Smart-data pipelines (smart-meter IDs, account numbers, IoT telemetry keys) often can't just encrypt sensitive fields — downstream billing, analytics and legacy schemas expect the same digit count and type. Format-Preserving Encryption (FPE) solves this with an unbalanced Feistel network run over the digit domain (base 10), the same construction NIST SP 800-38G standardizes as FF1/FF3:
split digits into halves L, R (4+4)
for round i = 1..r:
F = RoundFunction(R, key, i) // pseudorandom digits
(L, R) = (R, (L + F) mod 10)
token = L || R
Because a Feistel network is invertible by construction — regardless of whether F itself is invertible — anyone holding the same key can run the rounds backward and recover the exact original digits. That's what the Detokenize button does: it re-derives F for each round from the last record's key and undoes the swap-and-mix step by step. Try the "guessed wrong key" checkbox — one wrong key produces a completely different (and wrong) digit string, because every round's mix depends on it.
One-Way Hash mode models the alternative approach used by many DLP/vault-based tokenization systems: a keyed one-way function collapses the original digits into a token with no mathematical inverse. Recovering the original there requires the vault's stored token→value mapping, not math — so in this simulator, detokenization always fails in Hash mode, exactly as it would against a real vault you don't have access to.
- Feistel rounds — more rounds mix R further into L before the network is considered secure; too few rounds leaves structure an attacker could exploit.
- Round key K — the shared secret; every round function reseeds from it, so it must never travel with the token.
- Collision risk — a birthday-bound estimate for the 10⁸ possible 8-digit tokens as more records stream through.