Glossary
Tokenization
Tokenization replaces a sensitive value — an account number, a credential — with a non-sensitive substitute token that can be used throughout most of a system exactly as the original value would be, while only one specific, tightly controlled system retains the ability to reverse the token back to the real underlying value. Everywhere else in the system handles only the token, which is worthless to an attacker without access to that one reversal capability.
This narrows where the actual sensitive value ever has to exist in a usable form — rather than protecting the real value everywhere it might conceivably be handled, tokenization concentrates that protection requirement onto one narrow, specifically hardened component, and lets every other part of the system operate on data that carries no risk if it leaks.