The Thales payShield family is purpose-built for the payment card industry - providing secure PIN processing, EMV card issuance, message authentication, and cryptographic processing for banks, payment processors, acquirers, and ATM networks.
Secure generation, translation, and verification of PINs for debit and credit card transactions - meeting PCI DSS requirements for PIN security.
EMV card issuance
Comprehensive EMV support for card personalization and issuance - including the cryptographic operations required to create and issue chip-and-PIN payment cards to EMV specifications.
Payment message authentication
Generation and verification of MACs (Message Authentication Codes) to ensure the integrity of payment messages between banks, switches, and acquirers.
ATM key management
Secure management of ATM terminal keys including initial key loading, remote key distribution, and the ATM Key Management System for secure key envelope printing.
Internet and mobile payment security
Secure processing for online and mobile payment transactions with RSA PIN encryption and support for internet payment application security requirements.
Broad command set support
Supports Mark II, AMB, and other payment HSM command sets - compatible with payment processing software from major vendors and backward compatible with legacy deployments.
payShield Payment HSM Product Lines
payShield 10K
The payShield 10K is Thales's enterprise-grade, on-premises payment HSM - the current flagship of the payShield family that has secured the majority of the world's payment transactions for decades. It handles PIN processing, EMV and mobile card issuance, message authentication, and payment tokenization at up to 10,000 transactions per second, with hot-swappable power and dual redundant ports for the always-on demands of a live payment network.
Because it is backward-compatible with earlier payShield deployments, banks and processors can upgrade their HSM estate without rewriting existing payment applications or host integrations - a significant advantage when a payment system's uptime requirements make a rip-and-replace migration too risky to consider.
Up to 10,000 transactions per second
DES/Triple-DES, AES (128/192/256-bit), RSA up to 4096-bit, ECC, HMAC, SHA
Hot-swappable power, remote configuration and monitoring
Best for: Issuers, acquirers, processors, and payment networks running their own data center infrastructure who need certified, high-throughput payment cryptography on hardware they control.
payShield Cloud HSM delivers the same payShield 10K cryptographic engine as a subscription service instead of hardware you own and rack yourself - a bare-metal, single-tenant, PCI-compliant HSM reachable over a cloud-agnostic connection to AWS, Azure, or GCP.
This is the practical alternative for organizations that want to modernize payment infrastructure without a capital outlay: no upfront hardware purchase, capacity that scales with transaction volume, and automatic access to the latest certified hardware generation as Thales rolls it out - useful for a fintech or processor whose transaction volumes are growing faster than a fixed on-prem HSM estate can be resized.
Subscription pricing - no upfront hardware capital cost
Same certified payShield 10K cryptographic foundation
Cloud-agnostic connectivity to AWS, Azure, and GCP
Single-tenant, PCI-compliant dedicated capacity
Elastic scaling and managed hardware refresh
Best for: Fintechs, processors, and banks moving payment workloads to the cloud, or anyone who wants to avoid tying up capital in dedicated payment HSM hardware.
A browser-based remote management platform for payShield 10K deployments - handling key management, firmware and license updates, and security configuration from anywhere, so staff no longer need physical access to the data center to administer an HSM.
AES-256 and ECC-521 protected remote sessions with smart-card authentication
Role-based access control for administrative tasks
Centralized master key management and firmware updates
24/7 remote visibility and operational support
Best for: Organizations running payShield HSMs across multiple sites who want to cut the cost and delay of physical data center visits for routine administration.
Centralized, 24x7 monitoring across every payShield HSM in a distributed estate - tracking health, utilization, tamper events, and configuration changes from one dashboard instead of per-site logins.
Real-time HSM health, utilization, and capacity tracking
Threshold-based alerts via email, SNMP, syslog, or web
Administrator, Group Manager, and Auditor roles
Historical reporting from one hour up to extended windows
Best for: Operations and security teams who need early warning of capacity or configuration problems before they cause a payment outage.
A secure, touchscreen handheld device for loading and transporting cryptographic keys into a payShield HSM under dual control - replacing the older paper key-component and smart-card processes still used in many payment key-management procedures.
Touchscreen interface with role-based, dual-control authentication
Supports multiple key output and transport formats
Encrypts sensitive key material during handling
Designed for compliance with card-scheme key-ceremony requirements
Best for: Key custodians and security officers who need an auditable, tamper-resistant way to load or transport payShield encryption keys.
payment HSM vendor worldwide - ABI Research Competitive Assessment, ranked ahead of Utimaco and Futurex
390
RSA 2048-bit operations per second - independently benchmarked payShield 10K throughput
83,000
Thales Group employees across 68+ countries, backing global 24/7 payment HSM support
The EU's Digital Operational Resilience Act (DORA) has been in force since January 2025, and card-scheme PCI PIN Security requirements continue to tighten. If your payment HSM key-management and monitoring processes aren't audit-ready, payShield Manager and payShield Monitor can help close that gap.
Built for the Post-Quantum Transition
Payment credentials and the cryptographic keys that protect them can be harvested today and decrypted later once large-scale quantum computers become practical - a risk known as "harvest now, decrypt later." For an industry built on long-lived card numbers and decades-long key-management practices, that risk needs to be planned for years before it materializes, not after.
Thales is an active participant in NIST's post-quantum cryptography standardization process, and the payShield platform's architecture is designed to adopt new algorithms as standards mature - so a payment HSM estate bought today doesn't become the reason a migration to quantum-safe cryptography stalls.
Frequently Asked Questions
Payment HSMs are required by any organization that processes payment card transactions, issues payment cards, or operates ATM networks - including banks, payment processors, acquirers, card personalization bureaus, and e-payment service providers. PCI DSS and card scheme rules require the use of approved HSMs for PIN processing and key management.
Yes - the payShield 10K meets PCI PTS HSM requirements and is approved for use in payment environments. It meets the security requirements of Visa, Mastercard, and other card scheme programs for PIN security and key management.
Payment HSMs implement the specific command sets (Mark II, EMV APIs) required by the payment industry for PIN processing, card issuance, and ATM key management. General Purpose HSMs provide broader cryptographic capabilities (PKI, code signing, TLS) but do not implement payment-specific command sets.
In its latest competitive assessment, ABI Research ranked Thales the #1 payment HSM vendor, ahead of Utimaco and Futurex, citing payShield's throughput (390 RSA 2048-bit operations per second), the broadest range of deployment options in the category, and Thales's participation in NIST's post-quantum cryptography standardization.
Thales is an active participant in NIST's post-quantum cryptography standardization process, and payShield's architecture is designed to evolve as new algorithms are adopted. On the regulatory side, the EU's Digital Operational Resilience Act (DORA), in force since January 2025, requires financial entities to demonstrate strong ICT risk management and resilience - payShield Manager and payShield Monitor help provide the auditable visibility and key-management controls that DORA compliance depends on.
Get in touch
Request Thales Payment HSM Pricing
As a Thales reseller, Sersor supports the local compliance and procurement side of your payment HSM project. Tell us about your payment processing requirements - we will come back with a tailored proposal within one business day.
Thank you!
Your request has been submitted. We will be in touch within one business day.
