What happens to a card number you save
What does an online shop keep when you tick “save this card”? If it tokenizes, it keeps a stand-in. The PCI Security Standards Council, the card industry’s security body, describes tokenization in its 2011 guidance as a process in which the primary account number is replaced with a surrogate value. Turning the token back into the number is called de-tokenization.
The same document shows that a token can take several shapes. One can be letters and digits, another digits only, and a third can keep the first six and last four digits of the card with the middle replaced. A single-use token stands for one transaction. A multi-use token always maps to the same card, so a merchant can follow that card across many purchases without holding the number.
Two places a token can be made
EMVCo, which writes the EMV chip and token standards, draws the main line. Its payment tokens travel from the point of purchase through the merchant’s acquirer and the card network to the issuing bank, and each can be limited to one merchant, one device or one kind of payment.
When the card network issues one itself, it is a network token. Other forms cover only one stretch of that chain, for example between a merchant and its acquirer, as EMVCo’s own FAQ notes.
Provider tokens of that second kind show up on payments company Stripe’s pricing page, read on November 12, 2026. It lists a Vault and Forward API that stores card details in Stripe’s vault and passes them to other processors when a payment is routed elsewhere. The same page prices Shared Payment Tokens, built for software agents that buy on a customer’s behalf, at $0.15 for each token issued.
The rulebook and who pays to join it
EMVCo’s own listing shows version 2.4 of its tokenization framework published on July 9, 2026, almost five years after version 2.3 of October 19, 2021, following a draft open for comments until May 1, 2026. The framework also defines a payment account reference, a value that links every token back to one card for fraud checks and loyalty programs.
Each token service provider that issues these tokens gets a three-digit code from EMVCo. According to its registration page, the first year costs $11,500 and each renewal $2,850. EMVCo adds that it “does not evaluate, approve or otherwise endorse” the providers it registers, so a code proves registration and nothing more.
What tokenization does not do
The most common misreading is that tokens end a merchant’s card security obligations. The PCI guidance says plainly that tokenization does not remove the need to maintain and validate compliance with PCI DSS, the card industry’s security standard. It can shrink the number of systems an assessor has to check, provided the card number cannot be recovered from any system taken out of scope.
The council’s 2015 product guidelines add that a token “should be distinguishable from a valid PAN”, and the 2011 text rules out tokenizing card security codes and PINs altogether. Hashing deserves care too. The guidance warns that someone holding both a hashed and a truncated version of the same card number may rebuild the original with relatively little effort.
Before you rely on a provider’s tokens, ask who can de-tokenize them, and whether they are network tokens, which the card network can replace for one merchant without a new card, or tokens that work only with that one provider.