How the Luhn Algorithm Works — and What It Can't Tell You
The checksum behind every card number, what the IIN prefix reveals, and why a number that passes validation still might not be chargeable.
The last digit of your card number isn’t part of the account. It’s a checksum, calculated from the other digits, and its only job is to catch you fat-fingering the form.
Hans Peter Luhn worked that out at IBM in 1954 and filed a patent for it. The patent expired long ago and the algorithm is public domain, which is why it ended up everywhere: card numbers, IMEI numbers on phones, Canadian social insurance numbers, US National Provider Identifiers.
What the checksum does
Go right to left. Double every second digit. If doubling gives you something over 9, subtract 9. Add everything up. A valid number lands on a multiple of 10.
That’s it. There’s no cryptography here and nothing secret about the method — anyone can run it in a few lines of code.
What makes it worth the trouble is what it catches. Every single-digit error, always. And every transposition of two neighbouring digits, with exactly one exception: swapping 09 and 90 produces the same sum, so that one slips through. For a checksum from the punch-card era, that’s a decent hit rate against the two mistakes people actually make when typing sixteen digits.
The practical effect is that a checkout form can reject a typo before it goes anywhere near a payment network. No round trip, no declined transaction on your statement, no wondering whether the bank blocked you.
What the first digits say
Card numbers follow ISO/IEC 7812. The first digit is the industry: 4 and 5 are banking and financial, 3 is travel and entertainment — which is why Amex, Diners Club, and JCB all start with a 3.
The leading block identifies the issuer. It used to be six digits, called the IIN. ISO extended it to eight in 2017, and Visa and Mastercard set April 2022 as the switchover date for their networks, which quietly broke a lot of BIN-lookup tables that had hardcoded six.
Brand detection works by matching that prefix against published ranges. It’s reliable for the big networks and less so at the edges: co-branded cards and regional issuers sometimes sit outside the ranges you’d expect. The Credit Card Validator shows the detected network alongside the raw IIN, so when the brand looks wrong you can see exactly what it matched on.
The part people get wrong
Passing Luhn means the digits are self-consistent. Nothing more.
It doesn’t mean an account exists. It doesn’t mean the card is active, unexpired, or has a balance. You can invent a sixteen-digit number, tack on the right check digit, and it will validate perfectly while corresponding to nothing at all. That’s precisely why processors publish test numbers like 4111 1111 1111 1111 — they’re structurally valid and deliberately hollow.
Only the issuing bank can answer the real questions, and only through an authorisation request. Client-side validation is a typo filter sitting in front of that, nothing else.
Which is also a good argument for doing the check in the browser. There’s no reason for a card number to touch a server just to have its arithmetic verified. This tool never sends one anywhere: no request, no logging, no storage. Use test numbers where you can anyway — check one here and watch the breakdown update as you type.