Card Number Masker
Mask a card number so only the last 4 digits are visible. Useful for receipts, logs and display.
How this tool works
Masking is the practice of showing only part of a card number so that a person can recognise a card without being able to use it. The convention is to keep the first six and the last four digits visible and to replace the middle with asterisks or dots, which is the format the card brands themselves publish on receipts and statements.
The reason the first six and the last four are kept is that the first six identify the issuer and the last four identify the individual card, and those are the parts a customer needs to recognise. The middle is the account number, and it is the part with no disclosure value and the most disclosure risk.
Masking conventions
| Visible | Masked | Reveals |
|---|---|---|
| First 6, last 4 | 424242******4242 | Issuer and the last four digits |
| Last 4 only | ************4242 | The individual card, not the issuer |
| First 6 only | 424242******** | The issuer, not the card |
| First 4, last 4 | 4242*********4242 | A weaker version of the first convention |
The first six and last four is the convention the schemes publish, and the one customers are used to seeing on a receipt.
When to use it
- Mask a card number in a support view or an admin panel
- Match a screenshot or a message to a stored record
- Format a number for a receipt or a statement
- Reduce the exposure of a record shown to a wider audience
Frequently asked questions
How should a card number be masked?
Keep the first six and the last four digits and replace the rest. That is the convention the card schemes publish for receipts and statements, and it lets a customer recognise the card without exposing the account number.
Why keep the last four digits?
They identify the individual card, so a customer can tell one of their cards from another. They are not sufficient to transact with.
Why mask at all?
Because a full number is cardholder data. A masked number lets a support agent or a customer identify a card without the record being usable if it is seen.
Is a masked number safe to store in logs?
It is a significant reduction rather than an elimination. Many of the most frequent PCI findings involve logs that should never have held a full number and now hold a masked one.
Should the middle be replaced with asterisks or with the actual length?
With a fixed mask, so that a masked number does not reveal the length of the original unless you intend it to.