Tokenization is the process of replacing sensitive data with a substitute value, called a token, so systems can use that value without exposing the original.

In data security, the token stands in for information such as a payment card number. Applications can store or pass the substitute through a workflow while access to the underlying data is restricted. This is different from the tokens used in OAuth authorization or to divide text for an AI model.

How data tokenization works

In a vault-based design, a tokenization service receives the sensitive value, generates a substitute and stores the mapping in a protected repository. Other systems use the token as a reference. An authorized operation can retrieve the original value through a controlled process often called detokenization.

Other designs generate tokens using cryptographic methods without keeping the same kind of lookup mapping. The implementation determines whether and how the original can be recovered. The word tokenization alone does not establish the token’s security properties.

The tokenization service becomes an important protection boundary. Access to its retrieval functions needs authorization and monitoring. Replacing data in one database achieves little if every application can freely exchange a token for the original value.

A payment example

A retailer can associate a customer with a payment token rather than retaining the original card number in its customer profile. Its support team can refer to the saved payment method without viewing the full card data.

EMV payment tokenization adds defined payment use cases and controls, such as restricting a token to a particular usage domain. It is one application of tokenization, with its own participants and lifecycle. A generic database token should not be assumed to behave like an EMV payment token.

If an attacker takes over the customer’s account, they may still be able to make purchases through authorized payment workflows. Hiding the card number reduces data exposure but does not decide whether the person initiating a transaction is legitimate.

Tokenization, encryption and masking

Encryption transforms data into ciphertext that can be decrypted with the appropriate key. Tokenization replaces data with a substitute and can use encryption internally. Masking changes what is displayed, such as showing only the last digits of a number, without necessarily removing the original from storage.

The choice depends on what downstream systems need to do. A service that only needs a stable reference may not need access to the original value at all. Mapping dependencies and token retrieval permissions should be reviewed before assuming that tokenization has removed sensitive data from a workflow.

Frequently asked questions

Is a data token the same as an access token?

No. A data token substitutes for sensitive information. An OAuth access token is a credential used to request authorized access to a resource.

Can tokenized data be recovered?

In reversible designs, authorized systems can recover the original through a mapping or cryptographic process. Other designs are irreversible. The implementation determines the behavior.

Does tokenization make account takeover irrelevant?

No. An attacker may abuse an account’s permitted actions without seeing the original sensitive data. Authentication and transaction-level controls still matter.

Related: PCI DSS · Data Breach · API Security · Authorization · Account Takeover (ATO) · Transaction Monitoring