← Back to Home

🔐 ARQC Cryptogram Calculator

Authorization Request Cryptogram Generator for EMV Chip Cards

⚠️ Security Warning: This is an educational tool. Never use real production keys in any online tool. All calculations are performed locally in your browser.

What is ARQC?

  • ARQC (Authorization Request Cryptogram) is generated by the EMV card chip during a transaction
  • It proves the card's authenticity and transaction data integrity to the issuer
  • Generated using 3DES encryption with session keys derived from card-specific master keys
  • Different card schemes (Visa, Mastercard, UnionPay, JCB) may have slight variations

🔑 Cryptographic Keys

💳 Card Data

💰 Transaction Data

📚 ARQC Calculation Documentation

Overview

The Authorization Request Cryptogram (ARQC) is a critical security element in EMV transactions. It serves as a digital signature that proves:

  • The card is genuine and issued by a legitimate issuer
  • The transaction data has not been tampered with
  • The card possesses the correct cryptographic keys

Prerequisites

1
Cryptographic Keys

AC Master Key: The issuer's Application Cryptogram Master Key (typically derived from IMK - Issuer Master Key)

Session Key (UDK): Derived using the formula:

UDK = 3DES-Encrypt(AC_Master_Key, PAN || PAN_Seq || Padding)
2
Card Data Elements
  • PAN: Primary Account Number (13-19 digits)
  • PAN Sequence Number: Distinguishes cards with same PAN
  • ATC: Application Transaction Counter (increments with each transaction)
3
Transaction Data (CDOL1)

The Card Data Object List (CDOL1) defines which data elements are used. Common elements:

  • 9F02: Amount, Authorized (6 bytes)
  • 9F03: Amount, Other (6 bytes)
  • 9F1A: Terminal Country Code (2 bytes)
  • 95: Terminal Verification Results (5 bytes)
  • 5F2A: Transaction Currency Code (2 bytes)
  • 9A: Transaction Date (3 bytes)
  • 9C: Transaction Type (1 byte)
  • 9F37: Unpredictable Number (4 bytes)

Calculation Algorithm

1
Derive Session Key (UDK)

Combine PAN and PAN Sequence Number, apply padding, then encrypt with AC Master Key using 3DES:

Input: PAN (right-justified, zero-padded to 16 hex) + PAN_Seq (2 hex) + "0000000000000000" Example: 4514617697322685 + 01 → "4514617697322685" + "01" + padding Output: 16-byte Unique DEA Key (UDK)
2
Build CDOL1 Data

Concatenate all transaction data elements as specified by CDOL1:

Amount_Auth + Amount_Other + Country + TVR + Currency + Date + Type + UN Example: 000000005800 + 000000000000 + 0784 + 0000000000 + 0784 + 251013 + 00 + D6051912
3
Prepend Dynamic Data

Add ATC and other dynamic data before CDOL1:

Input = ATC + UN + CDOL1_Data Example: 004F + D6051912 + (cdol1 data...)
4
Apply Padding (ISO 9797-1 Method 2)

Pad data to multiple of 8 bytes: append 0x80 followed by 0x00 bytes

If data length = 35 bytes → add 0x80 + five 0x00 = 40 bytes total
5
Calculate MAC (3DES-MAC)

Generate MAC using ISO 9797-1 Algorithm 3 (Retail MAC):

1. Split padded data into 8-byte blocks 2. Apply DES-ECB encryption on first block with Session Key 3. XOR result with next block, repeat DES encryption 4. Continue until last block 5. Apply full 3DES on final result 6. Take first 8 bytes as ARQC

Scheme-Specific Variations

VISA
Visa CVN 10/18

Standard 3DES-MAC with CDOL1 data. CVN 18 includes additional proprietary data.

MC
Mastercard CVN 10/14

Similar to Visa but may include Issuer Application Data (IAD) in the calculation.

CUP
China UnionPay (PBOC)

Follows PBOC 3.0 standard. Uses similar algorithm but with specific CDOL1 requirements.

JCB
JCB

Follows EMV standard closely, similar to Visa implementation.

⚠️ Important Notes:
  • This is a simplified educational implementation
  • Production ARQC validation requires issuer host system
  • Real keys are managed by Hardware Security Modules (HSMs)
  • Never store or transmit real cryptographic keys insecurely
  • Each card issuer may have proprietary variations

💡 Example Calculations

1
Visa Purchase Transaction

Scenario: $58.00 purchase in UAE

Card Scheme: Visa CVN 10
AC Master Key: 0123456789ABCDEFFEDCBA9876543210
PAN: 4514617697322685
PAN Sequence: 01
ATC: 004F

Amount Authorized: 000000005800 ($58.00)
Amount Other: 000000000000
Currency Code: 0784 (AED)
Country Code: 0784 (UAE)
Transaction Date: 251013 (Oct 13, 2025)
Transaction Type: 00 (Purchase)
Unpredictable Number: D6051912
TVR: 0000000000
TSI: 0000

Expected Output: ARQC will be generated based on 3DES-MAC calculation
2
Mastercard Cash Withdrawal

Scenario: €200.00 ATM withdrawal

Card Scheme: Mastercard CVN 10
AC Master Key: FEDCBA98765432100123456789ABCDEF
PAN: 5412345678901234
PAN Sequence: 00
ATC: 0123

Amount Authorized: 000000020000 (€200.00)
Amount Other: 000000000000
Currency Code: 0978 (EUR)
Country Code: 0276 (Germany)
Transaction Date: 251013
Transaction Type: 01 (Cash Withdrawal)
Unpredictable Number: 12345678
TVR: 0000000000
TSI: 0000
3
UnionPay Online Purchase

Scenario: ¥500 online purchase

Card Scheme: China UnionPay
AC Master Key: ABCDEF0123456789FEDCBA9876543210
PAN: 6212345678901234567
PAN Sequence: 01
ATC: 00A5

Amount Authorized: 000000050000 (¥500)
Amount Other: 000000000000
Currency Code: 0156 (CNY)
Country Code: 0156 (China)
Transaction Date: 251013
Transaction Type: 00 (Purchase)
Unpredictable Number: ABCD1234
TVR: 0000000000
TSI: 0000

Testing Your Implementation

To verify your ARQC calculator:

  1. Use test keys provided by your payment processor or card scheme
  2. Generate ARQC with your calculator
  3. Submit to test issuer host for validation
  4. Compare with expected ARQC from test cases

Note: Without the same keys, you cannot replicate exact ARQC values from real transactions.