Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.
Export as PDF

PAN vs. DPAN/Network Tokens

When you handle card data, it helps to know exactly which "number" you're holding — the real account number, a network's stand-in, or a token you created to avoid storing the real one. They look similar but carry very different sensitivity and PCI obligations.

PAN — the real account number

The PAN (Primary Account Number) is the actual card number on a physical card. It's sensitive data and is fully in PCI scope. On a Dyna-family reader, PAN read from a card is encrypted at the point of read (SRED) and carried inside the transaction data (for example, within the EMV ARQC) — your host works with the encrypted form and decrypts only where authorized. See Encryption & decryption.

DPAN — the network token used by wallets

A DPAN (Device PAN) is a network token that stands in for the real PAN. When a card is added to a mobile wallet (Apple Pay, Google Pay), the wallet stores a DPAN rather than the real card number. So when a cardholder taps, the reader receives the DPAN plus a cryptogram — not the underlying account number. The DPAN maps back to the real PAN only at the payment network. In practice this means contactless wallet taps inherently carry a network token, which reduces the value of the data if it's ever exposed.

Tokens — replacing the PAN in your own systems

Separately from anything the network does, you can replace a PAN in your environment with a token so you never store the sensitive number. MagTek's Magensa TokenExchange is a cloud, vaultless tokenization service that does this via REST APIs, with a few token types:

  • Payment tokens — for standard payment operations (sale, refund).

  • Transaction tokens — for tokenized payment links or QR codes.

  • PII tokens — for non-payment sensitive data.

See TokenExchange and TokenExchange Connect.

Telling them apart

  • PAN — the real, sensitive card number; protect and encrypt it, and it's in full PCI scope.

  • DPAN / network token — the network's stand-in a wallet presents on tap; you receive this instead of the PAN for wallet transactions.

  • TokenExchange token — a stand-in you generate to keep the PAN out of your systems entirely.

The short version: a PAN is the sensitive number itself; a DPAN is the network's substitute used in device/wallet transactions; and a TokenExchange token is the substitute you use in place of the PAN in your own applications.

Need Help?

For additional support, please contact MagTek Support:

Technical Support:

  • 📧 Email: support@magtek.com

  • 📞 Phone: 1-800-788-6835 (US) | +1-562-546-6616 (International)

  • 🕐 Hours: Monday-Friday, 6:00 AM - 5:00 PM PST

Online Resources:

Documentation Feedback:

Help us improve this documentation! Submit feedback

Last updated