Tech, ExplainedNetworking, infrastructure and security
Concept

Tokenisation

A stand-in for the real number.

HOW IT WORKSA system receives asensitive number, suchas a card numberThe secure placestores the real numberand creates a tokenThe system stores andsends only the tokenWhen the real numberis needed, the tokengoes back to thesecure placeOnly the secure placeconverts the tokeninto the real numberIf the system's data is stolen, the thief gets only tokens, which work nowhere else.HOW IT WORKSA systemreceives asensitivenumber,such as acard numberThe secureplacestores thereal numberand createsa tokenThe systemstores andsends onlythe tokenWhen the realnumber isneeded, thetoken goesback to thesecure placeOnly thesecure placeconvertsthe tokeninto thereal numberIf the system's data is stolen, the thief gets only tokens, which work nowhere else.HOW IT WORKSA system receives a sensitive number,such as a card number↓The secure place stores the real numberand creates a token↓The system stores andsends only the token↓When the real number is needed, the tokengoes back to the secure place↓Only the secure place converts the tokeninto the real numberIf the system's data is stolen, the thief gets onlytokens, which work nowhere else.
A sensitive number is stored in one secure place, every other system keeps only a token, and only the secure place can convert the token back into the real number.
opens a page inside this one a page in the same scene a page in another scene a concept page a label only, with no page

Tokenisation means replacing a sensitive number, such as your card number, with a different number called a token. The real number is stored in one secure place. Only that place can convert the token back into the real number. So even if someone steals a token, they cannot use it on its own.

The best-known example in India is card tokenisation, also called card-on-file tokenisation. Since October 2022, RBI rules say that online shops and payment gateways cannot store your full card number. Your phone uses the same idea: a digital wallet stores a token for each card you add.

Here is how it works in general. The first time a system receives the real number, the secure place stores that number and creates a token for it. The system keeps only the token. Each time the real number is needed, the system sends the token back to the secure place, which converts it into the real number. If a thief steals the system's data, they get only tokens. Those tokens do not work on any other website or app.

Take, for example, a card that you save on a shopping app. When you pay, the app sends only the token, and the card network, such as Visa or RuPay, converts it back into your real card number so that your bank can approve the payment.

Consider a company that stores phone numbers, bank account numbers or patient IDs in its databases. With data tokenisation, it replaces these numbers with tokens, so that its analysts can study the data without seeing anyone's real details.

Say an AI agent pays on your behalf. It can be given its own token, with its own spending limit, and if there is a problem, only that token is cancelled while your card continues to work as usual.

How is tokenisation different from its close neighbours? Data masking hides part of a number. For example, a masked card number shows only its last four digits. Tokenisation replaces the whole number. Encryption scrambles the real number, and anyone who has the key can unscramble it. A token can be converted back only by the one secure place that stores the real number.

Appears in

Networking, infrastructure and security
Fintech
Tech, Explained is a part of ingrid.fyi. Every page explains one piece of technology in plain words.