I am using a payment gateway in my app.
I'm thinking of storing credit card numbers without the CVC numbers in my app.

Storing the CC number eliminates the requirement of re-entering the CC number. However, the user must still enter the CVC number.
The CC number itself will be encrypted with AES and a user defined key.


  1. Is it secure to store credit card data in an App this way?
  2. How secure is this implementation in Android versus other OSes?
  • 1
    How are you going to store the key? Commented May 9, 2016 at 12:30
  • 2
    What does "user defined key" mean exactly? Will the user have to enter a password on every launch? Or is the key defined on first run and then stored somewhere? (If yes, where?)
    – marstato
    Commented May 9, 2016 at 13:11
  • 3
    Your app will need to be PCI compliant: pcicomplianceguide.org/pci-faqs-2
    – James Hyde
    Commented May 9, 2016 at 13:13
  • 1
    – ForguesR
    Commented May 9, 2016 at 14:34
  • 1
    PCI considerations aside, I wouldn't encrypt it with AES or any other symmetric encryption scheme if it will be stored on the user's device. If you instead encrypt it using RSA with a sufficiently long key (2048 bit or longer), and leave the private key on the server doing the payment processing then it will be a bit harder for anyone to decrypt the account number if the device is compromized, stolen, or lost.
    – KristoferA
    Commented May 12, 2016 at 7:32

2 Answers 2

  1. It is as secure as the place where you store the CC encrypting key.
  2. Android features a keystore, which handles key generation, storage and usage for you. Your app talks to it via the KeyChain API. It offers some advantages:
    • Each app can only access their own keys. The keystore enforces this for you.
    • Key material is protected in case of app process compromise.
    • It performs all the crypto for you.
    • If the device features some piece of secure hardware, key material can be stored there, so that it is hard to extract it from the device.

Reference to Android keystore is informative only. Using it won't necessarily make you neither secure nor PCI-DSS compliant. Others have posted references for that.

  • what would make it compliant for use-cases? Commented May 9, 2016 at 15:49

You can read the PCI standards here:


First of all find the regulations your app needs to follow, then check out specific cryptography / implementation related recommendations regarding CC data storage. They provide way more details than what we cound gather here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .