Card tokenization is the process of substituting the primary account number (PAN) of a payment card with a non-sensitive surrogate value, called a token. The mapping between the token and the real card is held by a secure token service, so the token cannot be reversed by anyone who does not have access to it.
Why it matters
Merchants who store tokens instead of card numbers hold far less sensitive data, which can reduce breach impact and the scope of PCI DSS compliance. Network tokens, issued through the card networks, are usually tied to a specific merchant or device and can update automatically when a card is renewed. Some regulators have required tokenization for saved cards, and in India the RBI rules for card-on-file data restrict merchants from storing real card numbers. Wallets such as phone payment apps rely on device tokens.
Example
Card number: 4111 1111 1111 1111
Token: 4895 4200 0000 7731
Merchant: example-store onlyA repeat purchase sends the token. The network exchanges it for the real number, and if it is used at another merchant, the request is declined.
Common mistakes
- Mixing up tokenization with encryption. Encryption is reversible with a key; a token has no mathematical link.
- Assuming stored tokens never need the CVV or authentication.
- Confusing this with API or JWT tokens.
Rules vary by country; this entry is a definition only.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.