Luhn Algorithm: How Credit Card Numbers Are Validated (1960)

The Red Alert at Checkout

You have been there. Cart loaded, shipping address typed, and then the moment of truth. You start punching in your credit card number, carefully reading each digit off the plastic, and just as you finish, the screen flashes red: "Please enter a valid credit card number."

Your eyes narrow. You check the digits again. There it is. You typed a 6 when you meant to type a 5. One single key, pressed wrong, and the entire checkout process has ground to a halt. You fix it, and suddenly everything goes through smoothly.

But here is the question that lingers: how did the website know? There is no giant database of every valid credit card number on earth sitting on the server. No phone call to your bank was made in that split second. The site did not even need to check with anyone. It just looked at the number you typed and knew, instantly, that something was off.

The answer is pure mathematics. Every credit card number is built with a hidden self-checking mechanism, a quiet little guardian called the Luhn algorithm. It is a simple formula that runs in the background the moment you hit submit, and it is the reason that one wrong digit gets caught before you ever reach the confirmation page.

Who Was Hans Peter Luhn?

Hans Peter Luhn (1896–1964) was an engineer, inventor, and mathematician who spent his most productive years working at IBM. He is best known today for creating the Luhn algorithm, the mathematical check that quietly guards billions of credit card transactions every single day.

Luhn's career was anything but ordinary. He worked on automatic information processing long before computers became household machines, and his ideas helped shape how we retrieve and organize data. But it was in 1954 that he developed the algorithm that would bear his name, a simple yet elegant method for catching typing mistakes in identification numbers. The patent for his invention was granted in 1960, which is why some accounts say he "developed and patented" it in that later year. The record shows the real work happened in 1954, with the patent following six years afterward.

What makes Luhn's creation so remarkable is how little it demands. No massive databases, no instant connections to banks, no complex hardware. Just a short sequence of arithmetic that any card reader, website, or cash register can run in a fraction of a second. That modest tool, born from one engineer's curiosity about information handling, now stands between you and a rejected payment every time you shop online.

Anatomy of a Credit Card Number

Pull any credit or bank card from your wallet and you will see a string of numbers that looks random, but it is anything but. Most cards carry 16 digits, though American Express uses 15. That sequence follows a strict structure designed to be read and verified in seconds.

The first digit alone tells you the network. Visa cards start with 4, MasterCard with 5, and American Express with 3. The next five to seven digits identify the issuing bank or financial institution, pinning your card to a specific lender. The remaining digits, except for the last one, form your personal account number within that bank.

That final digit is the check digit, and it carries no bank information at all. It is calculated mathematically from all the other digits, which is exactly why the Luhn algorithm can validate a card number without ever contacting your bank. The system simply runs the digits through a quick formula and sees if the check digit matches.

How the Luhn Algorithm Works: Step by Step

The Luhn algorithm is a simple mod 10 check that decides whether a credit card number is valid or not. It works by doubling every second digit from the right, adding those results together, and confirming the final sum is a multiple of 10. Here is the step-by-step process.

Start by writing down all the digits except the check digit, which is the last number on the card. Then, working from the right side, double every second digit. If doubling gives you a two-digit number, add those digits together. For example, 7 multiplied by 2 equals 14, and you would treat that as 1 + 4 = 5.

Now add all the single digits together, plus the check digit at the end. If the total is a multiple of 10, the card number passes the test. If not, the number is invalid.

Let's walk through a real example to see this in action. Say the first 15 digits of a 16-digit bank card are 5333 6195 0371 570, and we do not know the last digit yet, so we call it x. After doubling every second digit from the right and summing everything up, we get 48 + x. For this total to be a multiple of 10, x must equal 2, because 48 + 2 = 50, and 50 divides evenly by 10.

Card issuers decide the account number first, then run the Luhn algorithm to figure out what the check digit should be. In this case, since the sum of the first 15 digits came to 48, the issuer knows the final digit has to be 2 to make the whole number valid.

This is why a single mistyped digit gets caught almost instantly at checkout. The system does not need to contact your bank or search a massive database. It just runs the Luhn algorithm, and if the sum does not land on a multiple of 10, the number fails.

There is one small gap in this system though. If you accidentally swap the digits 09 to become 90, or the other way around, the Luhn algorithm will not catch it. That specific transposition slips through the net.

In 1969, Dutch mathematician Jacobus Verhoeff published a study on user errors when entering numbers. He found that about 90 percent of mistakes were either a single wrong digit or two adjacent digits swapped. Verhoeff went on to design his own algorithm that catches more errors than Luhn, including the tricky 09/90 swap, but it never caught on widely because it is more complex to implement.

Where the Luhn Algorithm Falls Short

Passing the Luhn check does not mean a card number is real, only that it is correctly formed. A random string of digits has roughly a one-in-ten chance of passing the check by pure coincidence, so the algorithm serves as a fast first-line filter rather than a guarantee of validity.

Type a single digit wrong while entering your card number and the Luhn algorithm catches it instantly. Swap two adjacent digits and it will usually catch that too. But there is one sneaky exception: the transposition of 09 to 90, or 90 to 09. Because 0 and 9 differ by five, this particular swap slips right past the algorithm undetected.

In 1969, Dutch mathematician Jacobus Verhoeff published a detailed study of how people actually make errors when typing numbers. His research showed that roughly 90 percent of card-entry mistakes come from either a single wrong digit or two adjacent digits swapped around. Verhoeff went on to develop a more sophisticated algorithm that catches every single-digit error and every adjacent transposition, including the tricky 09/90 case. His method was technically superior, yet it never gained widespread adoption. The main reasons were its added complexity and the fact that the Luhn algorithm was already embedded in existing systems and handling the vast majority of errors just fine.

Today the Luhn algorithm is baked directly into popular programming languages and code libraries, which makes adding Luhn-based validation to new software applications remarkably easy. That convenience, combined with decades of reliable service, explains why Hans Peter Luhn's 1954 creation remains the standard despite its known blind spot.