Validation Algorithms

Credit Card Numbers

This code sample demonstrates the algorithm for validating a credit card number. Almost all credit card companies use the same method for generating card numbers.

In this method, the last digit of the card number is a checksum. The other digits are generally used to identify the card company, the financial institution that issued the card, the customer account number, etc. They follow whatever coding scheme that particular card company chooses.

The last digit, however, is generated by performing a fixed set of calculations on the other digits. For almost all credit cards, the Luhn Formula is used. This algorithm generates a single digit which is then used as the last digit of the card number. By performing the same calculations, you can determine if the number matches the checksum digit.

You can try it below. Don't worry, the form data is not sent anywhere. It merely triggers a call to the JavaScript function to check the number (you can view the page source to see this for yourself).

Note that if a number passes this test, it does not necessarily mean that it is definitely valid. Usually, other checks should be made to determine if the card number is acceptable.

These may include checking the total number of digits, the number prefix, etc. The table below shows acceptable values for some of the major credit cards.

Even when these are correct, it does not guarantee that a given card is good. The account number may be unused or have been revoked or be over its limit.

Algorithm for the Luhn Formula

Here's how the algorithm for the Luhn formula works. Starting with a given credit card number,

1 2 3 4 - 5 6 7 8 - 9 0 1 2 - 3 4 5 2

we reverse the number, removing any non-numeric characters, to create a new string of digits like this (note that the checksum is now the first digit):

2 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1

Now we'll look at each individual digit. Starting with the second digit in the string, we double every other number. The others are left alone.

2 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1

This creates a new string of digits shown here:

2 10 4 6 2 2 0 18 8 14 6 10 4 6 2 2

Finally, we go through this new string and add up each single digit to produce a total. In other words, for this example, we don't add 2 + 10 + ... but 2 + 1 + 0 + ... instead:

2 + 1 + 0 + 4 + 6 + 2 + 2 + 0 + 1 + 8 + 8 + 1 + 4 + 6 + 1 + 0 + 4 + 6 + 2 + 2 = 60

If this sum is an integer multiple of 10 (e.g., 10, 20, 30, 40, 50,...) then the card number is valid, as far as the checksum is concerned.

Here is the JavaScript code to sum the digits, where r represents the card number as a string of digits already in reverse order.

  // Run through each single digit to create a new string. Even digits
  // are multiplied by two, odd digits are left alone.

  t = "";
  for (i = 0; i < r.length; i++) {
    c = parseInt(r.charAt(i), 10);
    if (i % 2 != 0)
      c *= 2;
    t = t + c;
  }

  // Finally, add up all the single digits in this string.

  n = 0;
  for (i = 0; i < t.length; i++) {
    c = parseInt(t.charAt(i), 10);
    n = n + c;
  }

Once the sum is found, the code checks to see if it's an even multiple of ten (i.e., n % 10 leaves no remainder).

  // If the resulting sum is an even multiple of ten (but not zero), the
  // card number is good.

  if (n != 0 && n % 10 == 0)
    return true;
  else
    return false;
}

Programming Note

You may have noticed that the checksum digit (2) is included in the sum. Rather than adding up the other digits and calculating the valid checksum value for comparison, it's included in the total to save some programming steps.

In other words, if you were creating a new card number and wanted to find the right checksum digit, you'd total up the other digits as shown above except that you wouldn't have the initial digit (2).

1 + 0 + 4 + 6 + 2 + 2 + 0 + 1 + 8 + 8 + 1 + 4 + 6 + 1 + 0 + 4 + 6 + 2 + 2 = 58

Using the total (58) you'd take the next highest number that is evenly divisible by ten and subtract the total from this to produce the proper checksum digit (60 - 58 = 2 in this case).

If the total was already an even multiple of ten, say 70, the checksum would simply be zero.

To save a couple of steps in the code, the checksum digit is included in the calculation so that the sum should be an integer multiple of ten.

Prev