Tokenization is the replacement of a sensitive value, most often a card's primary account number, with a substitute string called a token that is meaningless outside the system that issued it. The real value sits once in a secured vault, and other systems handle only the token. Network tokens, issued by scheme token services, are bound to one merchant or device and survive card reissue; PSP tokens work only with the issuing gateway, so switching PSPs means migrating card data. Unlike encryption, a token has no mathematical link to the value, so systems seeing only tokens can fall outside PCI DSS scope. Buyers of a PSP check who holds detokenization rights and whether the vault can migrate.
What is a payment token
A payment token stands in for the card number so a merchant, wallet or PSP can charge the card without storing it. Tokenization in payment processing produces two families. Network tokens are issued by scheme token services under the EMVCo tokenisation specification and are bound to one merchant or device; Apple Pay and Google Pay store them as device PANs. PSP tokens work only with the gateway that issued them, so switching PSPs means a card data migration.
Payment token vs card number: a stolen token fails at any other merchant, a network token payment carries a one-time cryptogram so replayed data is rejected, and when a card is reissued the scheme relinks the token to the new PAN.
How does payment tokenization work
At checkout the provider stores the PAN in its vault and returns a token such as tok_4f9a2c. The merchant saves the token and sends it for later charges; the provider swaps it back inside its secure environment before passing the card to the acquirer. A merchant with 250,000 stored cards sees roughly a quarter reissued each year: with PSP tokens up to 62,500 credentials go stale, with network tokens renewals continue.
How does tokenization protect payment data
Breached tokens yield nothing chargeable, and systems that see only tokens can fall outside PCI DSS scope. A PSP holding 3 million card numbers across 12 databases is assessed on all 12; after centralising them in one vault, perhaps two systems remain in scope.
Tokenization vs encryption
Encryption transforms data with a key, and anyone holding the key can reverse it, so encrypted card data is still cardholder data under PCI DSS. A token has no mathematical link to the value, only a vault lookup. In practice data is encrypted in transit and at rest, and tokenized elsewhere.
What is security tokenization
Tokenization (security) is the architecture view: how the vault, its keys and hardware are arranged so real data lives in one small, controlled zone.
HSM in payment security
A hardware security module generates and uses keys without exposing them in plaintext. It encrypts PANs in a vaulted design or derives tokens in a vaultless one, where security rests on key rotation, split knowledge and dual control.
What is detokenization
Detokenization exchanges a token for the original value, the one point where protected data becomes readable again. How does detokenization work? An authenticated caller sends the token, the service checks permissions, decrypts the entry and ideally forwards the PAN straight to the acquirer. Network tokens are detokenized by the scheme, never by the merchant.
Tokenization vs detokenization: one happens at every checkout, the other should be rare, limited to named services, rate-limited and logged. A buyer of a PSP checks who holds detokenization rights and whether the vault can migrate, since non-portable tokens tie merchants to the platform.