Tools

PIN Block

Calculate and reverse ISO 9564 Format 0 PIN Blocks.

What is a PIN Block?

A PIN Block is a standardized 64-bit (or 128-bit for Format 4) data structure that securely encodes a Personal Identification Number for transmission across the payment processing chain. Defined by ISO 9564, PIN blocks bind the cardholder's PIN to the Primary Account Number (PAN) using XOR, producing a clear block that is then encrypted under a PIN Encryption Key (PEK or ZPK) before leaving any device — ATM, POS terminal, mobile wallet, or HSM. The ISO 9564 standard defines five PIN Block formats: Format 0 (the workhorse — used by virtually every acquirer and issuer worldwide), Format 1 (no PAN dependency, used when the PAN is unknown at PIN entry, like remote verification), Format 2 (offline EMV PIN verification on the chip), Format 3 (Format 0 with random padding for added entropy), and Format 4 (the newest AES-based 128-bit format, required by PCI PIN Security v3.1 for new deployments). Format 0 remains the most common because it is required for online PIN authorization through Visa, Mastercard, and most national payment networks, and is the format every payShield HSM CA/CY command operates on by default.

How to Use This Tool

  1. To calculate a PIN Block: enter the PIN (4-12 digits) and the full PAN (card number including check digit).
  2. The tool constructs the PIN field as: 0 + PIN length nibble + PIN digits + F-padding to 16 HEX characters.
  3. The PAN field is constructed as: 0000 + rightmost 12 PAN digits excluding the Luhn check digit.
  4. These two 16-HEX fields are XORed together to produce the clear PIN Block.
  5. To reverse: enter a clear PIN Block and the PAN, and the tool extracts the original PIN.
  6. Use the step-by-step view to inspect each intermediate value, including the prepared PIN and PAN fields.

Common Use Cases

  • Verifying PIN Block calculations during ATM, POS, or mobile-wallet terminal development.
  • Debugging PIN translation failures between acquirer and issuer environments (typically CA/CY HSM commands).
  • Validating PIN entry firmware on encrypted PIN pad (EPP) devices during PCI POI testing.
  • Auditing PIN Block formats for PCI PIN Security and PCI DSS compliance reviews.
  • Generating test PIN Blocks for HSM driver development and integration testing.
  • Training new payments engineers on PIN security and ISO 9564 semantics.
  • Reverse-engineering legacy PIN flows where the original format documentation has been lost.
  • Cross-checking clear-PIN extraction during incident response and fraud investigations.

Frequently Asked Questions

What is ISO 9564 Format 0?▾
ISO 9564 Format 0 (also called ISO-0 or ANSI X9.8) creates a 64-bit PIN block by XORing a prepared PIN field with a prepared PAN field. The PIN field is: 0 + PIN length nibble + PIN digits + F-padding to 16 HEX characters. The PAN field is: 0000 + rightmost 12 digits of the PAN excluding the Luhn check digit. The XOR of these two fields produces the clear PIN Block.
Why bind the PIN to the PAN?▾
Without PAN binding, two cardholders with the same PIN would produce identical PIN Blocks, enabling pattern-based attacks where an attacker correlates ciphertexts. By XORing with PAN-derived material, each PIN Block becomes unique per card even when PINs collide. This is the same defense-in-depth principle used in salting password hashes.
Is the PIN Block the same as an encrypted PIN?▾
No. The clear PIN Block is the XOR result and is not yet encrypted. Before transmission, the clear block must be encrypted under a PIN Encryption Key (PEK, ZPK, or under an AES KEK for Format 4) using 3DES or AES in ECB mode. This tool shows the clear construction so you can reproduce the input to any HSM PIN-encryption command.
What other PIN Block formats exist and when are they used?▾
Format 1 has no PAN dependency and is used for change-PIN flows or any context where the PAN is unknown at PIN entry. Format 2 is used for offline EMV PIN verification on the IC chip itself. Format 3 mirrors Format 0 with random padding instead of F-padding for added entropy. Format 4 is a 128-bit AES-based format introduced in 2017, now mandatory for new PCI PIN Security v3.1 deployments. PCI is phasing out Formats 0, 1, 2, and 3 for new builds.
Can a PIN Block expose the PIN if intercepted?▾
A clear (unencrypted) PIN Block is only obfuscated, not encrypted — knowing the PAN allows immediate XOR recovery of the PIN. That is precisely why every PCI-compliant deployment encrypts the PIN Block under a session key (PEK/ZPK) immediately at the EPP and only ever transmits the encrypted form. Capturing an encrypted PIN Block without the corresponding key reveals nothing.
How does the HSM CA command use a PIN Block?▾
The Thales payShield CA (PIN Translation) command takes a PIN Block encrypted under a source ZPK, decrypts it inside the HSM, optionally re-formats it (e.g., Format 0 → Format 1), and re-encrypts under a destination ZPK. The clear PIN never leaves the HSM. Your PIN Block field constructions here must match exactly what the issuer-side HSM expects for translation to succeed.

More Tools

Data Converter

Convert data between HEX, ASCII, Binary, Decimal, and Base64.

LUHN Validator

Validate and generate numbers using the Luhn algorithm.

XOR Calculator

XOR two hexadecimal strings together.

TLV Parser

Parse EMV Tag-Length-Value data structures.