Canadian · Validation
CUSIP check digit validator & calculator.
Verify a 9-character CUSIP's real check digit, or enter just the 8-character body (6-character issuer number + 2-character issue number) to have the correct check digit computed for you. Everything runs in your browser: nothing you type is transmitted anywhere.
Inputs
Result
Enter a CUSIP and press Validate.
How the CUSIP check digit works
A CUSIP is 9 characters: a 6-character issuer number, a 2-character issue number, and 1 numeric check digit — used across the US and Canada to identify stocks, bonds, and other securities. Each of the first 8 characters is converted to a value (digits keep their value, letters A–Z become 10–35, and the rare symbols * @ # become 36, 37 and 38). Scanning those 8 values left to right, every second one (the 2nd, 4th, 6th and 8th character) is doubled; for every value, doubled or not, its tens digit and ones digit are added into a running sum. The check digit is whatever value would make that sum a multiple of 10: (10 − (sum mod 10)) mod 10.
This is a different checksum from an ISIN's: an ISIN expands every letter into two digits before running a standard Luhn pass right-to-left, while a CUSIP keeps each character as one value and doubles every other position scanning left-to-right. Worked by hand against real CUSIPs: Apple Inc. (037833100) sums to 30, giving check digit 0; Microsoft Corp (594918104) sums to 36, giving check digit 4; and Goldman Sachs Group (38141G104, which contains a letter) sums to 26, giving check digit 4 — all three match their real, publicly known CUSIPs.
What a passing checksum does and doesn’t tell you
A valid check digit only proves the characters are internally consistent — it does not confirm the CUSIP was ever actually assigned to a real security, or identify what that security is. CUSIP numbers are assigned and licensed by CUSIP Global Services (CGS), operated for the American Bankers Association; look an actual CUSIP up with your broker or CGS's own database. This tool runs entirely in your browser: nothing you type is transmitted, stored, or logged.