Token

A token is a small digital pass that proves you are logged in or allowed to do something, and a stolen token can work like your password.

Token: A token is a short piece of data that a website or app gives you after you sign in, so you do not have to type your password each time. It acts like a temporary pass. Anyone who steals it may be able to act as you until it expires.

Tokens appear in many forms: login tokens in apps, session cookies in browsers, API keys that connect apps and tokens that a bank app creates to confirm a payment. They make life easier, but if malware or a fake login page grabs one, the attacker may skip your password and even your OTP. Fake login pages try to capture tokens as well, which is why checking the web address first matters so much.

Protect tokens by keeping devices clean and updated, logging out of shared computers, and removing devices you no longer use from account settings. Never paste a token, link code or API key into a chat or form because someone asks. A bank or company never needs a token from you. Signing out and signing in again creates a fresh token and ends the old one.

Tips

• Log out of accounts on shared or borrowed computers and phones.
• Review the logged-in devices list in your Google and WhatsApp accounts and remove ones you do not know.
• Never share a login code, link code or key with anyone who asks.

Related terms