A security device given to authorized users who keep them in their possession. To log in to the network, the security "card" or "token" may be read directly like a credit card, or it may display a changing number code that is typed in as the password or in addition to a primary password. USB-based tokens plug directly into the computer. The code can also be implemented entirely in software, and these "soft tokens" can be generated in a PC or smartphone. See SecurID card, challenge/response, authentication and security protocol.