How checksums work
Card numbers, IBANs, tax IDs and crypto addresses all carry a hidden extra digit or two, computed from the others. Mistype one character and the arithmetic no longer adds up — which is how a validator can flag a typo instantly, offline, without ever asking a bank or a blockchain.
What a checksum is
A checksum (or check digit) is redundancy on purpose. When a number is issued, one or more of its digits are not chosen freely: they are calculated from the rest by a fixed recipe. Anyone who knows the recipe can later recompute those digits and compare. If they match, the number is internally consistent. If they do not, something was mistyped, misread or corrupted.
That is all a checksum promises. It says nothing about whether the account exists, who owns it or what it holds — a point every validator on this site repeats, because the two are easy to confuse.
Worked example 1 — Luhn, the card-number algorithm
Luhn is used by Visa, Mastercard and most other payment cards. Take the classic example
7992 7398 713. Starting from the rightmost digit, double every second digit; if doubling
gives a two-digit number, add its digits together. Then sum everything.
| Digit | Position from right | Doubled? | Counts as |
|---|---|---|---|
3 | check digit | — | 3 |
1 | 2nd from right | 1 × 2 = 2 | 2 |
7 | 3rd | — | 7 |
8 | 4th | 8 × 2 = 16 → 1 + 6 | 7 |
9 | 5th | — | 9 |
3 | 6th | 3 × 2 = 6 | 6 |
7 | 7th | — | 7 |
2 | 8th | 2 × 2 = 4 | 4 |
9 | 9th | — | 9 |
9 | 10th | 9 × 2 = 18 → 1 + 8 | 9 |
7 | 11th | — | 7 |
The column on the right adds up to 3 + 2 + 7 + 7 + 9 + 6 + 7 + 4 + 9 + 9 + 7 = 70. Seventy is divisible by ten, so the number is valid. Change any single digit and the total stops being a multiple of ten. Try it on the Credit Card Validator — it runs this exact arithmetic on your device.
Worked example 2 — a weighted sum (ISBN-10)
Many national ID numbers use a weighted sum: multiply each digit by a fixed weight, add them up and
check the remainder. ISBN-10 is the cleanest illustration. For 0-306-40615-2 the weights run
from 10 down to 1:
0×10 + 3×9 + 0×8 + 6×7 + 4×6 + 0×5 + 6×4 + 1×3 + 5×2 + 2×1 = 132
132 is exactly 11 × 12, so the remainder modulo 11 is zero and the ISBN is valid. Brazil's CPF, Poland's PESEL and dozens of other identifiers follow the same pattern with their own weights and modulus — which is why one batch validator can check thousands of them in a second.
Worked example 3 — IBAN and mod 97
International bank account numbers use ISO 7064 mod 97-10, a stronger scheme with two check digits. Take
the standard example GB82 WEST 1234 5698 7654 32:
- Check the length for the country: a British IBAN is 22 characters. ✓
- Move the first four characters to the end:
WEST12345698765432GB82. - Replace every letter with two digits (A = 10 … Z = 35): W→32, E→14, S→28, T→29, G→16, B→11, giving
3214282912345698765432161182. - Divide that number by 97. The remainder must be exactly 1 — and it is.
Because 97 is prime and larger than any two-digit swap, mod 97 catches every single-character error and every transposition; only about one random string in 97 would pass by luck. The IBAN Validator shows each of these layers passing or failing.
Crypto addresses: checksums built from hashes
Bitcoin and Ethereum addresses raise the bar, because a typo there sends money to nobody, permanently.
Legacy Bitcoin addresses (1…, 3…) use Base58Check: the address payload is run
through SHA-256 twice and the first four bytes of the result are appended as a checksum. A single wrong
character changes the hash completely, so the odds of a typo slipping through are about one in four
billion. Newer bc1… addresses use Bech32 or Bech32m, an error-correcting code that
guarantees detection of any mistake touching up to four characters. Ethereum's EIP-55 hides its
checksum in the pattern of upper- and lower-case letters.
The Bitcoin Address Validator and Ethereum Address Validator implement these algorithms in the browser and verify themselves against the official test vectors on every page load.
Schemes at a glance
| Scheme | Used by | Catches | Chance a random error passes |
|---|---|---|---|
| Luhn (mod 10) | Credit & debit cards, IMEI, many national IDs | Every single-digit error and most adjacent swaps | About 1 in 10 |
| ISO 7064 mod 97-10 | IBAN, some tax and company numbers | Every single error and every transposition | About 1 in 97 |
| Weighted sum, mod 10 or 11 | ISBN-10, Brazil CPF, Poland PESEL and many IDs | Single errors and most transpositions | About 1 in 10 or 1 in 11 |
| Base58Check (double SHA-256, 4 bytes) | Bitcoin legacy addresses (1…, 3…) | Any typo, with overwhelming probability | About 1 in 4 billion |
| Bech32 / Bech32m (BCH code) | Bitcoin SegWit & Taproot addresses (bc1…) | Guaranteed: any error touching up to 4 characters | Below 1 in a billion |
| EIP-55 (keccak-256 casing) | Ethereum addresses | Typos, via the pattern of upper- and lower-case letters | Very low for mixed-case input |
Why a validator should run on your device
Everything above is arithmetic on digits you already have. There is no reason for a validator to send a card number, a tax ID or a wallet address to a server — and a very good reason not to. Every validator on this site runs locally; the offline tools list groups them, and our guide to checking whether a tool uploads your data shows how to confirm that for any site in twenty seconds.
FAQ
Does a valid checksum mean the number is real or active?
No. A checksum only proves the digits are internally consistent — that the number could exist. It cannot tell you whether the account is open, who owns it, or what its balance is. Every validator on this site says so on the page, because that distinction matters.
How likely is it that a wrong number still passes?
It depends on the scheme. A single mod-10 check digit lets roughly 1 random error in 10 through; IBAN's mod 97 lets about 1 in 97 through; a 4-byte Base58Check checksum lets about 1 in 4 billion through. The important property is that the common human mistakes — one wrong digit, two swapped digits — are caught by all of them.
Why do some identifiers have no checksum at all?
Older or simpler schemes were designed to be looked up in a registry rather than checked offline, and some numbering systems simply predate the practice. For those, a validator can only check length and format.
Is it safe to paste my card or ID number into a validator?
Only if the validation runs on your device. A checksum is arithmetic on digits you already have, so there is no legitimate reason for a validator to send them to a server. You can confirm a tool runs locally with the airplane-mode test described in our guide to checking whether a tool uploads your data.
What is the difference between a checksum, a hash and encryption?
A checksum is a short check digit designed to catch accidental typos. A cryptographic hash is a long fingerprint designed so that even a deliberate change is detectable and the original cannot be recovered. Encryption transforms data so it can be read only with a key. Base58Check uses a hash to build its checksum, which is why it is so hard to fool by accident.