Payment Utilities

Introduction

A PIN block is a fixed-format encoding of a cardholder PIN designed to be encrypted under a key (TPK, ZPK, or DUKPT-derived) and transmitted across a payment network. ISO 9564 defines the canonical formats; vendors and legacy networks add a few non-standard variants you may still encounter.

The PIN calculators live in Tools → Payment Utilities, alongside the card-verification, DUKPT and MAC tools. Two of them are dedicated PIN tools — PIN Block Calculator and PIN Block (AES) — and two more tools in the group carry PIN block operations of their own, covered in PIN Block Translation and DUKPT PIN below.

All tools

Every tool in this category — each card links to the detailed reference below.

PIN Block Formats

PIN Block Calculator

The PIN Block Calculator builds a formatted PIN block, or recovers the PIN from one. The format is picked once from the PIN block format drop-down at the top of the screen; Encode and Decode sit below it as a tab pair, so the same format applies in both directions.

Inputs

• PIN block format — Drop-down covering the ISO 9564 formats and the OEM / ECI variants. Format 0 (ISO-0) is the default.
• PAN — Only the PAN-bound formats ask for it; the field reads PAN is required for this format when the current selection needs one.
• PIN — 4–12 numeric digits.

The rest of the form follows the format you pick, so a format that carries no PAN simply drops that field.

Walk-through (Encode, ISO-0)

1. Open the PIN Block Calculator from Tools → Payment Utilities → PIN Block Calculator.
2. Pick Format 0 (ISO-0) in the PIN block format drop-down.
3. Stay on the Encode tab.
4. Enter the PAN. ISO-0 uses the rightmost 12 digits excluding the check digit.
5. Enter the PIN (e.g. 1234).
6. Click Encode. The formatted PIN block is written to the activity log with its inputs.

The Decode tab reverses the same format: give it the PIN block and it recovers the PIN.

Format Walk-throughs

ISO-0 / ANSI X9.8

Step 1 (PIN block):  04 12 34 FF FF FF FF FF
   - 04 = PIN length (4 digits)
   - 1234 = PIN
   - FF padding to 8 bytes

Step 2 (PAN block):  00 00 12 34 56 78 90 12
   - leading zeros + rightmost 12 digits of PAN excluding check digit

Step 3 (XOR):        04 12 26 CB A9 87 6F ED
Step 4 (Encrypt):    encrypted under TPK / ZPK

ISO-1

No PAN; the PIN is followed by random fill bytes. Use when PAN is not transmitted (e.g. some IVR / VRU flows).

ISO-3

Like ISO-0 but the padding nibbles are random in the range 0xA–0xF. Each generated PIN block is unique even for the same PIN + PAN combination.

ISO-4 (AES)

16-byte clear PIN block: control field, PIN length, PIN digits, then a random fill. Encrypted with AES (128 / 192 / 256-bit) and XOR-combined with a derived PAN block. Use the dedicated AES PIN Block tab for ISO-4 work.

OEM-1 / ECI

Reserved for compatibility with legacy ATM and POS networks. The exact layout differs per vendor; the calculator labels each tab with the vendor name.

AES PIN Block (ISO-4) Calculator

The PIN Block (AES) tool focuses on the modern ISO Format 4 design. One form covers both directions — Encode and Decode are buttons rather than tabs, and the middle field changes meaning between them.

Inputs

• Key — 32 hex chars (AES-128).
• PIN (Encode) / PIN Block (Decode) — One field serving both directions: the PIN going in, the encrypted block coming back out.
• PAN — Required for the PAN block XOR step.

Buttons: Encode, Decode.

Output

• Clear PIN block (16 bytes)
• PAN block (16 bytes)
• Intermediate ciphertext (after AES of clear PIN block)
• Final encrypted PIN block (after XOR with PAN block)

PIN Block Translation (AS2805)

Translation re-encrypts a PIN block from one key to another without ever exposing the clear PIN — the acquiring step that moves a PIN from the terminal key (TPK) it arrived under to the zone key (ZPK) shared with the next node. The AS2805 Calculator carries it on its Translate PIN Block tab, and can change the PIN block format in the same operation.

Inputs

• System ZPK (Hex) — The zone key the block is translated to.
• Terminal TPK (Hex) — The terminal key the block arrived under.
• STAN — System trace audit number of the transaction.
• Transaction Amount
• Incoming / Outgoing PIN Block Format — Two-digit format codes, defaulting to 01. Set them differently to translate the format as well as the key.
• Incoming PIN Block (Hex)
• Account Number — Binds the block for the PAN-bound formats.

Button: Translate.

DUKPT PIN

Under DUKPT, the PIN is encrypted with a PIN Entry Key (PEK) derived per transaction rather than a static TPK. The DUKPT PIN tab takes a PEK you have already derived and encrypts or decrypts a PIN block with it.

Inputs

• PEK — 32 hex chars. Derive it first on the PEK Derivation tab from a BDK or IPEK plus the KSN.
• PIN Block — 16 hex chars: the clear block to encrypt, or the encrypted block to recover.

Buttons: Encrypt, Decrypt.

Tips

• If the host rejects your PIN block, verify the format on both sides — ISO-0 and ISO-3 look identical at a glance but produce different blocks.
• When testing DUKPT-protected PIN flows, derive the working key first (DUKPT Tools), then encrypt or decrypt with it under DUKPT PIN. The activity log shows both the input PIN block and the decrypted clear PIN for cross-checking.