Custom Token Generator
Make your own payment tokens without Visa, Mastercard or Amex token services: a vault with random tokens, vaultless FF1 format-preserving encryption (NIST SP 800-38G), or a keyed hash. Keep the BIN and last four, force the token to fail Luhn, and reverse it.
Follows NIST SP 800-38G FF1 (AES) · RFC 2104 HMAC-SHA-256FF1 checked against NIST sample vectors 1, 2, 4, 5, 7, 8 (all radix-10 samples)·verified Oct 2026· double-checked Oct 2026— radix 10 only; FF3/FF3-1 omitted as dropped from the SP 800-38G Rev. 1 draft
Use test data only. All calculations run locally in your browser — PayProbe never sees, transmits, or stores your PAN, CVV, keys, PINs, or cryptographic inputs. How we handle data →
Runs entirely in your browser: FF1 on an in-page AES (AES-128/192/256), HMAC and random digits on Web Crypto. The vault exists only in this page and is gone when you reload. Never paste real card numbers into any website.
Vault: the token says nothing about the card, and the vault is the only way back — so it is the one system that stays in full PCI DSS scope. FF1: no database to protect or replicate, but the key becomes the vault; NIST's draft revision of SP 800-38G drops FF3/FF3-1 and requires a domain of at least a million values, so keeping the BIN and last four of a 16-digit card leaves no margin. Keyed hash: the same card always gives the same token, which suits analytics and duplicate detection, but cannot be reversed. Read the custom tokens guide for design rules and PCI DSS scope, or compare with network tokens.