7

Encrypted Website Payments

To add security to online payments, merchants can create Encrypted Website Payment (EWP) 

button code using standard public key encryption. With public and private keys, merchants 

can dynamically encrypt payment information before it is sent to PayPal.

N

O T E

:

The PayPal Software Development Kit includes commands to create private keys and 

public certificates for EWP and to generate EWP code. For more information, see the 

PayPal SDK Guide.

How It Works

Encrypted Website Payments works in the following way.

T

ABLE

7.1

How Encrypted Website Payments Work

Merchant...

Buyer...

PayPal...

Creates HTML name/value pairs that 

represent the parameters of the 

HTML FORM to post to PayPal when 

a customer clicks a button on his 

website

Encrypts those button parameters 

with PayPal's public key

Signs the encrypted data with his own 

private key

Publishes the signed, encrypted 

Clicks  Pay  button, which 

Checks the authenticity of the data by 

FORM to his website with a  Pay  

posts the signed, encrypted 

using the merchant's uploaded public 

button

FORM data to PayPal's 

key

URL

Decrypts the data with PayPal's 

private key

Directs the buyer's browser to the 

PayPal payment flow specified in the 

button parameters

Website Payments Standard Checkout Integration Guide

August, 2005

71