Abstract: A security method comprises initiating a security token with a particular user through a personal computer client by accepting a personal identification number (PIN) as a code1 input, wherein a user is expected to remember the PIN in later accesses of the servers. And, generating a master key as code2 which does not need to be remembered by the user. Then, encrypting the code2 with a symmetric key cipher, using the code1 input as an encryption key, and storing the ciphertext in the security token. Later, registering the user with a USER_ID at a server with a SERVER_ID, and a password. And, obtaining the PIN from the user as a code1 which is used as a decryption key to decrypt the ciphertext back to its original code2. And, computing the password from the USER_ID, SERVER_ID, and code2. Afterwards, logging-on the user with a USER_ID at a server with a SERVER_ID, and a password.