Starts a checkout
- Amount
- $12.99
- Terminal
- TERMINAL-1
- Fresh challenge
Preparing…
Card · Terminal · Issuer
Why a chip transaction needs a fresh authenticator
A card authenticates data for a particular checkout. Change the amount or repeat a previously accepted packet and ask the issuer what it would do.
Teaching model: This page computes HMAC-SHA-256 over synthetic fields to show the online authentication idea. It does not implement EMV application cryptograms, chip commands, payment-network rules, offline card authentication, or cardholder verification. Do not enter real card information.
One checkout
Follow the packet
Authenticates its data
- Card
- DEMO-CARD
- Counter
- Preparing…
- Model authenticator
Preparing…
Checks the packet
Its copy of the synthetic key verifies the amount, terminal, challenge, card ID and counter. It remembers accepted counters in this page.
Try the original first, then replay it. “New checkout” creates a new terminal challenge and increments the model card counter. The real issuer has much more risk and authorization logic.
What this experiment establishes
Changing a bound field: the issuer cannot validate the altered packet under the card’s secret. A visible card number alone cannot create the authenticator.
Freshness and replay: a challenge ties the request to a checkout; the model issuer also tracks accepted counters. These are illustrative controls, not a promise that every real EMV deployment uses this exact replay policy.
Actual EMV chip payments distinguish online cryptograms checked remotely by issuers, commonly with symmetric cryptography, from offline authentication that a terminal can verify with public-key cryptography. The latter is outside this model. Tokenizing a stored card number, as in Format Ward, solves a different problem.
Sources and limits
- EMVCo, EMV Contact Chip: card–terminal exchange and one-time transaction cryptograms (accessed 23 October 2026).
- EMVCo, EMV Security quick reference (May 2025): terminal challenge and the online-versus-offline distinction.
The buttons are a browser demonstration of authentication and replay decisions with invented data. They are not EMV test vectors or a certified payment application. Read the model source.