Knowledge Base

Knowledge Base SafeNet Authentication Client software

Token Password Best Practices

Updated on October 1, 2026

Overview

Use this article to distinguish user and administrator passwords, change your initial password, manage authorized access, and get help when a password is forgotten or a token becomes inaccessible.

Applies to

SafeNet Universal Serial Bus (USB) tokens supplied by Sectigo for Organization Validation (OV) Code Signing, Extended Validation (EV) Code Signing, Document Signing, and applicable electronic identification, authentication and trust services (eIDAS) qualified signature creation device (QSCD) orders.

Understand the two passwords

The password in Sectigo’s encrypted issuance email is the user password, also called the token password—not an administrator password.

Password	Purpose	What to do
User/token password	Unlocks the token for operations such as signing	Enter it only when the application requests the user/token password
Administrator password	Used for token-management operations, which may include reset or unblock functions	Do not substitute the user password; seek Support guidance

If an administrator-password prompt appears, cancel the operation rather than entering your user password.

Repeated incorrect attempts can lock the token; stop if you are uncertain about the requested credential.

Attempt limits and recovery options require confirmation for your token model and configuration—do not assume a universal limit or guaranteed recovery.

Change the initial user password

Change the supplied user password after receiving the token.

1. Install SafeNet Authentication Client (SAC). Follow Set up your Sectigo token using SafeNet.

Connect the token using the supported connection instructions for your setup.

Open SAC and select Change Token Password.

Enter the current user password. Use the issuance password only if it has not already been changed.

Choose a new, unique password that meets the requirements displayed by SAC.

Complete the change and store the new password in your organization’s approved password manager.

Confirm that SAC reports a successful change before treating the new password as current.

If the password is rejected or the prompt is unclear, stop rather than repeatedly trying uncertain passwords.

Choose and store passwords securely

Use a long, unique password generated by an approved password manager, within the token’s displayed requirements.

Do not reuse a password from another system.

Do not write the password on the token, its packaging, or a note stored alongside it.

Do not send passwords through email, chat, or support tickets.

Record the token serial number and order number so the credential can be matched to the correct device.
Do not use the issuance email as the permanent record of a password you have changed.

Keep inventory details in an appropriately controlled record without exposing the password in ordinary project or order notes.

Handle the issuance email according to your organization’s security, retention, and audit policies; do not delete it merely because the password has changed.

Control who can use the token

Assign an authorized custodian and keep the token physically secured when not in use.

Review access when someone changes roles or leaves the organization.

For an organization-owned token, shared-vault access or a backup custodian should be used only where the certificate’s permitted use and organizational policy authorize it.

Do not assume that a company-managed vault permits multiple people to use a named-person certificate or personal eIDAS signing credential.

Plan signing continuity without bypassing signer authorization or approval controls.

The password is one access control—not the private key itself. Protect both the credential and the token, and restrict access to the signing computer.

If something goes wrong

The password is forgotten, rejected, or the token is locked

Stop guessing and contact Sectigo Support with your order number and token serial number.

Do not try the user password at an administrator prompt.

If the user password was changed, the issuance email does not provide the new password.

Ask Support to assess the device-specific recovery options; do not assume that recovery or replacement is automatic.

The password may have been exposed

If you still have authorized access, change the user password in SAC and follow your organization’s security-incident process.

Contact Sectigo Support promptly if the token may also have been accessed or certificate revocation may be needed.

A password change alone should not be treated as confirmation that unauthorized signing or key exposure has been ruled out.

The token is lost, damaged, or inaccessible

Contact Sectigo Support for assistance assessing the situation.

Do not initialize or reinitialize a provisioned token as a password-recovery step: this can erase the certificate and private key rather than restore access.