Passcodes and tokens use a secret combination of numbers to prove your identity when trying to access an account or system. After entering your login information, a physical or digital token device generates a one-time passcode (OTP). The code is received via email, text, or a mobile authentication app and needs to be submitted to verify the user’s identity and grant access.