A token is a device or digital artifact used to verify a user’s identity and grant access to protected systems or resources. Tokens are a key part of multi-factor authentication (MFA) and two-factor authentication (2FA), providing an additional layer of security beyond just a username and password.
Types of tokens include:
- Physical tokens: Devices such as smart cards, USB keys, key fobs, or badges with embedded chips. These generate or store codes or cryptographic keys used during login.
- Digital tokens: Software-based tokens, often delivered via a mobile app, SMS, or email, which generate time-sensitive codes (one-time passwords, or OTPs) for authentication.
How tokens work:
- When logging in, after entering a username and password, the user is prompted to provide a code generated by the token.
- The token may generate a unique code each time (dynamic password) or store cryptographic information for challenge-response authentication.
- The server verifies the code or cryptographic response, granting access only if it matches the expected value.
Purpose and advantages:
- Tokens make it much harder for attackers to gain unauthorized access, even if they have stolen a password, because they would also need the physical or digital token.
- They are widely used for securing access to computer networks, sensitive data, online banking, and even physical spaces like secure buildings.
Key features:
- Tokens can store passwords, cryptographic keys, or biometric data.
- They may use interfaces such as USB, NFC, Bluetooth, or RFID.
- In digital contexts, tokens (such as JSON Web Tokens) can securely transmit identity information between applications, allowing users to remain authenticated without repeatedly entering credentials.