Member Avatar for ivanshish

Hey, is there a possible way to display the stars (*) on a webpage but not in password field?
For example on Amazon is it possible to display hidden credit/debit card numbers?

  • 3 Contributors
  • 4 Replies
  • 100 Views
  • 4 Hours Discussion Span
  • Latest Post Latest Post by JorgeM

Dani AI

Generated

Short summary and practical guidance.

As asked about the asterisks shown next to saved cards: those characters are a rendering choice by the site. If the server never transmits the full PAN (primary account number) to the browser, there is nothing in the HTML, DOM or CSS that can be used to reconstruct the hidden digits. Conversely, if a site does place the full number into the DOM or into JavaScript, it can be discovered with developer tools — which is why production sites avoid that practice. 's legality warning is relevant, and 's comment about where the visible stars come from points to the same implementation tradeoffs.

For implementers: never keep cleartext PAN in the browser. Common safe patterns:

  • Tokenize or store the card with a PCI-compliant processor and keep only a token plus the last four digits.
  • Render the visible mask server-side (for example, produce "****1234") and send only that string to the client.
  • If offering a “reveal” feature, require a secure server endpoint, additional authentication, and strict logging and access controls.

Small examples:

function maskPan(pan) {
  return pan.replace(/\d(?=\d{4})/g, '*'); // JS: replace all digits except last 4
}
$masked = str_repeat('*', max(0, strlen($pan) - 4)) . substr($pan, -4); // PHP

Operational checks and further reading:

  • Do not store PAN in input values or JavaScript variables on pages that customers can access.
  • Check the browser Network tab — if the PAN never appears in requests/responses, it cannot be revealed client-side.
  • Follow PCI DSS and OWASP guidance for handling card data: PCI Security Standards and . For how password inputs mask characters in the browser, see MDN input type=password.

Recommended Answers

All 4 Replies

Member Avatar for pritaeas

Care to explain a little more? Sounds like illegal activity.

Member Avatar for ivanshish

For example <tr>************9212</tr>. Is it possible to view it? I am not trying to be illegal.

Member Avatar for pritaeas

Is it possible to view it?

No, not possible. This information is not sent to the browser.

Member Avatar for JorgeM

So I assume your looking at the page's source view since you have included the HTML elements in your example. As pritaeas mentioned, the browser is not receiving all of the credit card numbers. It's actually getting the asterisks from the webserver so they data is not sent in transit.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.