What Is Tokenization for WooCommerce Saved Cards?
How WooCommerce Tokenization Actually Works
When a customer enters a card at checkout with "save this card" selected, the card details go directly from their browser to the gateway's secure servers (never touching your site's own server if using hosted or embedded fields, as most modern integrations do). The gateway generates a token — essentially a random ID with no mathematical relationship to the actual card number — and sends that token back to WooCommerce to store. Next time the customer checks out, WooCommerce sends the token back to the gateway, which looks up the real card on its own secure side and processes the charge.
Why This Matters
- A database breach of the store's own site exposes only tokens, which are useless to an attacker without access to the specific gateway account that issued them — this is the core security benefit tokenization provides.
- PCI compliance burden drops significantly for stores using tokenization through hosted/embedded gateway fields, since the site itself never handles raw card data at any point.
- Tokens are typically gateway-specific, which is exactly why saved cards don't carry over when switching payment gateways — the old token means nothing to a different provider.
- The last-four-digits and expiry shown at checkout are safe display details the gateway explicitly permits storing alongside the token, since they don't expose enough to be useful for fraud on their own.
What This Means Practically
- Confirm the active gateway integration uses proper tokenization (virtually all reputable ones do) rather than any custom handling of raw card numbers.
- Never attempt to store or log full card numbers anywhere on the site, even temporarily, regardless of tokenization being used elsewhere.
- Understand that saved cards are gateway-specific when planning any future gateway migration.
Questions about how your specific gateway handles stored payment data? See WooCommerce fixes.