What the Luhn formula does
The Luhn formula is a check digit algorithm. Hans Peter Luhn, an IBM researcher, patented the method in 1960 under US Patent 2,950,048. It computes one digit from the other digits in a string. If the computed digit matches the last digit, the string passes the check.
Payment card numbers, IMEI device identifiers, and US National Provider Identifiers use it. The check runs on arithmetic. No network call is involved.
The calculation, step by step
- Start at the rightmost digit and move left.
- Double the value of every second digit: the second, fourth, sixth and so on from the right.
- If a doubled value is greater than 9, subtract 9 from it.
- Add all resulting digits together.
- If the total modulo 10 equals 0, the number passes.
The check digit takes part in the doubling count. A common variant drops the check digit first, then doubles the rightmost digit of what remains. Both versions give the same result.
Worked example
Test the string 79927398713. Digits from the right: 3, 1, 7, 8, 9, 3, 7, 2, 9, 9, 7. Double positions 2, 4, 6, 8 and 10: 1 becomes 2, 8 becomes 16 then 7, 3 becomes 6, 2 becomes 4, 9 becomes 18 then 9. Sum: 3 + 2 + 7 + 7 + 9 + 6 + 7 + 4 + 9 + 9 + 7 = 70. Since 70 modulo 10 is 0, the string passes.
Testing a number
A Luhn test is a loop or a spreadsheet formula. Sandbox card numbers published by payment processors, such as 4111 1111 1111 1111 and 5555 5555 5555 4444, pass the test. So do many other strings. About 1 in 10 random digit strings passes, because the check digit is one decimal digit.
What a pass does not prove
- It does not show that an account exists.
- It does not show that a card is open, funded, or approved for a charge.
- It does not detect a transposition of 09 to 90.
- It does not detect three twin errors: 22 against 55, 33 against 66, 44 against 77.
- It carries no data about issuer, brand, or expiration date.
Card networks use authorization messages, not arithmetic, to accept or decline a transaction. A Luhn pass is a format check on digits. Databases and payment gateways treat it as one input among many, and a rejection at that step means the digits are inconsistent.
Where the algorithm is used
- Payment card numbers under ISO/IEC 7812.
- IMEI numbers on mobile devices.
- US National Provider Identifiers, with the prefix 80840 added before the check.
- Canadian Social Insurance Numbers.
- Some national identity and account numbers.
Not every numbering scheme uses it. Some issuers assign identifiers under other rules, so a failing string is not proof of a fake number and a passing string is not proof of a real one.