Tokenization

Tokenization replaces a card number with a random value called a token. You can store the token and use it to charge the card again. Only the processor can map the token back to the real number, inside its own secure vault, so a stolen token is useless elsewhere. This is how a business saves a card for future billing without handling the card number.

How it works

1. At checkout, the payment gateway collects the card number and sends it to the processor.
2. The processor stores the real number in its vault and returns a token. Stripe returns it as a saved payment method.
3. To charge the card later, the business sends the token. The processor swaps in the real number internally.

In Stripe, saving a card with a SetupIntent creates this kind of reusable token.

Why it matters

• The raw card number never touches your servers, which shrinks your PCI DSS compliance work.
• A subscription can renew every month without the customer typing their card again.
• A stolen token can't be used outside your account, so a data leak exposes far less than leaked card numbers would.

The card data stays in the processor's vault and never in your database.