Home / Knowledge hub / Tokenisation
Knowledge hub
Tokenisation
Replacing sensitive data with a harmless stand-in kept apart from the real value.
What it means
Tokenisation replaces a sensitive value, such as a card number, with a token that has no meaning outside your system. The real value is stored in a separate, tightly guarded place, often called a vault. The token is what the rest of your application sees and keeps. It is not the same as encryption, which scrambles the value but keeps it in place.
The idea that makes it click is that a good token cannot be worked back to the original. There is no key to steal that unlocks it. To get the real value, someone must ask the token service, and that service decides whether to answer.
Why it matters
A stolen database of tokens is close to useless. An order table full of tokens, rather than card numbers, means a breach of that table does not expose payment data. That is why payment providers push it hard for card storage.
It can also shrink audit scope. The PCI Security Standards Council notes that tokenisation can reduce the systems that handle card data, though it does not remove your PCI DSS duties. The token service itself becomes the thing to protect most carefully.
How it shows up
You meet it when a payment provider hands back a token after checkout, in stored cards, in customer records where an ID number is swapped for a reference, and in test data. Format-preserving tokens look like the original, which helps old systems that expect a certain shape.
The common mistakes are quiet ones. The token service answers anyone who asks, so a signed-in account reads another customer's real value. Tokens are guessable or sequential. Or the detokenise call is open to far more services than need it. Check who can turn a token back, not just where tokens are stored.
Questions people ask
Tokenisation, answered
Is tokenisation the same as encryption?
No. Encryption transforms data with a key, and anyone with the key can reverse it. A token is a stand-in with no mathematical link to the original, which lives elsewhere.
Some systems use encryption to build tokens, so ask your provider which kind they use.
Does tokenisation make us PCI compliant?
Not by itself. It can reduce how many of your systems touch card data, which narrows scope.
You still have duties for anything that sees card data, and for the way you connect to the token service.
What is the difference between tokenisation and masking?
Masking hides part of a value for display, such as showing only the last four digits. The full value usually still exists in the same place.
Tokenisation removes the real value from the system and keeps it elsewhere.
Can a token be stolen and used?
A token only works where the token service accepts it. Stolen tokens are still a risk if an attacker can call that service, or if the token itself can be used to make a payment.
Limit tokens to one merchant or one purpose where the provider allows it.
How do we test a tokenisation setup?
Try to turn a token back into the real value from an account that should not be able to. Then check whether one customer's token works on another customer's record.
Also check that logs and error messages never print the real value.
Sources
Where this comes from
Related
Terms that sit next to this one
Encryption at rest
Stored data scrambled so a stolen disk is useless without the key.
PCI DSS
The security standard for any business that handles payment card data.
Data masking
Hiding part of a value, such as card digits, so most people only see a safe version.
PII
Any data that points at a specific human being.
Hardware security module (HSM)
A tamper-resistant device that holds keys and does cryptography inside it.
Who can turn a token back?
Detokenise calls open to the wrong account, tokens that work on another customer's record and real values in error messages all fall within cross-account access testing, and each finding carries the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.