What is tokenization in payments?
Tokenization in payments replaces a card number (PAN) with a substitute value, the token, that is useless outside a defined context. The real number is kept in a secure vault, and only the token is stored and sent at checkout. Tokenization limits what a data breach can expose and can reduce PCI DSS scope.
In detail
Tokenization in payments replaces a card’s primary account number (PAN) with a token: a substitute value that has no meaning outside the system or merchant it was created for. The PAN is stored in a secure token vault, and only that vault can map the token back to the card.
Why operators use it
- Security: a stolen token cannot be used to pay elsewhere.
- Compliance: systems that only handle tokens can fall outside PCI DSS scope.
- Recurring payments: stored tokens let merchants charge saved cards without keeping card numbers.
Two main types
Vault tokens are created by a PSP or merchant vault to protect stored data. Network tokens are issued by card schemes such as Visa and Mastercard, replace the PAN across the whole payment chain and are updated when the card is reissued.
Tokenization is not encryption: a token has no mathematical link to the card number. Read the full explanation in What Is Tokenization? and the scheme view in network tokens.