The new integrated Vault interface for Magento 2 payment methods includes a public_hash that is generated from the payment method information:

    $hashKey = $paymentToken->getGatewayToken();
    if ($paymentToken->getCustomerId()) {
        $hashKey = $paymentToken->getCustomerId();

    $hashKey .= $paymentToken->getPaymentMethodCode()
        . $paymentToken->getType()
        . $paymentToken->getTokenDetails();

However, it is unclear to me what the purpose is of this hash. It doesn't hash any information that's not also stored in clear text, and it's not the primary key of the database table.

Does anybody know why this field was added?

1 Answer 1


The public_hash is used to reference the card from untrusted sources (like on checkout). It gives each card a unique non-sequential identifier that can't be readily guessed, to help curb any possible abuse.

  • What is the reason for using this instead of the entity ID of the record in the vault? If it's just an arbitrary identifier, I can't see the point. What's also strange is that it seems to be using symmetrical encryption rather than a true one-way hash, even though it's never decrypted that I can see. Commented Mar 22, 2017 at 3:30
  • I just reread your answer and noticed your point about it being "non-sequential." That explains why they don't just use the entity_id. Good point! Commented Mar 23, 2017 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.