Short answer
Payment tokenisation replaces a card number with a random token that is useless to a thief. The real number stays in a secure vault at the provider or card network. Merchants use tokens to store cards for repeat payments, shrink their PCI burden and lower breach risk, but tokens can tie a business to its provider.
Part of How payments work. Start with the main guide: How a card payment works: authorisation, clearing and settlement
Key takeaways
- A token stands in for the card number. It has no value outside the system that issued it.
- Tokenisation and encryption are different. A token cannot be turned back into a card number by maths, only by looking it up in a vault.
- There are three main types: gateway tokens, network tokens and device tokens such as those used by phone wallets.
- Tokens can reduce a merchant's PCI scope, but only if the merchant's own systems never hold the card number.
- Gateway tokens usually stay with one provider, which can make switching harder. Ask about token migration.
When a customer saves a card on a website, or a gym takes a monthly payment, the business does not need to keep the card number. It keeps a token instead. If a hacker steals the token, they have nothing they can spend. That small idea sits behind most modern card payments, from one-click checkout to phone wallets.
This guide explains payment tokenisation in plain terms: what a token is, how it works, the three main types, what it does for PCI compliance, and what a payment consultant should check on a merchant's contract and statement. It is spelt tokenization in the US, and you will see both.
What is payment tokenisation?
Payment tokenisation replaces a card number, known as the primary account number or PAN, with a substitute value called a token. The token looks like a number but has no use on its own. The real card number is held in a secure vault run by the payment provider or the card network.
A good token has no mathematical link to the card number it replaces. Nobody can work out the card number from the token, however much computing power they have. The only way back is to ask the vault, and the vault only answers requests from trusted systems.
How does tokenisation work?
The process has two halves: creating the token and using it later.
- Customer enters the cardOn a checkout, in a hosted payment form or on a terminal.
- Details go to the vaultThe provider receives the card number directly and stores it securely.
- A token is returnedThe merchant receives a token, not the card number.
- Merchant stores the tokenIn its customer record, for repeat payments or refunds.
- Later payment uses the tokenThe merchant sends the token, and the provider looks up the card and runs the payment.
The merchant never needs to store the real card number.
The key point is that the card number goes straight to the provider. On a well-built checkout it never touches the merchant's own servers, so there is no card number there to steal.
Is tokenisation the same as encryption?
No, though people mix them up. Encryption scrambles a card number using a key, and anyone with the key can unscramble it. Tokenisation swaps the number for a random substitute that cannot be unscrambled at all.
| Question | Tokenisation | Encryption |
|---|---|---|
| What does the merchant hold? | A token with no value | An encrypted card number |
| Can it be reversed with maths? | No, only by a vault lookup | Yes, with the key |
| What if it is stolen? | Useless outside the system | Safe only while the key stays secret |
| What does it protect? | Stored cards and repeat payments | Card data moving between systems |
| Effect on PCI scope | Can reduce it | Usually does not remove it |
Most payment systems use both. Encryption protects the card number as it travels to the vault. Tokenisation protects it once it is stored.
What are the main types of token?
Not every token is the same, and the difference affects portability and cost.
- Gateway or processor tokens. Issued by the payment gateway or provider and usable with that provider only. They are the most common for online stores and card-on-file payments.
- Network tokens. Issued by the card network, such as Visa or Mastercard, and managed by the network. They can be used across merchants that support them and can update automatically when a card is reissued or expires, which can reduce failed repeat payments.
- Device tokens. Created when a card is added to a phone or watch wallet. The wallet holds a device-specific token, and the real card number is not shared with the merchant. This is part of why tapping a phone can be safer than tapping a card.
Network tokens usually need support from the provider and may carry their own fees. A merchant with many failed subscription payments should ask whether network tokens are available.
What does tokenisation do for PCI compliance?
Tokenisation can shrink the part of a business that falls under card security rules, known as PCI scope. The PCI Security Standards Council publishes guidance on how tokenisation can reduce the systems that store, process or transmit card data.
The effect depends on design. If the merchant's systems only ever see tokens, and the card number goes straight from the customer to the provider, the merchant has far less to protect and a simpler compliance form. If the merchant's own systems still handle card numbers before they are tokenised, the scope does not shrink in the same way.
Merchants who key card numbers by phone, as covered in MOTO payments explained, should still use a system that tokenises the number rather than writing it down. For the fees that can sit behind compliance, see PCI compliance fees explained.
Where do merchants use tokens?
Tokens are everywhere once you know to look.
- Card on file. Online shops that remember a card for next time.
- Subscriptions and memberships. Monthly payments taken without the customer re-entering details.
- One-click checkout. A saved card, confirmed with a tap or a code.
- Refunds. The provider can refund to the original card using the token.
- Phone wallets. Apple Pay and Google Pay use device tokens.
- Pay-by-link and virtual terminals. The provider holds the card, and the merchant holds the token.
How does tokenisation connect to 3D Secure?
Tokenisation protects stored card data, while 3D Secure checks that the person paying is the cardholder. They work together. A customer may authenticate with 3D Secure when they first save a card, and later payments can use the token without asking again, subject to the rules that apply. See 3D Secure explained for how the authentication step works.
What should a payment consultant check?
Tokens create costs and dependencies that are easy to miss. Check these before recommending a switch.
- Does the merchant store cards?Subscriptions, card on file and one-click checkout all do.
- Whose tokens are they?Gateway tokens usually belong to the provider that issued them.
- Can they be moved?Ask the current and new provider about secure token migration, and how long it takes.
- Are there vault or token fees?Look for storage, network token or tokenisation lines on the statement.
- What happens if tokens are lost?Customers may need to re-enter cards, which can lose repeat revenue.
Tokens can be the hidden cost of leaving.
Token migration is possible with many providers but it is not automatic, and it usually needs cooperation between the old and new provider. A merchant with thousands of saved cards should plan for it, because a failed migration can interrupt recurring payments. Add any vault or token fee to the monthly cost in the calculator, and see acquirer, ISO, payfac and gateway to work out which company holds the tokens.
What are the limits of tokenisation?
Tokenisation reduces risk but does not remove it. It does not stop fraud, because a criminal who steals a token and uses it through the merchant's own compromised system can still make payments. It does not protect card details that are written down, recorded on a call or typed into an insecure system before tokenisation. And it does not replace authentication, which is the job of 3D Secure.
It is best seen as one layer in a set of controls, alongside encryption, authentication, staff training and fraud checks.
Frequently asked questions
What is payment tokenisation in simple terms?
It swaps a card number for a random substitute called a token. The business stores the token, and the real card number stays in a secure vault with the provider or card network.
What is the difference between tokenisation and encryption?
Encryption scrambles data with a key and can be reversed by anyone holding the key. A token is a random substitute that cannot be reversed with maths, only by asking the vault that issued it.
What is a network token?
A network token is issued by a card network such as Visa or Mastercard. It can work across supporting merchants and can update when a card is reissued, which helps recurring payments keep working.
Does tokenisation make a business PCI compliant?
No. It can reduce PCI scope and simplify compliance, but only if the business's own systems never hold card numbers. The business should confirm its requirements with its provider.
Can I move saved cards to a new payment provider?
Often yes, but it needs a secure token migration between the old and new provider and is not automatic. Ask both providers how it works and how long it takes before you switch.
Do tokens cost anything?
Basic gateway tokens are often included in the service, but some providers charge for vault storage or network tokens. Look for tokenisation or vault lines on the merchant statement.
Sources and further reading
Figures in this guide are examples to show the method. Fees, rules and rates change, so check your own statement, contract and current rules before you decide. This is general information, not financial or legal advice.