Detokenization is the controlled process of converting a token back into the original sensitive value. In a tokenization system, the token is the placeholder; detokenization is the step that reverses it, usually through a secure vault or mapping service and only after authorization checks pass.
This matters because the security of tokenization depends on tight control over when and where detokenization can happen. If attackers steal tokens but cannot detokenize them, the data is far less useful. If they compromise the vault, access controls, or application logic that requests detokenization, they may recover the protected records. Defenders therefore limit who can request detokenization, log every lookup, and separate the token store from systems that only need to process or analyze the data. In practice, detokenization appears in payment flows, customer support tools, and analytics systems when a trusted service needs the real value for a legitimate business action.