ISIN validator

What an ISIN is

An ISIN is the twelve-character code that identifies a specific security worldwide. It is defined by ISO 6166 and made of three parts: a two-letter prefix, a nine-character national number assigned by the local numbering agency, and a single check digit at the end.

The prefix is almost always an ISO 3166 country code, so a US share starts US and a British one starts GB. There are a few reserved exceptions, and the important one is XS, used for international securities cleared through Euroclear or Clearstream. Most eurobonds carry it, so any validator that insists the prefix must be a country is wrong about a large slice of the market.

The check digit is the Luhn algorithm, the same one behind bank card numbers. It is not applied to the ISIN as you read it, though. Every letter is first replaced by two digits, A becoming 10 through Z becoming 35, and the Luhn sum runs over that expanded string. Apple's US0378331005 becomes 3028037833100 before a single addition happens, which is why the arithmetic never looks like it matches the code in front of you.

How to use it

1. Paste or type the ISIN. Spaces, hyphens and lowercase are all fine. Twelve characters is the only requirement.
2. Read the breakdown. It names the prefix, separates the national number, and shows the expanded digit string the check digit is actually computed over.
3. Check whether your code has a twin. If reversing the first two letters produces another real prefix, the tool shows you that code, because it is valid too and no check digit anywhere will tell you which one you meant.

The transposition that can never be caught

A check digit exists to catch typing mistakes, and the commonest typing mistake is swapping two adjacent characters. ISIN catches most of them. It cannot catch one particular kind, and the failure is total rather than occasional.

Swapping two adjacent letters never changes the check digit. Not rarely, not usually not: never. We tried over eighteen thousand letter-letter transpositions and every single one produced a code that still validates. The reason is arithmetic. Luhn doubles every second digit counting from the right, and a letter occupies exactly two digit positions once expanded. Moving a two-digit block by two positions leaves each of its digits on the same side of that alternation as before, so its contribution to the total is unchanged, so the sum is unchanged, so the check digit is unchanged.

Now notice where the letters are. The first two characters of every ISIN are the country prefix, and they are always letters. The one transposition this scheme is structurally blind to is therefore sitting at the front of every code ever issued. And because 43 pairs of ISO 3166 codes happen to be reverses of one another, the corrupted prefix usually names a real country rather than looking like nonsense.

The worked example is a real security. GB0002634946 is a British instrument, and BG0002634946 is the same digits under Bulgaria's prefix. Both pass. Spain and Sweden do it too, as ES and SE, along with Hong Kong and Cambodia, Israel and Liechtenstein, Malta and Turkmenistan, North Korea and Pakistan. The full list is in the table above the article.

It is worth being precise about how unusual this is. Against the other checksums, ISIN misses only 1.90% of digit-for-digit transpositions, and those are exactly the 0 and 9 swaps that the Luhn algorithm has always missed. It misses about 11% of swaps between a letter and a digit, which move blocks by an odd offset and so mostly do change the sum. Letter-for-letter is the one that goes to a hundred percent.

Honest limits, and how this was checked

A valid check digit means the twelve characters are internally consistent. It does not mean the security exists, that it is tradeable, or that the national number was ever issued. Anyone can construct a well-formed ISIN in a few seconds, and this page effectively does exactly that for the sample buttons. There is no register to consult here, because there is no free public one to consult, and a tool that implied otherwise would be lying about what it knows.

The check digit is also weaker than it looks against single mistyped characters, catching roughly nine in ten and missing the rest, which is the ordinary behaviour of any single modulo-ten digit rather than a defect specific to ISIN.

The implementation is pinned to five published ISINs from three countries rather than to itself, and the country table is the same ISO 3166 dataset behind this site's country codes page, so the prefixes accepted here and the codes listed there cannot drift apart. There are 910 assertions in total. The letter-letter result is asserted twice, once by sweeping thousands of generated codes and once as the algebra that forces it, and it carries a negative control: swaps between a letter and a digit are detected about 89% of the time, without which a claim that everything is preserved would pass for a function that ignored its input entirely.

One trap worth naming for anyone implementing this themselves. It is tempting to align the doubling to the original twelve characters rather than to the expanded digit string. That produces the right answer often enough to survive casual testing and disagrees with the standard on about nine ISINs in ten.

Why is it free?

This is a few dozen lines of arithmetic and a lookup table, running in the tab you already have open. No server sees the code you type, so there is nothing to charge for and no account to create.

Nothing you enter is uploaded, stored or logged. Holdings and trade tickets are exactly the sort of thing people paste into a validator, so that is worth stating plainly rather than leaving to be assumed.