Home/ Questions/Q 6358035
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T23:17:24+00:00

Yeah… just thinking about it… Should I store credit card numbers that have been

  • 0

Yeah… just thinking about it…

Should I store credit card numbers that have been input on my site as strings or ints?

I mean, they’re made up of numbers which makes me think it’s an int… but I don’t do maths on them, so maybe a string is more appropriate?

EDIT: So I have to store the number that’s been input at some point, before I encrypt it. I probably should have been more specific – it’s not like I’m saving them in the DB in clear text or anything – glad to see how conscientious everyone is 🙂

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Neither. You should save them, at very least, as byte arrays encrypted with AES or equivalent using industry-accepted key storage.

    Windows provides a lot of this via the Data Protection API: http://msdn.microsoft.com/en-us/library/ms995355.aspx

    For your own sake and the sake of your customers, please learn the proper standards for encrypting financial credentials or hire someone who knows them.

    Given your edit:

    C# has a SecureString class that you should use. I don’t believe that there is a Java equivalent, but I could be wrong.

    EDIT: For posterity’s sake…

    Guidelines for storage, transmission, and processing of credit card details are defined by PCI DSS (Data Security Standards). Anyone considering how to architect their solution for managing credit card data should read about that here, and consult an industry expert: https://www.pcisecuritystandards.org/

    • 0