Luhn Validator (generic)

The Luhn algorithm: 1960 IBM patent that protects half the digital world

The Luhn algorithm — also called modulo 10 or mod 10 — is a simple checksum that detects nearly every accidental single-digit error in a numeric identifier. Invented by IBM scientist Hans Peter Luhn and patented in 1960 (US patent 2,950,048), it expired into the public domain decades ago and became the de facto checksum for credit cards, IMEI, Canadian SIN, US National Provider Identifier and dozens of other ID schemes that need a cheap, offline integrity check.

Despite its age, Luhn remains the right tool for the job whenever the goal is to catch typos and misreads — not to authenticate or detect malicious tampering. It is intentionally not a cryptographic hash: a determined attacker can craft any number of valid sequences. The job of the checksum is to stop the cashier mistyping one digit of a card number, or the OCR scanner misreading an IMEI.

The algorithm in four steps

1. From the rightmost digit, double every second digit.
2. If a doubled value exceeds 9, subtract 9 (equivalent to summing its two digits).
3. Sum all transformed digits, including the rightmost one which is never doubled.
4. The sequence is valid if the total is a multiple of 10.

Worked example on 79927398713: from the right, the digits in even positions are 1, 8, 3, 2, 9; doubled and reduced they become 2, 7, 6, 4, 9; summed with the untouched 3, 7, 9, 7, 9, 7 the total is 70; 70 mod 10 = 0; valid.

Reference JavaScript implementation

function luhn(str) {
  let sum = 0, alt = false;
  for (let i = str.length - 1; i >= 0; i--) {
    let n = parseInt(str[i], 10);
    if (alt) { n *= 2; if (n > 9) n -= 9; }
    sum += n;
    alt = !alt;
  }
  return sum % 10 === 0;
}

Production libraries that already bundle a battle-tested Luhn: validator.isCreditCard, card-validator, the creditcards npm package, and Apache Commons LuhnCheckDigit in Java. They add card-brand detection (BIN ranges) on top of the raw checksum.

Where Luhn is used (and where it is not)

• Credit and debit cards: Visa, Mastercard, American Express, Discover, JCB, UnionPay, Diners — every brand on the planet uses Luhn for the PAN.
• IMEI: 15-digit mobile handset identifier.
• Canadian SIN (Social Insurance Number) — 9 digits.
• US National Provider Identifier (NPI) — healthcare provider IDs.
• South African ID, Greek AMKA, Israeli Teudat Zehut.
• Not used for Brazilian CPF, CNPJ or PIS: those rely on modulo 11, which catches a wider error class at the cost of producing an X for remainder 10.

What Luhn does NOT catch

Mod 10 is not bullet-proof. Specifically:

• Twin errors: 22 -> 33, 44 -> 55 — same digit replaced twice produces the same checksum. Luhn misses ~1.7 percent of these.
• Specific transpositions: swapping 09 with 90 and a handful of others slip through.
• Existence: a Luhn-valid PAN can still be unissued, expired, frozen or stolen. PCI-DSS forbids storing the full PAN client-side even after Luhn passes.
• Authenticity: phishing kits trivially print Luhn-valid numbers — never use the checksum as the only fraud signal.

For real card verification, combine the BIN (first 6 digits) + last 4 + AVS + 3D Secure + tokenization at the acquirer. The Luhn step is purely a client-side guard against typos.

FAQ

Does the Luhn algorithm catch all typos? No. It catches every single-digit substitution and most adjacent transpositions, but misses twin errors and a few rare swaps. Empirically it filters about 95 percent of accidental typos.

Is Luhn used for Brazilian CPF? No. CPF, CNPJ and PIS use modulo 11 with two check digits, which catches a wider class of errors at the cost of occasionally producing remainder 10 (treated as 0 in CPF/CNPJ, as X in ISBN-10).

Which card brands use Luhn? All of them — Visa, Mastercard, American Express, Discover, JCB, UnionPay, Diners, Hipercard, Elo and so on. The brand is distinguished by the BIN (first 6 digits), not by the checksum.

Can I generate a Luhn-valid number? Yes — by definition, any 14-digit prefix admits exactly one final digit that closes the checksum. That is precisely why Luhn alone is never a fraud defense.

Is the Luhn patent still in force? No. US 2,950,048 was filed in 1954, granted in 1960 and expired in 1977. The algorithm has been in the public domain for nearly half a century.