What Is a Checksum and Why Does It Work?

Type your credit card number into a website with one digit wrong, and it's often rejected instantly, before anything is sent to your bank. The website isn't looking up your card. It's doing a quick calculation on the digits themselves.

The last digit of your card number is a check digit, computed from the others. That small piece of redundancy catches most typos in milliseconds. Barcodes, book numbers, bank accounts, network packets and ZIP files all use the same idea: a checksum.

One Extra Digit Can Catch Every Single-Digit Typo

It seems like detecting errors would require storing a lot of extra information. It doesn't. A single, well-designed check digit can detect every error where one digit is mistyped, and most errors where two neighboring digits are swapped.

The secret is choosing a calculation where changing any one digit is guaranteed to change the result.

The Simplest Checksum: Parity

Add one bit so the total number of 1s is even:

Data: 1011001  (four 1s)  → parity bit 0 → 10110010

If any single bit flips, the count becomes odd, and the error is detected. But if two bits flip, it goes unnoticed. Parity is the most basic form of error detection.

The Luhn Algorithm: Credit Cards

In 1954, IBM scientist Hans Peter Luhn filed a patent for a handheld device to validate identification numbers; it was granted in 1960. His method is now used for virtually all credit card numbers.

To check a number:

1. Starting from the rightmost digit, double every second digit
2. If doubling gives more than 9, subtract 9
3. Add all the digits
4. The number is valid if the total is divisible by 10

Example: 79927398713

Digits (right to left):  3  1  7  8  9  3  7  2  9  9  7
Double every second:     3  2  7  16 9  6  7  4  9  18 7
Subtract 9 if > 9:       3  2  7  7  9  6  7  4  9  9  7
Sum = 70  →  70 mod 10 = 0  ✓ valid

Swap the last two digits to 79927398731 and the check fails.

What Luhn catches: every single-digit error, and almost every swap of adjacent digits. It misses the swap 09 ↔ 90, because both contribute the same total.

ISBN-10: The Power of a Prime

Older 10-digit ISBNs use weights 10, 9, 8, …, 1 and modulo 11:

10d₁ + 9d₂ + 8d₃ + … + 2d₉ + 1d₁₀ ≡ 0 (mod 11)

For 0-306-40615-?:

10×0 + 9×3 + 8×0 + 7×6 + 6×4 + 5×0 + 4×6 + 3×1 + 2×5 = 130
130 mod 11 = 9, so the check digit is 2   (130 + 2 = 132 = 12 × 11)

Since check digits can be 10, ISBN-10 uses the symbol X for 10.

Why modulus 11? Because 11 is prime. That guarantees ISBN-10 catches every single-digit error and every swap of two digits, even non-adjacent ones. With a prime modulus, multiplying a non-zero error by a non-zero weight can never give 0. Verify primality with the prime checker.

The newer ISBN-13 uses alternating weights 1 and 3 with modulus 10, matching retail barcodes, and loses a little of that error-catching power.

UPC Barcodes

A 12-digit UPC barcode multiplies the digits in odd positions by 3 and even positions by 1. The check digit makes the total divisible by 10. For 03600029145?, the weighted sum is 58, so the check digit is 2.

Scanners read barcodes with lasers or cameras. If a smudge changes a single digit, the checksum fails and the scanner beeps for a rescan instead of charging for the wrong product.

CRC: Checksums for Data

For files and network data, simple sums aren't strong enough. Cyclic redundancy checks (CRCs), introduced by W. Wesley Peterson in 1961, treat the data as a giant polynomial with binary coefficients and divide it by a fixed generator polynomial. The remainder is the checksum.

Data bits:   1101011011  → polynomial x⁹ + x⁸ + x⁶ + x⁴ + x³ + x + 1
Divide by a generator such as x³ + x + 1 (bits 1011)
Remainder:   the CRC

The arithmetic is done in binary without carries, so addition and subtraction are both XOR, which makes CRCs extremely fast in hardware. CRC-32 protects Ethernet frames, ZIP archives and PNG images. A well-chosen CRC detects all burst errors shorter than its length. Explore binary with the binary to decimal converter.

An Insider Reference: The Verhoeff Algorithm

Luhn's method misses some transpositions. In 1969, Dutch mathematician Jacobus Verhoeff set out to design a decimal check digit that catches all single-digit errors and all adjacent swaps.

He showed it can't be done with ordinary addition modulo 10. Instead, he used the dihedral group D₅, the symmetries of a regular pentagon, which has exactly 10 elements but isn't commutative. Because a·b ≠ b·a in D₅, swapping two digits changes the result. The Verhoeff algorithm is used in some ID numbers, including India's Aadhaar identity numbers.

Checksums vs. Hashes vs. Error Correction

Checksums detect accidents, not attacks: an attacker can easily change data and recompute a CRC. For tamper detection, you need a cryptographic hash. See Hash Functions: The Mathematics Behind Modern Software.

Two Concepts Worth Knowing

Modular Arithmetic

Nearly every check digit is a rule of the form "weighted sum ≡ 0 (mod m)." Choosing the weights and modulus determines which errors are guaranteed to be caught. See the number theory formulas.

Redundancy

Redundancy is extra data derived from the original. A check digit adds a small amount of redundancy that makes errors visible without storing the data twice.

Quick Answer: What Is a Checksum?

A checksum is a small value calculated from data and stored alongside it. When the data is read or received, the checksum is recalculated; if it doesn't match, an error occurred. Credit cards use the Luhn algorithm, ISBNs use weighted sums modulo 11 or 10, and network data uses cyclic redundancy checks.

Try Them Yourself

• Binary to Decimal Converter: the bits behind CRCs
• Is 11 Prime?: why ISBN-10 uses mod 11
• Number Theory Formulas: congruences and remainders
• Division Tables: compute remainders quickly
• The Mathematics of Modular Arithmetic: the theory behind check digits
• How Error-Correcting Codes Make Digital Communication Possible: going from detecting errors to fixing them

Grab any book and run its ISBN through the checksum formula by hand. Then change one digit and watch the check fail.