Understanding credit card number validation and the Luhn algorithm
Payment card numbers issued across the globe follow structural and mathematical standards established by the International Organization for Standardization (ISO/IEC 7812). Far from being arbitrary digits, credit card numbers encode the issuing industry, the card network, the specific financial institution, the cardholder account number, and a mathematical verification digit known as the Luhn check digit.
Validating a credit card number instantly catches accidental keystroke errors, transposed numbers, and corrupted digits before a transaction request ever reaches a payment processor. For software developers and QA testers generating synthetic test datasets, pairing this validator with our credit card generator allows end-to-end verification of checkout forms. If you are managing active card debt or planning payment schedules, explore our credit card payoff calculator, calculate monthly carrying costs with our credit card interest calculator, or assess minimum obligations using our credit card minimum payment calculator.
How the Luhn algorithm (Mod 10) checksum works
Developed in 1954 by IBM computer scientist Hans Peter Luhn, the Luhn formula (also known as the Modulo 10 or Mod 10 algorithm) is a public domain checksum formula used worldwide to validate primary account numbers (PANs) on credit cards, debit cards, IMEI numbers, and national identification documents.
The mathematical validation steps
Given a sequence of numerical digits represented as :
- Begin at the rightmost digit (the check digit, position 1 counting from the right) and move leftwards toward the beginning of the number.
- Leave the first digit (the check digit) unaltered. Double the numerical value of every second digit (position 2, 4, 6, 8, etc., from the right).
- If the product of the doubling operation exceeds 9 (meaning it is a two-digit number between 10 and 18), subtract 9 from the product. This produces the identical result as adding the two individual digits together (for example, ).
- Sum all processed values together to compute the total checksum :
The card number is considered mathematically valid under the Luhn algorithm if the total sum is evenly divisible by 10 (its remainder modulo 10 equals zero):
Worked step-by-step validation example
To see the Luhn checksum in action, consider the standard 16-digit Visa card number 4532 7500 1234 5673:
| Position (Left to Right) | Digit | Position from Right | Operation Applied | Added Value |
|---|---|---|---|---|
| #1 | 4 | 16 (Even) | 4 x 2 = 8 | 8 |
| #2 | 5 | 15 (Odd) | Unaltered | 5 |
| #3 | 3 | 14 (Even) | 3 x 2 = 6 | 6 |
| #4 | 2 | 13 (Odd) | Unaltered | 2 |
| #5 | 7 | 12 (Even) | 7 x 2 = 14 (14 - 9) | 5 |
| #6 | 5 | 11 (Odd) | Unaltered | 5 |
| #7 | 0 | 10 (Even) | 0 x 2 = 0 | 0 |
| #8 | 0 | 9 (Odd) | Unaltered | 0 |
| #9 | 1 | 8 (Even) | 1 x 2 = 2 | 2 |
| #10 | 2 | 7 (Odd) | Unaltered | 2 |
| #11 | 3 | 6 (Even) | 3 x 2 = 6 | 6 |
| #12 | 4 | 5 (Odd) | Unaltered | 4 |
| #13 | 5 | 4 (Even) | 5 x 2 = 10 (10 - 9) | 1 |
| #14 | 6 | 3 (Odd) | Unaltered | 6 |
| #15 | 7 | 2 (Even) | 7 x 2 = 14 (14 - 9) | 5 |
| #16 | 3 | 1 (Check Digit) | Unaltered | 3 |
Summing all 16 contributions yields:
Evaluating the modulo 10 remainder: . Because the remainder is exactly 0, the card number passes the mathematical validation check. If any single digit were altered (for example, typing a 5 instead of 3 as the last digit), the sum would become 62, yielding , flagging the number as invalid.
Payment card anatomy: ISO/IEC 7812 standards
Under ISO/IEC 7812, primary account numbers (PANs) are structured into three distinct logical segments:
1. Major Industry Identifier (MII) and Issuer Identification Number (IIN)
The very first digit is the Major Industry Identifier (MII), which signifies the economic sector of the issuing institution:
- 1 and 2: Airlines and financial programs
- 3: Travel and entertainment (American Express, Diners Club, JCB)
- 4: Banking and financial institutions (Visa)
- 5: Banking and financial institutions (Mastercard)
- 6: Merchandising and banking (Discover, China UnionPay, Maestro)
- 7: Petroleum and energy cards
- 8: Telecommunications and healthcare
- 9: National assignments and special testing
The first 6 to 8 digits form the Issuer Identification Number (IIN), historically known as the Bank Identification Number (BIN). This prefix identifies the network, the issuing bank (such as Chase, Citibank, or Barclays), card tier, and country of issue.
2. Individual account number
The intermediate sequence (following the IIN up to the penultimate digit) identifies the unique customer account. Issuers use this variable-length sequence to allocate millions of customer accounts.
3. Luhn check digit
The final digit is the check digit. It is explicitly calculated so that the entire number satisfies the Luhn Mod 10 formula.
Card network identification matrix
Each major card network specifies its own prefix patterns, expected digit lengths, and security code (CVV/CVC) formats:
| Network Brand | IIN / BIN Prefixes | Valid Lengths | CVV Length | Formatting Layout |
|---|---|---|---|---|
| Visa | 4 | 16 (rarely 13 or 19) | 3 digits | 4-4-4-4 |
| Mastercard | 51–55, 2221–2720 | 16 | 3 digits | 4-4-4-4 |
| American Express | 34, 37 | 15 | 4 digits (front) | 4-6-5 |
| Discover | 6011, 622126–622925, 644–649, 65 | 16 (or 19) | 3 digits | 4-4-4-4 |
| JCB | 3528–3589 | 16 to 19 | 3 digits | 4-4-4-4 |
| Diners Club | 300–305, 36, 38 | 14 (or 16) | 3 digits | 4-6-4 |
| UnionPay | 62 | 16 to 19 | 3 digits | 4-4-4-4 |
| Maestro | 50, 56–58, 6 | 12 to 19 | 3 digits | 4-4-4-4 |
Mathematical validation vs payment authorization
It is essential to understand the difference between algorithmic validation and live payment authorization:
- Offline mathematical validation: The Luhn algorithm verifies that a number follows legitimate formatting rules and contains no typos. It does not verify whether the card exists, whether it is currently active, or whether the account possesses available credit limit.
- Online bank authorization: When a customer submits a purchase, the payment gateway sends an encrypted request to the acquiring bank, the card network (such as Visa or Mastercard), and the issuing bank. The issuing bank confirms that the card is active, verifies the CVV and expiration date, checks fraud scores, and ensures sufficient funds.
- Keystroke error prevention: Implementing client-side Luhn checks in e-commerce checkout forms prevents customers from submitting mistyped numbers. This cuts unnecessary gateway API calls and decreases abandoned checkouts caused by minor typing errors.
Frequently asked questions
Does passing the Luhn algorithm mean the card is real and has available funds?
What types of user input errors does the Luhn algorithm catch?
Why does American Express have 15 digits instead of 16?
Can I validate multiple credit card numbers at once?
Is it safe to paste real credit card numbers into this online tool?
How can I calculate loan payments and interest rates for credit card balances?
Resources and references
The formulas and methods in this calculator were checked against these independent sources.