Tokenization replaces a card number with a meaningless reference — a token — that only your payment provider can resolve back to the real card. You store the token, charge it whenever you need to, and never hold the card details yourself.
How it works
- The customer enters their card
Into a hosted field or iframe served by your provider, so the number never reaches your server.
- The provider vaults it
The real card number is stored inside their PCI-compliant environment.
- You receive a token
Something like tok_1a2b3c — a reference with no relationship to the underlying number.
- You charge the token
Now, or in twelve months. The provider resolves it internally; you never see the card again.
Why it matters more than it sounds
| Without tokens | With tokens |
|---|---|
| Card numbers on your servers | Only opaque references |
| PCI SAQ D — 300+ requirements | PCI SAQ A — roughly 20 |
| A breach exposes real cards | A breach exposes useless strings |
| Recurring billing means storing cards | Recurring billing means storing tokens |
The compliance consequence is the largest of these. Keeping raw card numbers out of your systems is precisely what earns the reduced PCI scope.
Network tokens
A newer variant, issued by Visa and Mastercard themselves rather than by your processor. They carry two real advantages.
- They update automatically. When a card is reissued after expiry or loss, the network token keeps working — which directly reduces the involuntary churn that failed cards cause.
- They authorise better. Issuers treat a network token as a stronger signal than a raw card number, typically lifting approval rates by a point or two.
GOOD QUESTIONS
Frequently asked
What is the difference between tokenization and encryption?+
Encrypted data can be decrypted back to the original with the right key. A token has no mathematical relationship to the card number at all — it is a lookup key into your provider's vault. If a token leaks, it is worthless outside that provider.
Can I move my tokens to another processor?+
Not directly, since tokens are specific to the provider that issued them. Most major processors will run a PCI-compliant migration transferring the underlying card data to the new provider, which then issues its own tokens. Ask before you commit — it is the main technical obstacle to switching.
What is a network token?+
A token issued by Visa or Mastercard rather than by your processor. It updates automatically when a card is reissued and typically improves authorisation rates by a point or two, because the issuer trusts it more than a raw card number.
Are tokens safe to store in my database?+
Yes, and that is the point. A token can only be charged through your account with your provider, so it has no value to an attacker who obtains it. Storing tokens is what keeps you out of PCI scope while retaining the ability to bill.