The payment card number, also known as the Primary Account Number (PAN), is the initial input into the tokenization system. This is the sensitive data that needs to be protected.

The PAN is typically a 16-digit number, embossed on the payment card, and includes information such as:

- Card number

- Expiration date

- Card verification value (CVV)

The PAN is considered sensitive personal information and needs to be handled securely to prevent unauthorized access and fraud.

Once the PAN is input into the tokenization system, SHA-256 is used to generate a unique token, which replaces the PAN, ensuring the sensitive data is protected and secure.