 3 12 4 12 7
Subtract 9 where >9:
8 5 6 9 2 4 7 8 0 3 8 3 3 4 3 7
Sum = 80 → ends in 0 → valid LuhnHighlighted digits are doubled (then reduced if over 9) before the bottom row is summed: 80 — ends in 0, so this number is Luhn-valid.
The card validator runs exactly this check.
What it catches — and what it doesn't
Luhn detects any single-digit error (one wrong digit) and most adjacent transpositions (two neighbouring digits swapped). That covers the overwhelming majority of human typing and OCR mistakes.
It does not catch the transposition 09 ↔ 90, and it doesn't catch two errors that happen to cancel out. It's a sanity check, not cryptographic integrity — anyone can compute a valid check digit, so it provides no security and no authentication.
Why "passes Luhn" means almost nothing about a real card
A card number that passes Luhn is necessary for it to be real, but nowhere near sufficient. Passing tells you only that the digits are internally consistent. It says nothing about whether a bank issued the number, whether an account exists, whether it has funds, or whether the expiry and CVV match. This is exactly why a Luhn-valid test card number is safe to use for testing a form — it exercises the client-side check and then any real payment gateway rejects it.
Luhn vs. the IBAN check
Bank account numbers in IBAN format use a different and stronger check: ISO 7064 mod-97. The two check digits after the country code make the whole rearranged number leave a remainder of 1 when divided by 97, which catches essentially all single and double errors and most other slips. See the IBAN validator. Credit cards stuck with Luhn because it was designed in the 1950s to be computable on mechanical equipment.
Where else you'll meet it
- IMEI (phone hardware IDs) — 15 digits, last is Luhn.
- Canadian SIN and several other national IDs.
- Many gift card, loyalty, and survey codes, to reject typos at entry.