PAN vs. DPAN/Network Tokens

When you handle card data, it helps to know exactly which "number" you're holding — the real account number, a network's stand-in, or a token you created to avoid storing the real one. They look similar but carry very different sensitivity and PCI obligations.

PAN — the real account number

The PAN (Primary Account Number) is the actual card number on a physical card. It's sensitive data and is fully in PCI scope. On a Dyna-family reader, PAN read from a card is encrypted at the point of read (SRED) and carried inside the transaction data (for example, within the EMV ARQC) — your host works with the encrypted form and decrypts only where authorized. See Encryption & decryption.

DPAN — the network token used by wallets

A DPAN (Device PAN) is a network token that stands in for the real PAN. When a card is added to a mobile wallet (Apple Pay, Google Pay), the wallet stores a DPAN rather than the real card number. So when a cardholder taps, the reader receives the DPAN plus a cryptogram — not the underlying account number. The DPAN maps back to the real PAN only at the payment network. In practice this means contactless wallet taps inherently carry a network token, which reduces the value of the data if it's ever exposed.

Tokens — replacing the PAN in your own systems

Separately from anything the network does, you can replace a PAN in your environment with a token so you never store the sensitive number. MagTek's Magensa s a cloud, vaultless tokenization service that does this via REST APIs, with a few token types:

• Payment tokens — for standard payment operations (sale, refund).

• Transaction tokens — for tokenized payment links or QR codes.

• PII tokens — for non-payment sensitive data.

See and .

• PAN — the real, sensitive card number; protect and encrypt it, and it's in full PCI scope.

• DPAN / network token — the network's stand-in a wallet presents on tap; you receive this instead of the PAN for wallet transactions.

• token — a stand-in you generate to keep the PAN out of your systems entirely.

The short version: a PAN is the sensitive number itself; a DPAN is the network's substitute used in device/wallet transactions; and a token is the substitute you use in place of the PAN in your own applications.