How does the Luhn algorithm work and why does it catch about one digit in ten errors?
Executive summary
The Luhn algorithm is a simple "mod 10" checksum that validates identification numbers by doubling every second digit from the right, summing digit-values (subtracting 9 for doubled digits >9), and checking that the total is a multiple of 10; this structure guarantees it catches every single-digit mistype and almost all adjacent-digit swaps (with a few specific exceptions) [1][2]. At the same time, because it is only a modulus-10 checksum, a wholly random or deliberately forged number has a one-in-ten chance of producing a valid checksum — hence the statement that about one digit in ten errors will slip past Luhn checking [3][4].
1. How the algorithm actually works — the step-by-step trick that feels like magic
Starting from the rightmost digit (the check digit), Luhn doubles every second digit, replaces any doubled result greater than 9 by subtracting 9 (equivalently summing the two decimal digits), then adds those transformed digits to the untouched digits and tests whether the total modulo 10 equals zero; if it does, the number passes the Luhn check [1][5]. This arithmetic is intentionally lightweight so terminals and browsers can validate input instantly before contacting a backend service, and the check digit is typically appended as the final (rightmost) digit of the full number [6][7].
2. Why single-digit errors are always caught — a consequence of unique contributions
Any single-digit substitution changes the total sum by a nonzero amount that can never be exactly a multiple of 10 because each digit’s contribution to the checksum is unique under the Luhn weighting (digits are either multiplied by 1 or effectively by 2 with the -9 normalization), so flipping one digit always alters the final sum mod 10 and therefore fails the check [3][4]. Educational treatments and textbooks emphasize this property: Luhn was designed to protect against common human entry mistakes such as mistyping a single digit [2][8].
3. Why almost all adjacent transpositions are detected — and where it fails
Because adjacent digits receive different weights (one is doubled, the other is not), swapping two neighbors usually changes the weighted sum and thus is detected; careful counting shows that among the 90 possible ordered pairs of two distinct digits (00–99 excluding equal-digit pairs), only two specific swaps — 09 ↔ 90 — leave the total unchanged under Luhn’s weighting and therefore slip through, giving an effective adjacent-transposition detection rate of roughly 97.8% for neighboring-digit swaps [3][9]. Sources repeatedly note the exception of 09/90 as the canonical blind spot for Luhn [2][1].
4. Why “one in ten” keeps appearing — the modulus-10 inevitability
If a number is random or entirely corrupted (not just one digit changed), the Luhn check reduces the many possible error patterns to their residue class modulo 10; because the check accepts exactly one out of every ten residue classes, a random wrong number will pass with probability 1/10. Expositions on the algorithm and classroom analyses make this explicit: the modulus-10 nature implies a one-chance-in-ten that a random sequence will nonetheless satisfy the checksum by coincidence [3][1].
5. What Luhn is good for — and what it is not (alternatives and caveats)
Luhn’s virtue is simplicity and effectiveness against the most common human entry errors, which is why it is used for credit cards, IMEIs and many ID numbers [2][6]; but it is not a security or authentication mechanism and offers no defence against stolen-but-valid numbers or deliberate forgeries beyond the 1/10 randomness limit [10][7]. For higher guarantees (catching the 09/90 swap and other exotic mistakes) stronger check codes such as the Verhoeff algorithm exist and are well-documented alternatives [4]. The reporting reviewed provides consistent technical explanation and highlights both strengths and blind spots rather than exaggerated claims — for example, claims of 99.9% typo detection should be treated skeptically against the analytical counts that give exact figures for single-digit and transposition detection and the 1-in-10 random-pass property [10][3].