What is a hardware token?
A hardware token is a physical object used to prove identity. Because an attacker has to possess the device, it supplies the "something you have" factor. Combined with a password or PIN ("something you know"), it creates multifactor authentication (MFA). Organizations often require hardware tokens for administrator accounts, VPN and remote access, and other high-risk sign-ins, and they work without cell service or a smartphone.
Types of hardware tokens
- OTP key fobs: small devices with a display that show a one-time password (OTP). Time-based tokens (TOTP) change the code on a fixed interval, typically every 30 or 60 seconds; counter-based tokens (HOTP) produce a new code at each button press. Both are built on a secret shared between the token and the server. The user types the code at sign-in.
- FIDO security keys (FIDO U2F and FIDO2/WebAuthn): keys that plug into USB-A or USB-C, or tap over NFC. Instead of a typed code, the key answers a cryptographic challenge that is tied to the real website's domain, so a response captured by a fake site does not work on the real one. That makes them phishing-resistant. Many FIDO2 keys also require a PIN or touch and can store passkeys.
- Smart cards: cards with a chip that hold a certificate, used with a card reader and a PIN. The US government CAC and PIV cards are common examples.
Compared with other MFA methods
| Method | Phishing resistance | Main weakness |
|---|---|---|
| SMS or voice code | Low | Phone numbers can be moved (SIM swap) or messages intercepted |
| Authenticator app (code or push) | Medium | Codes can be typed into a fake page; users may approve push prompts by mistake |
| OTP hardware token | Medium | The code can still be phished; the fob can be lost |
| FIDO2 security key | High | Loss of the key; needs a free port or NFC |
| Smart card with PIN | High | Needs readers, middleware and certificate management |
Hardware tokens as an application requirement
Some software will not start, or will not let the user sign in, unless a physical device is present. Besides security keys and smart cards, this includes USB license dongles used by professional CAD, audio and laboratory software, where the license lives on the key rather than the PC. Practical requirements a technician should check before installing:
- A free, compatible port; a USB-A dongle on a USB-C-only laptop needs an adapter or dock
- The vendor's driver, license runtime or smart card middleware
- USB or smart card redirection enabled when the app runs in a Remote Desktop or virtual desktop session
- Removable-device policies that might block the token along with USB storage
For a "key not found" error, confirm the token is seated, look for it in Device Manager, try a port directly on the computer, confirm the runtime is installed, and only then suspect the token.
Support issues
Treat a lost token as a security event: verify the user's identity, revoke the lost token's enrollment and issue a replacement. Registering a second key as a backup prevents lockouts. Code-generating tokens can drift out of sync with the server or run out of battery and may need resynchronization or replacement.
Hardware token on the CompTIA A+ exam
Hardware tokens appear in Core 2 (220-1202) objective 2.1, where they are compared with other MFA methods such as authenticator apps, SMS and voice codes, and TOTP, and in objective 1.10, where an external hardware token can be an application requirement. If a question asks for the most phishing-resistant MFA option, think FIDO2 hardware security key. If newly installed software will not open on a new PC while the old PC still runs it, look for a license dongle or smart card left behind. If a token works locally but not inside a remote session, check USB or smart card redirection.