What a Luhn check test does
A Luhn check test runs the Luhn algorithm, also called the mod 10 algorithm, against a string of digits. It returns one result: the string has a valid check digit, or it does not. Hans Peter Luhn, an IBM engineer, filed the method in 1954 and received US Patent 2,950,048 in 1960. ISO/IEC 7812 names it as the check-digit method for payment card numbers. The same method covers IMEI numbers, National Provider Identifiers, Canadian Social Insurance Numbers, and several airline record locators.
How the algorithm works
- Read the digits from right to left.
- Double every second digit, starting with the digit in the second position from the right. The rightmost digit is the check digit and is not doubled.
- If a doubled value is 10 or more, subtract 9. This equals the sum of the two digits of the product.
- Add the doubled values and the digits you left alone.
- If the total ends in 0, the number passes. Any other final digit fails.
Worked example
Take 79927398713. Digits from the right: 3, 1, 7, 8, 9, 3, 7, 2, 9, 9, 7. Double the digits in positions 2, 4, 6, 8, and 10. The 1 becomes 2. The 8 becomes 16, then 7. The 3 becomes 6. The 2 becomes 4. The 9 becomes 18, then 9. Add everything: 3 + 2 + 7 + 7 + 9 + 6 + 7 + 4 + 9 + 9 + 7 = 70. 70 mod 10 = 0, so the number passes.
To find a missing check digit, run the same steps on the digits left of the final position, then choose the digit that makes the total a multiple of 10. For the payload 7992739871 the processed digits total 67, so the check digit is 3.
A second case: 4242424242424242 passes. The eight 2s add 16. Each 4 doubles to 8, and eight of them add 64. The total is 80.
What the test does not tell you
- It does not confirm the account exists, is open, or holds funds.
- It does not confirm an issuer assigned the number or that the number falls in a live range.
- It does not read the expiration date, cardholder name, or security code.
- It does not authorize a transaction. Only the issuer does that.
Any digit string with the correct final digit passes. A random 16-digit string passes about one time in ten. A failure does show that at least one digit is wrong.
Running a test
Most implementations take a string, strip spaces and hyphens, reject characters that are not digits, and return a boolean. Test suites use confirmed values. 79927398713 and 4242424242424242 pass. 79927398710, 79927398711, 79927398712, 79927398714, 79927398715, 79927398716, 79927398717, 79927398718, and 79927398719 fail. Edge cases to include: an empty string, a single digit, a string of zeros, and leading zeros.