I meant storing it on the server - just preferring not to have any actual cc data on the cookie, even obfuscated or encrypted. It may be a distinction without a difference, though, I honestly have never dealt with anything more complex than your basic 'hash username and password and check the hash when they login' scheme.