How to Validate a Credit Card with the Luhn Algorithm

What the Luhn algorithm checks (and what it doesn't)

The Luhn algorithm — also known as the "mod 10" formula — was created in 1954 by Hans Peter Luhn, an engineer at IBM. It is a check digit scheme: a small piece of arithmetic that catches typos before a number ever leaves your form. Nearly every card network (Visa, Mastercard, Amex, Discover) issues numbers that obey it, standardized in ISO/IEC 7812.

The most common misunderstanding is what Luhn does not do. It never queries a bank. It can't tell you whether a card exists, is active, has funds, or belongs to anyone. A number can sail through the Luhn check and still be entirely made up. All the test guarantees is one thing: the sequence is internally consistent.

That's why Luhn is the first layer of validation, never the last. At checkout it instantly rejects a mistyped number, sparing a pointless round trip to the payment gateway. If you just want to check that consistency without writing any code, paste the number into the Credit Card Validator and read the result on the spot.

The Luhn calculation, step by step

The recipe has four steps. Let's run it on a valid test number: 4539 1488 0343 6467.

1. Start at the rightmost digit (the check digit itself) and move left.
2. Double the value of every second digit — that is, the 2nd, 4th, 6th, counting from the right.
3. If a doubled value exceeds 9, subtract 9 (which is the same as adding its two digits: 16 becomes 1+6 = 7).
4. Add up every resulting digit. If the total ends in zero (divisible by 10), the number is valid.

In our number, the digits sitting in the even positions from the right are 4, 3, 1, 8, 0, 4, 6 and 6. Each one is doubled and, if it goes past 9, reduced:

The doubled digits sum to 8 + 6 + 2 + 7 + 0 + 8 + 3 + 3 = 37. Now add the digits that were not doubled (the odd positions from the right): 7 + 4 + 3 + 3 + 8 + 4 + 9 + 5 = 43.

Grand total: 37 + 43 = 80. Because 80 ends in zero, the number passes the Luhn check. Change a single digit — say 4539 1488 0343 6467 → 4539 1488 0343 6567 — and the sum jumps to 81, no longer divisible by 10, so the number is rejected at once.

One detail that trips people up: always count from the right

Why double starting from the right rather than the left? Because card lengths vary — Visa and Mastercard use 16 digits, American Express uses 15, Diners uses 14. Anchoring the count to the check digit (always the last one) makes the rule work for any length. Double from the left and a 15-digit number would double the wrong digits.

Identifying the brand by BIN/IIN

The opening digits of a card aren't random. They form the IIN (Issuer Identification Number), historically called the BIN (Bank Identification Number). Under ISO/IEC 7812, the first digit is the MII (Major Industry Identifier): 4 and 5 are financial institutions, 3 is travel and entertainment (home of Amex), 6 is merchandising and banking.

The first 6 to 8 digits identify the brand and the issuer. The most common ranges:

This is how a checkout form can show the right brand logo while you're still typing: it reads the leading digits and matches them against these ranges. The Luhn check digit and the BIN lookup are independent checks — one confirms consistency, the other tells you who issued the card.

Test numbers vs real numbers: the legal and ethical line

Because Luhn is a public, deterministic formula, generating numbers that pass it is trivial. Card networks and payment gateways (Stripe, Adyen, Braintree) publish test numbers for exactly this reason: 4242 4242 4242 4242, for instance, is a classic Visa test number that passes Luhn (its sum is 80) and never maps to a real card.

These numbers exist for development and QA: validating the form logic, exercising the error flow, checking the gateway integration in a sandbox. A Credit Card Number Generator produces synthetic, Luhn-valid sequences precisely to feed those tests.

Where Luhn validation shows up in forms and checkout

In practice, Luhn lives in the front end. The moment the card field loses focus, a snippet of JavaScript runs the formula and, if it fails, shows "invalid number" without ever touching the server. It's a cheap check that improves the experience: the customer fixes the typo right away instead of waiting a few seconds for the gateway to decline.

A full checkout flow usually goes:

• Format and Luhn — is the number the right length and does it pass mod 10? If not, an instant error in the browser.
• BIN — do the leading digits match a brand the store accepts? It shows the logo and adjusts the mask (Amex has 15 digits and a 4-digit CVV).
• Authorization — only then do the encrypted details go to the gateway, which asks the issuer whether the transaction is approved. This is where — and only where — you learn if the card is real and has available credit.

Notice how Luhn occupies the first rung and nothing beyond it. It's a typo filter, not a proof of authenticity. To quickly confirm whether a number is well-formed, the Credit Card Validator applies exactly that first rung and even flags the brand from the BIN.

Frequently asked questions

Does passing the Luhn algorithm mean the card is valid?

No. It only means the digit sequence is internally consistent — with no detectable typo. The card may not exist, may be cancelled, or may have no available credit. Only the issuer, at authorization time, confirms whether it's real and works.

Why does the last digit of a card look random?

Because it isn't chosen — it's computed. The check digit is defined as the value that makes the Luhn sum land on a multiple of 10. It exists purely to detect typos in the rest of the number.

Does Luhn protect against fraud?

No. It is not a security or cryptographic algorithm — it's only error detection. Anyone can generate numbers that pass it. Real protection comes from tokenization, the CVV, 3-D Secure, and the issuer's authorization.

Do all card brands use the Luhn algorithm?

Practically all card networks (Visa, Mastercard, American Express, Discover, Diners, JCB) issue numbers that respect Luhn, per ISO/IEC 7812. A few rare historical exceptions existed, but for cards in circulation today the rule holds.

Can I use a generated number to make a purchase?

No. A number that passes Luhn has no account, balance, or authorization behind it. Attempting to use it for a real purchase is fraud. Generators exist to test code in a sandbox, not to transact.