Self-identification of tokens

A technique of protecting a datum within a set of sensitive data is presented. In this technique, the datum includes a first set of bits satisfying a first set of constraints, and a computer receives the set of sensitive data from an authorized client. The technique involves producing a token corresponding to the datum, the token including a second set of bits distinct from the first set of bits, the second set of bits satisfying a second set of constraints, the second set of constraints being a superset of the first set of constraints. The technique further involves storing the datum and the corresponding token. The technique further involves sending the token to the authorized client, the authorized client enabled to perform, using the second set of bits, a verification that the token satisfies the second set of constraints, the verification being performed apart from the database.