Recommended Free Tools
Apple Pay and Google Pay ECv2 tokens are not interchangeable: each has its own envelope, signing trust chain, key-recovery method, and decryption sequence. Select the flow from the token’s version field, validate its signature before using payment data, and perform transaction and risk checks after decryption. A successful decrypt alone does not authorize a payment.
Start with the token protocol, not the wallet name
Apple documents two payment-token versions: EC_v1 and RSA_v1. Google’s merchant cryptography guide describes ECv2; Google says existing ECv1 implementations may continue to work, while enabling ECv2 payloads in production is coordinated with Google. Apple’s EC_v1 and Google’s ECv2 are different protocol identifiers, not compatible formats. Dispatch to a platform- and version-specific parser rather than trying to handle both with one generic “EC” flow. Apple’s token reference and Google’s merchant cryptography guide describe the respective formats.
As an Amazon Associate I earn from qualifying purchases.
Also keep the Google API version separate from the token protocol version: the API version identifies the request and response structure, while protocolVersion selects the token’s cryptographic scheme. Google’s request reference identifies ECv2 for DIRECT protocol configuration. Google Pay request objects
Free tools Windows power users keep installed
One-click scans. No signup required.
How the two token designs differ
| Dimension | Apple Pay | Google Pay ECv2 |
|---|---|---|
| Envelope | Serialized JSON with data, header, detached PKCS #7 signature, and version. |
Serialized JSON with protocolVersion, signature, intermediateSigningKey, and signedMessage; the signed message carries encryptedMessage, ephemeralPublicKey, and tag. |
| Key recovery and encryption | Use the header’s publicKeyHash to select the merchant key and restore the symmetric key; decrypt with AES-256-GCM for EC_v1 or AES-128-GCM for RSA_v1. |
Use P-256 ECIES-KEM and HKDF-SHA256 to derive separate encryption and MAC keys; authenticate with HMAC-SHA256, then decrypt with AES-256-CTR. |
| Trust validation | Validate the required certificate OIDs and chain to Apple Root CA G3, then verify the detached signature over version-specific data. | Validate the Google root and intermediate signing-key chain, then verify the signed message with the intermediate key. |
| Operational condition | The documented flow selects the corresponding merchant certificate and private key; the cited format reference does not state a universal rotation interval. | DIRECT requires qualifying PCI DSS compliance and secure credential-handling infrastructure; encryption keys must be rotated annually. |
The field names and algorithms above are protocol-specific; the full validation order and implementation details differ further, as described below. Apple token format reference; Google payment data cryptography; Google request objects
#1 Best Overall
- 1️⃣ Take Control of Your Finances - Easily set monthly financial goals and track your income, savings, debts, and expenses. Say goodbye to budget chaos with this comprehensive financial organizer.
- 2️⃣ Effortless Bill Tracking - Features a detailed bill management system: paid & auto-paid checklist, unpaid bills, due dates, amounts due, amounts paid, and unpaid balances. Includes a monthly overview to keep your income, expenses, and balance in check.
- 3️⃣ Extra Pages for Versatile Planning - Bill payment organizer includes dedicated sections to save bank account details, track debt payoff, summarize yearly financial progress, brainstorm ideas, and jot down notes for added flexibility.
- 4️⃣ High-Quality Design for Daily Use - 128 pages with a large 8 x 10-inch (20.32 x 25.4 cm) format for easy reading and writing. Printed with sharp, clear layouts to ensure a top-tier user experience that stands out from competitors.
- 5️⃣ More Than a Financial Tool - This bill tracker notebook is not just about tracking; it’s about celebrating progress. Over four years, your entries will document milestones and serve as a cherished keepsake of your financial achievements.
Apple Pay: validate the token, restore its key, then decrypt
An Apple token is a UTF-8 serialized JSON object. Its data field contains Base64-encoded encrypted payment data. The header includes publicKeyHash and transactionId, plus ephemeralPublicKey for EC_v1 or wrappedKey for RSA_v1; applicationData is optional. The signature is detached PKCS #7. Apple’s token format reference
- Validate the signing certificate. Check the required certificate OIDs and verify the trust chain to Apple Root CA G3.
- Verify the detached signature. Use the concatenation specified for the token version:
ephemeralPublicKey,data,transactionId, andapplicationDataforEC_v1; orwrappedKey,data,transactionId, andapplicationDataforRSA_v1. - Review the signing time. Apple says a CMS signing-time difference of more than five minutes from transaction time may indicate a replay attack. Treat this as a replay signal within the wider transaction checks, not as a substitute for checking whether the transaction was already processed.
- Select the merchant key and recover the symmetric key. Match
publicKeyHashto the relevant merchant public-key certificate and corresponding private key, then restore the symmetric key using the version-appropriate method. - Decrypt the data. Use AES-256-GCM for
EC_v1or AES-128-GCM forRSA_v1. Both use a 16-byte all-zero IV and no associated authenticated data. - Validate the payment against the request. Confirm the
transactionIdhas not already been credited, and compare currency, amount, and any application data with the original payment request before processing.
Apple says ECC is used in most regions. RSA may be used in some regions where ECC is unavailable because of regulatory concerns, so an implementation should not assume every Apple token is EC_v1. Apple’s token format reference
Google Pay ECv2: verify Google’s signing chain, authenticate, then decrypt
Google ECv2’s signed and encrypted PaymentData can represent a PAN or a device PAN and cryptograms. The envelope contains Google’s signature, an intermediate signing key, and a serialized signed message. Follow Google’s documented order: establish the signing-key trust chain and validate the signed payload before relying on decrypted values. Google’s merchant cryptography guide
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- Fetch the Google root signing keys. Verify the intermediate signing key’s signature with a non-expired root key and check that the intermediate key has not expired.
- Verify the signed message. Validate the payload signature using the verified intermediate signing key.
- Recover the shared secret and derive keys. ECv2 uses ECIES-KEM on NIST P-256 and HKDF with SHA-256 and no supplied salt. Derive 512 bits and split them into a 256-bit encryption key and a 256-bit MAC key.
- Authenticate before decrypting. Verify
tagwith HMAC-SHA256 and compare in constant time. Only after the tag is valid, decryptencryptedMessagewith AES-256-CTR, a zero IV, and no padding. - Check message expiration. Reject a decrypted message whose expiration has passed.
Google strongly recommends using an existing cryptographic library rather than writing signature-verification code. Its Java Tink paymentmethodtoken library handles the documented verification and decryption steps; Google’s guide says that library is available only in Java. Teams using another language should follow the protocol specification carefully and use reviewed cryptographic components rather than adapting Apple’s flow or assuming the Java library is available for their runtime. Google’s merchant cryptography guide
Decryption is not authorization
Decryption reveals payment data; it does not establish that the transaction is fresh, matches the order, or should be approved. Apple calls for replay checks and comparison of currency, amount, and application data with the original request. Google requires checking message expiration and retaining the merchant’s own transaction risk controls; its validation and fraud checks do not replace merchant risk management. Apply those checks before fulfillment or crediting a payment. Apple token format reference; Google payment data cryptography; Google Pay request objects
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Google DIRECT eligibility and key rotation
Google DIRECT is not a general-purpose decryption option for every merchant integration. Google requires PCI DSS compliance validated by a Qualified Security Assessor and servers equipped to handle payment credentials securely. Third-party gateway or processing providers serving merchants are not eligible for DIRECT; Google recommends using a supported gateway if the prerequisites are not met. Google Pay request objects
Rank #4
For DIRECT, Google requires encryption-key rotation annually and allows a three-month grace period; it says fulfillment requests may stop if keys are not rotated. During a key change, support both the old and new private keys. Keep the old private key available for eight days after removing its public key, and provide updated PCI documentation during rotation. Google’s merchant cryptography guide
That guide was last updated on 2026-02-20 UTC. It states that the current production root key is valid until 04/14/2038 under normal circumstances, except in the event of key compromise. Root-key validity is a live operational detail, not a reason to hard-code trust indefinitely: use the current official key-distribution and verification instructions when implementing or maintaining the integration. Google’s merchant cryptography guide
Quick Recap
Best Value
Implementation decision rule
- Dispatch on the token’s actual protocol/version field and preserve its platform-specific parsing rules.
- Verify the platform’s signing trust chain and signature before using payment data.
- Use only the cipher, key derivation, IV, and authentication rules documented for that exact token version.
- After decryption, enforce expiration, replay protection, order matching, and the merchant’s own risk decisions.
- For Google DIRECT, confirm eligibility and build key rotation and secure credential handling into operations from the start.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
