---
title: Validate payment password
summary: Compares an encrypted candidate payment password against the stored, encrypted payment password value.
status: draft
owner: SAIF
last_reviewed: 2026-07-30
library: SAIF.Business.Security.SystemUser
reference_type: package
operation_id: OP-SU-09
trigger: Caller calls clsSystemUser.CheckPaymentPWD(inPaymentPwd)
---

# Validate payment password

`CheckPaymentPWD` answers whether a candidate payment password matches the value currently stored for the loaded user. It underpins [Enforce payment password uniqueness](enforce-payment-password-uniqueness.md), which negates this result as its first uniqueness check.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-SU-09 |
| **Trigger** | Caller calls `clsSystemUser.CheckPaymentPWD(inPaymentPwd)` |
| **Inputs** | `inPaymentPwd` — the candidate payment password |
| **Outputs** | `Boolean` match result |
| **Primary components** | `clsSystemUser.CheckPaymentPWD(...)`, `clsSecureEncrypt.EncryptString(...)` |
| **Entry point** | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |

## Steps

1. **Encrypt the candidate value.** `CheckPaymentPWD` calls `clsSecureEncrypt.EncryptString(inPaymentPwd)` ([BR-011](../business-rules.md#br-011-payment-password-comparisons-use-encrypted-values)).
   - `clsSecureEncrypt` is provided by the `SAIFEncrypt.dll` internal local binary; its internal encryption implementation is opaque to this library.*
2. **Compare against the stored value.** The encrypted candidate is compared directly (`=`) to `PaymentPWD`, a property that reads `m_DirUser.MiddleName` — the AD attribute used to store the payment password's encrypted form ([BR-011](../business-rules.md#br-011-payment-password-comparisons-use-encrypted-values)).
3. **Return the match result.** `isValid` is set to the comparison result and returned; the plaintext candidate itself is never compared directly to any stored value.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([Caller calls CheckPaymentPWD]) --> Encrypt[Encrypt candidate via clsSecureEncrypt.EncryptString]
	Encrypt --> Compare[Compare to stored PaymentPWD - MiddleName attribute]
	Compare --> Return([Return Boolean match result])
```

## Failure and edge-case behavior

- Because the comparison is encrypted-to-encrypted, a change in the encryption algorithm or key used by `clsSecureEncrypt` would silently break all existing stored comparisons; no such migration logic exists in this method.*
- The method relies on `m_DirUser` already being loaded; calling it before a user context is established would compare against whatever `MiddleName` value is present (or fail if `m_DirUser` is `Nothing`).*

## Related documentation

- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources

- `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`