Credit Card Mask Formatter
Masked
4532-****-****-0366
How it works
Credit card masking replaces all but the last four digits with asterisks or X characters, producing a display-safe representation (e.g., **** **** **** 4242) that allows users to identify their card without exposing the full PAN (Primary Account Number). This is a PCI-DSS requirement for any application that displays stored card data.
**PCI-DSS compliance requirements** PCI-DSS Requirement 3.3: "Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed)." The first 6 digits (BIN — Bank Identification Number) identify the issuing bank and card network, which may be exposed for operational purposes. The last 4 digits are retained for card identification. The middle digits must never be displayed.
**Card number structure** Luhn algorithm: all major card numbers (Visa, Mastercard, Amex, Discover) satisfy the Luhn check — a weighted-sum checksum used to detect transcription errors. Card lengths: Visa = 16 digits, Mastercard = 16, Amex = 15, Discover = 16. BIN ranges: Visa starts with 4, Mastercard with 51–55, Amex with 34 or 37.
**Masking vs. tokenization** Masking is a display operation — the original number still exists in storage. Tokenization replaces the PAN with a randomly generated token that is meaningless to an attacker; the mapping is stored in a secure token vault. For full PCI-DSS compliance, tokenization (not just masking) is required for stored card data.
Frequently Asked Questions
- PCI-DSS Requirement 3.3 allows displaying a maximum of the first 6 and last 4 digits. The middle 6 digits must always be masked. Display format: 4111 11** **** 1111 (first 6 and last 4 visible) or **** **** **** 1234 (only last 4 visible — more conservative and most common in practice). Never display or log the full PAN, CVV/CVV2, or magnetic stripe data. The 'first 6 + last 4' rule exists so financial institutions can identify the issuing bank (BIN = first 6 digits) while protecting the accountholder.
- The Luhn algorithm validates credit card numbers against transcription errors. Starting from the rightmost digit, double every second digit (right to left). If doubling produces a number > 9, subtract 9 (or equivalently, sum the two digits). Sum all digits. If sum mod 10 == 0, the number is valid. Example: 4532015112830366 → valid. This catches any single-digit transcription error and most transposition errors. It is a checksum, not security — it does not prove the card is real or active.
- No. Masking is a display operation — the full card number still exists in storage, just shown as ****1234 to users. Tokenization replaces the actual PAN with a meaningless surrogate token (a random number like 8472-9183-2749-5830) that has no mathematical relationship to the real card number. The mapping is stored in a secure token vault operated by a payment processor. Tokenization is required for PCI-DSS compliance at the storage level; masking is a display requirement. A tokenized system never has the real PAN in its database at all.
- The first digit is the Major Industry Identifier (MII): 3=travel/entertainment (Amex, Diners), 4=Visa, 5=Mastercard, 6=Discover/Maestro. The first 6 digits form the Bank Identification Number (BIN), identifying the issuing bank, card network, and card type (debit/credit/prepaid). Visa starts with 4. Mastercard: 51–55 (transitioning to 2221–2720). Amex: 34 or 37 (15 digits total). Discover: 6011, 622126–622925, 644–649, 65. Knowledge of BIN ranges is used for fraud detection and routing.