The Luhn algorithm test is a mod-10 checksum that tells you whether a string of digits is internally consistent. It catches most single-digit typing errors and most swapped neighboring digits, and it returns a pass or a fail. What it does not do is confirm that the number belongs to a live account, that a card is active, or that the digits were ever issued to anyone.
What the Luhn test checks
Hans Peter Luhn, a researcher at IBM, patented the formula in the 1950s as a way to protect punched-card and account numbers from transcription mistakes. The check digit is the final digit of the number, and it is calculated from every digit that comes before it. When a system receives a number, it recomputes the sum and compares the result against that final digit. If the total is a multiple of 10, the number passes.
How to run a Luhn test in four steps
- Write out the digits in order, ignoring spaces and hyphens.
- Starting at the rightmost digit, which is the check digit, move left and double the value of every second digit.
- If a doubled value is greater than 9, subtract 9 from it. This is the same as adding the two digits of the result together.
- Add every value. If the total ends in 0, the number passes the Luhn test.
A worked example
Take the digit string 79927398713, a common teaching example. Reading from the right, the doubled positions hold 1, 8, 3, 2 and 9. After doubling and reducing, those become 2, 7, 6, 4 and 9, which add up to 28. The digits left untouched, 3, 7, 9, 7, 9 and 7, add up to 42. The combined total is 70, so the string passes.
Now change one digit, turning the 8 into a 9. The doubled value becomes 18, which reduces to 9 instead of 7, and the total rises to 72. Since 72 is not a multiple of 10, the test fails and the typo is flagged before the number ever reaches a database.
Why the position of the check digit matters
Doubling starts from the right. For an even-length number the digits in odd positions from the left get doubled, and for an odd-length number the even positions do. This parity rule explains why a 16-digit card number and the 11-digit example above are processed differently even though the formula is identical.
What the Luhn check cannot do
- It cannot confirm that an account is open, funded, or authorized for a transaction.
- It cannot catch every error. Swapping 09 for 90 still passes, and some pairs of mistakes cancel each other out.
- It has no knowledge of issuer prefixes, so a string of the right length with the right final digit will pass.
- A random final digit matches the required value about one time in ten, so coincidental passes are common.
Where Luhn check digits appear
- Payment card numbers, covered by the ISO/IEC 7812 standard for primary account numbers.
- IMEI numbers that identify mobile devices, per ITU-T E.212.
- National Provider Identifier numbers used by US healthcare providers.
- Canadian Social Insurance Numbers, older ISBN-10 codes, and various loyalty and account identifiers.
Running a Luhn test without doing the math by hand
Spreadsheets handle the calculation with a few nested functions, and most programming languages have a short published implementation. Payment sandboxes also publish test numbers that are built to pass the Luhn check, which is the appropriate way to exercise a checkout form or a validation routine during development.
Frequently asked questions
Does a number have to be 16 digits to pass?
No. The formula works on any length. Card numbers commonly run from 13 to 19 digits, IMEI numbers are 15 digits, and NPI numbers are 10.
Can a number pass the Luhn test and still be invalid?
Yes, and this is the point to remember. The check digit guards against typing mistakes and nothing else. A routine that stops at the Luhn check is validating a format, not an account, so any string built to satisfy the formula will pass it.
Is the Luhn algorithm the same as a mod-10 check?
Yes, the terms describe the same process. Documentation also calls it the Luhn formula, the Luhn check, or the modulus 10 algorithm.
The bottom line
A Luhn algorithm test answers one narrow question: are these digits arranged so that the check digit matches the rest of the string? It is a useful filter for typos at the point of entry. It is not a verification of identity, ownership, or account status, and it should not be treated as one.