Tokenization (payments)
Also called card tokenization, payment tokens.
Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service.
Last updated
What it is.
With tokenization, the sensitive value, such as a card number, is stored by a token service, usually the payment provider. Your system stores and uses only the token: to charge the card again, show the last four digits or issue a refund. The PCI SSC published guidance on tokenization and PCI DSS in August 2011.
It is different from encryption. Encrypted data can be decrypted by anyone with the key; a token has no mathematical link to the original and only the token service can map it back.
Why it matters
If your systems never hold real card numbers, a breach of your database does not leak them, and much less of your stack is in PCI scope. The same idea is used for other sensitive values, such as bank account or ID numbers.
In a product build
Tokenization is the default in modern payment builds: card entry goes through the provider's fields, and the product stores tokens, card brand and last four digits only.
Common mistakes.
- 01
Logging the card number before it is tokenized, for example in a debug log.
- 02
Building your own token vault without need, which brings it into PCI scope.
- 03
Assuming tokens from one provider work with another if you switch.
Read the official text.
Primary sources this definition is based on.
- PCI SSC press release: PCI DSS Tokenization Guidelines (August 2011)checked 2026-10-25
- PCI Security Standards Council glossarychecked 2026-10-25
Work it out with a tool.
Related terms.
- PCI scopeEvery system, person and process that PCI DSS applies to, because it handles card data or can reach systems that do.
- Encryption at restEncrypting stored data, such as databases, files and backups, so it cannot be read without the key.
- Cardholder data environment (CDE)The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them.
- SAQ (self-assessment questionnaire)The PCI DSS form that eligible merchants and service providers use to document the results of their own assessment.
