CAVV Calculator
Inspect 3-D Secure authentication values — Visa CAVV and Mastercard AAV: convert between the 28-character base64 form and hex, identify the type by length and leading byte, and look up ECI values. The scheme algorithms and CAVV field layouts are not public, so the MAC tab is an illustrative TDES CBC-MAC.
Try it as a puzzle: authenticate, then authorize, an online payment →
Use test data only. All calculations run locally in your browser — PayProbe never sees, transmits, or stores your PAN, CVV, keys, PINs, or cryptographic inputs. How we handle data →
ECI values
05Fully authenticated (frictionless or challenge)06Authentication attempted (issuer or cardholder not participating; attempts server)07Not authenticated / non-3DS e-commerce02Fully authenticated01Authentication attempted00Not authenticated04Data Only (no authentication, no liability shift)06SCA exemption / out of scope (e.g. acquirer exemption) — sources differ07Merchant-initiated or recurring transaction with prior authentication — sources differAbout CAVV and AAV
The CAVV (Visa, Cardholder Authentication Verification Value) and AAV (Mastercard, Accountholder Authentication Value) are produced by the issuer’s ACS when it authenticates the cardholder in EMV 3-D Secure 2.x. The ACS returns the value in the ARes (frictionless) or RReq (challenge) as authenticationValue — 28 base64 characters — and the 3DS Server passes it, with the ECI, to the merchant, who sends it in the authorisation; the issuer recomputes it with its own keys to confirm the authentication happened. A Visa CAVV is 20 bytes; a Mastercard SPA2 AAV is 21 bytes. Their internal layouts and MAC inputs are defined in scheme documents that are not public, which is why this tool does not decode individual fields.