Abstract: A secure authentication code is provided. A authentication code generator has an internal-key biometric input arrangement, for storing a password derived from the biometric input, and for generating a transaction code based on a transaction input, a biometric input, and the internal key. A personal key is derived based on the internal key and a biometric input, and transferring the personal key to a server in a secure initialization session. The authentication code generator is used to derive a transaction code for each transaction that is communicated to the server at the time when transaction parameters are transmitted to the server. At the server level, the transaction parameters and the personal key are used to generate a reference that is compared with the transaction code to authenticate the transaction.