How Safari and Apple Pay Protect Your Credit Card Number

This article explains how the Safari web browser and Apple Pay work together to keep your actual credit card number completely hidden during online checkouts. By utilizing a technology called tokenization, Apple replaces your sensitive card details with a unique Device Account Number (DAN). Through a combination of hardware-level isolation, biometric authentication, and transaction-specific security codes, Safari processes web payments without ever exposing your real credit card information to the merchant, the browser, or even Apple itself.

Creation of the Device Account Number (DAN)

The protection of your credit card begins before you ever open Safari, at the moment you add your card to the Apple Wallet app. Your actual 16-digit credit card number is never stored on your device or on Apple’s servers.

Instead, Apple securely sends your card details to your card-issuing bank or network (such as Visa, Mastercard, or American Express). The card network generates a unique, device-specific proxy number called a Device Account Number (DAN). This DAN looks like a normal credit card number, but it is mathematically irreversible and tied solely to the specific device you are using.

Hardware Isolation in the Secure Element

Once the card network generates the DAN, it sends it back to your iPhone, iPad, or Mac in an encrypted format. The DAN is immediately stored inside the Secure Element—a dedicated, tamper-resistant hardware chip that is completely isolated from the rest of the device's operating system.

Because the DAN lives inside the Secure Element, neither macOS, iOS, nor the Safari web browser can read or access it. Even if a website in Safari were running malicious code, it could not reach into the Secure Element to steal the DAN.

Initiating the Checkout in Safari

When you shop on a website in Safari and click the Apple Pay button, the website uses a secure framework (the Apple Pay JS API) to request a payment. The website sends the transaction details—such as the total amount, currency, and the merchant’s unique cryptographic identifier—to Safari.

Safari then pulls up the Apple Pay payment sheet on your screen. At this stage, the website still knows nothing about your payment method, and no sensitive data has been exchanged.

Biometric Authorization and Dynamic Security Codes

To approve the payment in Safari, you must authenticate using Face ID, Touch ID, or your passcode. This biometric check is handled by the device's Secure Enclave, which communicates directly with the Secure Element. Safari never sees your biometric data.

Once your identity is confirmed, the Secure Element prepares the payment data:

1. It retrieves the Device Account Number (DAN) to act as the card number.
2. It generates a dynamic security code (a unique cryptographic token) specifically for this single transaction. This code replaces the static 3-digit CVV code found on the back of your physical card.

Encrypted Transmission to the Merchant

The Secure Element packages the DAN and the one-time dynamic security code together and encrypts them using a public key linked to the specific merchant or their payment processor.

The Secure Element hands this encrypted package to Safari, which passes it to the website. Because the package is encrypted, the website cannot read the DAN. The merchant simply forwards this encrypted bundle to their payment processor.

Finalizing the Payment

The payment processor decrypts the package and sends the DAN and the dynamic security code to the card network. The card network is the only entity in the entire chain that holds the mapping key linking your DAN to your actual credit card number.

The card network verifies that the dynamic security code is authentic and came from your specific device. Once verified, the network maps the DAN to your real account, approves the transaction, and sends an approval message back through the chain to Safari.

Why This Protects You

Because of this architecture, your actual credit card number is completely invisible during a Safari web checkout. If the online store suffers a massive data breach, your real credit card number cannot be stolen because the merchant never had it. Even if hackers manage to intercept the DAN from the payment processor, the number is entirely useless to them. A DAN cannot be used to make a purchase without a fresh, transaction-specific dynamic security code, which can only be generated by the physical Secure Element chip inside your personal device.