Card · Wallet Tokens
Apple Pay / Google Pay Token
Parse wallet payment tokens and inspect encrypted payment data.
Apple Pay / Google Pay Token Parser
Inspect wallet payment token structure locally. Encryption is never broken in the browser.
Valid
Input
This tool only inspects structure. The encrypted blobs stay encrypted — full PAN and cardholder data are only recoverable server-side with your merchant private key.
Output
Detected format
Apple Pay · EC_v1
| Field | Value |
|---|---|
| Detected format | Apple Pay |
| Version | EC_v1 |
| Network | Visa |
| Method type | debit |
| Display name | Visa 1234 |
| Transaction ID (hex) | a1b2c3d4e5f6 |
| Ephemeral public key (hex) | 3059301306072a8648ce3d020106082a8648ce3d03010703420004 |
| Public key hash (hex) | 2b67c0da6f6ae2bed3b95c1985ab21 |
| Has encrypted data | Yes |
| Encrypted data bytes | 30 |
| Encrypted data hex (preview) | d93b27deae5caf85f685f0a883ef8bacd898589f9189615c0d5842d22714 |
| Has signature | Yes |
| Signature bytes | 16 |
| Signature hex (preview) | 308006092a864886f70d010701050200 |
| Transaction identifier | ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890 |
What this means
- Version EC_v1: asymmetric (ECDH) one-time ephemeral key; merchant must decrypt `data` server-side using their private key.
- This is an ENCRYPTED token. Full PAN/cardholder data is NOT readable client-side — decryption happens in your backend.
- Signature is a detached PKCS#7 over the data; verify with Apple Root CA + merchant cert chain server-side.
- Never log or store the decrypted PAN, CVV, or cryptogram. Treat the encrypted blob as sensitive at rest and in transit.