A small device used to authenticate user access to an information system. Hardware tokens are distinguished from smart cards in that they do not require any type of reader or sensor. They are synchronized with an authentication server at the time they are issued; and they remain synchronized with the server for the life of the token. The token generates and displays a one-time password; which the user types into the device he or she uses to access the system; along with his or her personal identification number. The principal advantage of hardware tokens is their portability. They enable authentication from any device without imposing any special software or hardware requirements on the device. The principal disadvantage is the requirement that users carry the tokens with them; although credit-card-size tokens and key-fob form factors reduce the nuisance factor of this burden.