What the Credit Card Luhn Validator does
The Luhn algorithm is the check digit built into almost every payment card number, and this page runs it with every step visible: each digit, whether it was doubled, what it contributes, and whether the total is a multiple of ten. It also names the card scheme the prefix and length point at, and checks a pasted list in one pass.
The arithmetic runs entirely in your browser and nothing is transmitted. Even so, use the schemes' published test numbers rather than a live card - there is no good reason to type a real card number into any web page, and this one is built so it does not need you to.
A Luhn pass is a weak claim and the page says so on every result. Roughly one random sixteen-digit number in ten satisfies the check. It cannot tell you that a card exists, is open, has funds, or belongs to the person presenting it.
How to use it
- Load one of the published test numbers, or type a number with or without spaces. The verdict and the full working appear as you type.
- Read the working table: every second digit from the right is doubled, and any product over nine has nine subtracted from it. The total must be a multiple of ten.
- Check the scheme and length lines together. A number whose prefix says American Express but whose length is sixteen is inconsistent, even when the arithmetic passes.
- Paste a list to check many at once. The table and the CSV export show masked numbers only, never the full digits.
- Open 'Work out a check digit' to see which final digit makes a given prefix satisfy the test - useful for understanding the algorithm.
Reading the results
A pass means the digits are internally consistent. It catches every single mistyped digit and almost every transposition of two adjacent digits, which is exactly what it was designed for in the 1950s.
A fail is decisive: at least one digit is wrong. It cannot say which, because the total is computed over the whole number at once.
The scheme comes from the prefix: 4 is Visa, 51-55 and 2221-2720 Mastercard, 34 and 37 American Express, and so on. Some prefixes belong to more than one scheme because of co-branding, and the page shows all the matches rather than picking one.
UnionPay numbers are not guaranteed to satisfy Luhn, so a failure on a 62-series number is not conclusive. The page flags that rather than reporting a confident wrong answer.
Worked example: the Visa test number, checked by hand
Take 4111 1111 1111 1111. Counting from the right, double every second digit. The rightmost digit is position one and is not doubled; positions two, four, six and so on are.
The eight odd-position digits are all 1, giving 8. Of the eight even-position digits, seven are 1 and double to 2 each, giving 14, and the leftmost is 4, which doubles to 8. The total is 8 + 14 + 8 = 30, a multiple of ten, so the check passes.
Change the final digit to a 2. That digit sits in an odd position and is not doubled, so the total goes from 30 to 31 and the check fails. Now swap the first two digits instead, giving 1411111111111111: the 1 now sits where the 4 was and doubles to 2 rather than 8, while the 4 moves to an odd position and contributes 4 rather than 2. The total becomes 27 and the transposition is caught - which is the whole point of the doubling step.
Formulas and scoring rules
- Luhn (ISO/IEC 7812 mod 10)
double every second digit from the right; if a product exceeds 9 subtract 9; the sum of all contributions mod 10 must be 0Equivalent to subtracting 9 or adding the two digits of the product - they give the same answer for every single-digit input.- Check digit
check = (10 - (sum of the other digits' contributions mod 10)) mod 10Computed with the doubling pattern shifted by one, because adding the check digit changes which positions are even.
Why the check digit exists at all
Hans Peter Luhn patented the algorithm in 1960, when card numbers were read aloud over telephones and punched into machines by hand. The design goal was narrow and it was met: catch the mistakes humans make when copying digits, cheaply enough to do on paper. It is not a security feature and was never meant to be one - the algorithm is public, and generating numbers that pass it is trivial.
That is why a Luhn check belongs at the front of a payment form, next to the length check, and nowhere near a fraud decision. Its job is to tell somebody they have mistyped their card before a declined authorisation appears on their statement.
The five questions, applied to a card number
Is it shaped like a card number? That is the length and prefix check. Do its check digits agree? That is Luhn. Is it in a directory? There is no public one. Which institution issued it? No free source can say reliably. Does the account exist and belong to the person paying? Only an authorisation against the card scheme can answer that, and it is the acquirer's job.
This page answers the first two and points at the prefix for the scheme. If you need the last one, the tools are a zero-value authorisation or an address and CVV check through your payment provider - none of which a static page can do, and all of which involve sending the card number somewhere.
Limitations: what the result does not prove
- Checksum and format only. It cannot tell you that a card exists, is active, has funds, has not been cancelled, or belongs to the person using it.
- Roughly one random number in ten passes the arithmetic, so a pass on its own is weak evidence. Read it alongside the prefix and the length.
- The scheme is read from a dated list of published brand ranges. It names the scheme, never the issuing bank - no free authoritative issuer register exists.
- UnionPay numbers may legitimately fail the Luhn test, so a failure on a 62-series prefix is not conclusive.
- Nothing here should be used with a live card number. Test numbers demonstrate the algorithm just as well.
Privacy: where your data goes
Everything you paste, type or drop is processed in this browser tab. It is not uploaded, logged, stored or sent to analytics. Session recording and tag-manager scripts are switched off on this page.
Standards and sources
- ISO/IEC 7812 - Identification cards: issuer identification numbers - checked 19 Sep 2026
- PCI Security Standards Council - PCI DSS
- Visa - card number structure
Frequently asked questions
How does the Luhn algorithm work?
Starting from the rightmost digit, double every second digit. If a doubled value exceeds nine, subtract nine from it. Add all the resulting values together, and the number is valid if the total is a multiple of ten. The table above shows every step for whatever you enter.
Does passing the Luhn check mean a card is real?
No. About one in ten random numbers of the right length passes, and generating numbers that pass is trivial because the algorithm is public. It catches typing mistakes, which is what it was designed for, and it is not a fraud check.
Can this tool tell me which bank issued a card?
No, and neither can any free tool honestly. It names the scheme from the prefix - Visa, Mastercard, Amex and so on - because those ranges are published. The issuing bank comes from a licensed register, and scraped copies of it name the wrong bank often enough to matter.
Is it safe to enter a card number here?
The page sends nothing anywhere and you can confirm that in your browser's network panel. The safer habit, though, is not to type a live card number into any web page at all - the published test numbers demonstrate the algorithm identically.
Why does my valid card fail the Luhn check?
Almost always a transcription error - a missing digit, an extra one, or a swapped pair. The other possibility is a UnionPay card: UnionPay numbers are not guaranteed to satisfy Luhn, and the page flags 62-series prefixes for that reason.
What is the difference between Luhn and a CVV?
The Luhn digit is part of the card number itself and is computed from the other digits, so anyone can check it. The CVV is printed separately, is not derivable from the number, and is verified only by the issuer. Storing a CVV after authorisation is prohibited by PCI DSS.
How long should a card number be?
It depends on the scheme: 15 for American Express, 16 for Mastercard and most Visa cards, 14 for some Diners Club cards, and up to 19 for others. ISO/IEC 7812 allows up to 19 digits. The page shows the lengths the matched scheme publishes.
Can I use this to generate card numbers?
The check-digit box shows which final digit makes a given prefix satisfy the test, which is how the algorithm is taught. That produces a string, not a card: there is no account behind it, and any authorisation attempt will simply be declined.
Last reviewed by the A2Z.Tools team against the sources listed above.
