decryptPAN

decryptPAN(
encrypted: EncryptedPAN,
encryptionKey: Buffer,
): string

Source: storage.ts:75

Decrypts an EncryptedPAN using AES-256-GCM. GCM authentication tag is verified before any plaintext is returned — if the tag fails, an error is thrown and no plaintext is exposed.

Parameters

encrypted (EncryptedPAN) — EncryptedPAN object from encryptPAN()
encryptionKey (Buffer) — The same 32-byte key used during encryption

Returns

string — The original 16-digit PAN string

Throws

If key is wrong, data is tampered, or input is malformed.