Primary Account Number (PAN)
What it is
The cardholder account number as embossed / encoded on the card — up to 19 digits, LLVAR.
The PAN identifies the card: the first 6–8 digits are the BIN/IIN that routes the transaction to the issuer, the last digit is the Luhn check digit. In authorization messages it arrives from the terminal (keyed, swiped, dipped, or tapped); in tokenized transactions the DPAN travels here instead of the real PAN.
PCI DSS treats DE 2 as cardholder data: it must be masked when displayed (at most the BIN and last 4 digits) and rendered unreadable in storage. DE 34 (PAN, extended) exists for account numbers that do not fit DE 2 conventions and is rarely used.
Example values
16 4761739001010119LL=16 length prefix followed by a 16-digit Visa test PAN.DE 2 on the wire
Bitmap position
DE 2 is bit 2 of the primary bitmap: byte 1, mask 0x40. A primary bitmap with only DE 2 present reads 4000000000000000 in hex.
Length
DE 2 is variable length (LLVAR): a 2-digit prefix gives the length of the value in digits, from 0 to 19. A 12-digit value is sent as 12 followed by the value. In ASCII the prefix is the bytes 31 32; dialects that pack lengths as BCD send 12 instead.
Size in the message
At most 21 bytes when the message travels as text (ASCII or EBCDIC), or 11 bytes in binary dialects that pack digits as BCD.
Format n
Format n means numeric: the digits 0–9 only.
Specification reference
Defined in ISO 8583:1987 (base). Card networks publish their own dialect tables (Visa BASE I / V.I.P., Mastercard CIS) that refine formats, lengths, and — for private-use elements — the entire layout. Always confirm against the interface specification you implement.