Types of Tokenization: Vault and Vaultless

The two types of tokenization are vaulted and vaultless. Vaulted tokenization stores the mapping between each token and its original data in a secure vault database, so it can be reversed by lookup. Vaultless tokenization uses cryptographic algorithms in a secure device to generate tokens without storing any mapping.

Tokenization comes in two main types: vaulted and vaultless. Vaulted tokenization keeps a secure database (the vault) that maps each token to its original sensitive value, which allows authorized detokenization by lookup. Vaultless tokenization generates tokens using standards-based cryptographic algorithms in a secure device, with no vault database to store or protect. Both protect data such as payment card numbers and support PCI DSS compliance.

Key Takeaways

• There are two types of tokenization: vaulted (vault) and vaultless.
• Vaulted tokenization stores a mapping of tokens to original data in a secure vault database; detokenization is a lookup in that vault.
• Vaultless tokenization uses cryptographic devices and standards-based algorithms to generate tokens, with no database to store or secure.
• Vault tokenization’s main drawback is scale: as data grows, the vault database grows, which slows detokenization and adds overhead.
• Vaultless tokenization is generally more efficient and removes the vault as a single point of risk, which is why many modern deployments prefer it.

Why Tokenization Matters for Payments

Customers use payment cards constantly, and every transaction handles data that is valuable to attackers, which makes it a target. Under PCI DSS, cardholder data must be kept secure, and tokenization is a common way to do it. Tokenization replaces sensitive data with non-sensitive data: if a card number were xxxyyyzzzz, tokenizing it might produce something like apxcladajedpo9iiuwqdw, a value that is useless to an attacker. There are two ways to do this, and they differ in how (or whether) the original data can be recovered.

Vault Tokenization

In vault tokenization, a secure database called the tokenization vault stores the sensitive data alongside its corresponding token. This table of sensitive and non-sensitive values is what makes detokenization possible: detokenization is the reverse process, where the original data is fetched from the vault using the token. In other words, the token is exchanged back for the sensitive value it stands in for.

How vault tokenization works

1. The organization passes its sensitive data to the vault tokenization server.
2. The server converts the original data into a token and saves the mapping in the vault database.
3. The token (non-sensitive data) is sent back to the organization, which stores only the token.
4. To comply with PCI DSS, access control governs retrieval. When the original data is needed, an authorized application requests it using the token.
5. The application passes the token to the vault tokenization server, which looks it up in the vault database and converts it back to the original data.
6. The authorized application now has the original data.

Disadvantage of vault tokenization: as the volume of data grows, the vault database grows with it, which increases detokenization processing time and makes the implementation more demanding to run and scale. This scaling limitation is the main reason vaultless tokenization was developed.

Vaultless Tokenization

Vaultless tokenization is generally more efficient and safer than vault tokenization because it does not maintain a database at all. Instead, it uses secure cryptographic devices running standards-based algorithms to convert sensitive data into tokens. Because there is no stored mapping, there is no vault database to grow, secure, or breach. The token is generated algorithmically rather than looked up, which removes the scaling bottleneck and eliminates the vault as a single point of risk.

How vaultless tokenization works

1. The organization passes its sensitive data to the secure cryptographic device.
2. The device uses a standards-based cryptographic algorithm to generate a token from the data, without storing any mapping.
3. The token is returned to the organization and used in place of the sensitive data.
4. When the original is required, the authorized application uses the secure device to reverse the process algorithmically, with no vault lookup involved.

Vault vs Vaultless Tokenization: Comparison

Aspect	Vault Tokenization	Vaultless Tokenization
How tokens are created	Generated and stored with a mapping in a vault database	Generated algorithmically by a secure cryptographic device
Stored mapping	Yes, in the vault database	No stored mapping
Detokenization	Lookup of the token in the vault	Algorithmic, no vault lookup
Scalability	Slows as the database grows	Scales well, no growing database
Main risk	The vault is a valuable target and a single point of risk	No vault to breach; relies on securing the device and algorithm
Efficiency	More overhead at scale	Generally more efficient

For the broader concept and how tokenization compares with encryption, see the companion overview, What Is Tokenization? This article focuses specifically on the two implementation types.

Which Type Should You Use?

Neither type is universally correct; the right choice depends on scale, architecture, and risk tolerance:

• Choose vaulted tokenization when you need a clear, auditable store of the token-to-data relationship and your data volumes are moderate, or when existing systems expect a vault-based model.
• Choose vaultless tokenization when scale and performance matter, when you want to avoid maintaining and securing a growing database, or when you prefer to remove the vault as a single point of risk.

Many modern deployments favor vaultless tokenization for its efficiency and reduced attack surface, but the decision should follow a proper assessment of your data flows and compliance obligations.

How Encryption Consulting Helps

Choosing between vaulted and vaultless tokenization, and implementing it so it actually reduces PCI DSS scope and risk, is where Encryption Consulting’s Encryption Advisory Services help. We assess your sensitive data flows, recommend the right tokenization model (and where encryption fits alongside it), and design an architecture aligned to PCI DSS and your performance needs. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

What are the two types of tokenization?

The two types are vaulted (vault) tokenization and vaultless tokenization. Vaulted tokenization stores the mapping between each token and its original sensitive value in a secure database called a vault, so the original can be retrieved by looking up the token. Vaultless tokenization uses secure cryptographic devices and standards-based algorithms to generate tokens without storing any mapping, so there is no vault database to maintain or secure.

How does vault tokenization work?

In vault tokenization, the organization sends sensitive data to a vault tokenization server, which generates a token and stores the token-to-data mapping in a secure vault database. The organization keeps only the token. When the original data is needed, an authorized application sends the token back to the server, which looks it up in the vault and returns the original value. Access control governs this retrieval to meet PCI DSS requirements.

How does vaultless tokenization work?

Vaultless tokenization uses a secure cryptographic device running standards-based algorithms to generate a token from sensitive data, without storing any mapping in a database. The organization uses the token in place of the real data. When the original is needed, the authorized application uses the secure device to reverse the process algorithmically. Because there is no vault, there is no growing database to secure and no vault to breach.

What is the main disadvantage of vault tokenization?

The main disadvantage is scalability. Because vault tokenization stores every token-to-data mapping in a database, the vault grows as data volumes grow. A larger vault increases the time needed for detokenization lookups and makes the system more demanding to run and scale. It also concentrates risk, since the vault holds all the sensitive mappings and becomes a high-value target. Vaultless tokenization was developed to address these issues.

Is vaultless tokenization more secure than vault tokenization?

Vaultless tokenization is often considered safer because it does not maintain a database of sensitive mappings, so there is no vault to breach and no single store concentrating all the risk. It is also more efficient at scale. That said, security depends on correctly protecting the cryptographic devices and algorithms it relies on. The best choice depends on your data volumes, architecture, and compliance needs, which is why an assessment helps.

Which type of tokenization is best for PCI DSS compliance?

Both vaulted and vaultless tokenization can support PCI DSS compliance by replacing cardholder data with tokens and reducing the systems in scope. Vaultless tokenization is often preferred at scale because it avoids maintaining and securing a growing vault database, but vaulted tokenization can suit environments that need an auditable token-to-data store. The right choice depends on your data volumes, performance requirements, and existing architecture.

Choose the Right Tokenization Model

Vault or vaultless, the right tokenization model protects sensitive data and can cut PCI DSS scope, but the choice should fit your scale and architecture. Explore Encryption Consulting’s Encryption Advisory Services to design the tokenization approach that fits your data and compliance needs.