Tokenisation

Tokenisation replaces sensitive data, such as a card number, with a random code (a token) that is worthless outside the payment system. Online stores use tokens to remember a card for a next purchase or a subscription without storing the card number itself. On Shopify this happens in the secure environment of Shopify or your payment provider. More on secure payments in our guide to Shopify payments.

In short

A token points to a card but does not reveal the card number.

Tokenisation makes saved cards, subscriptions and fast repeat purchases possible.

On Shopify, card data stays in a PCI-certified environment, outside your own systems.

How does tokenisation work?

The customer enters their card details in the checkout.

The payment provider stores the card number in a secure vault.

The store gets a token back, a string of characters with no value to outsiders.

On the next payment the store sends only the token; the provider links it to the real card.

If a token leaks, nobody can use it to pay elsewhere. As a result, far fewer systems fall under the requirements of PCI DSS. Card networks also offer network tokens, which can be updated automatically when a card is replaced.

Tokenisation or encryption?

Encryption scrambles data, and anyone with the key can make it readable again. A token has no mathematical link to the card number; only the provider's vault knows the mapping. In practice payment systems use both: encryption in transit, tokens for storage.

Tokenisation on Shopify

Saved cards for B2B: on all plans, business customers can have a card stored for later payments.

Subscriptions: only work with gateways that support saved cards; otherwise you need a separate solution.

Shop Pay remembers the customer's payment and shipping details for faster checkout.

Extra verification: on a new payment the bank can ask for verification again via 3D Secure.

Example in a Shopify context

A coffee roaster sells monthly subscriptions through a subscription app on Shopify Payments. The customer enters their card once; after that the app charges a token every month. The roaster never sees the full card number and so does not have to secure it.

Frequently asked questions

What is tokenisation in payments?

Replacing a card number with a random code that points to the real card only inside the payment system.

Is tokenisation the same as encryption?

No. Encrypted data can be made readable again with a key. A token has no link to the card number; only the provider's vault knows the mapping.

Does my Shopify store hold card data?

Not in your own systems. Saved cards are held by Shopify or your payment provider; your store only works with references.