If you have filed a company return on MCA, uploaded a GST filing, or bid on a government e-tender, you have used a small USB device called a DSC token. In 2026 this device is not optional for a Class 3 Digital Signature Certificate (DSC) in India — it is legally required. This guide covers what a DSC token is, why it is mandatory, what popular models cost, and how to set one up, reset its password, and keep it working.<\/p>\n
A DSC USB token is a small hardware device (a cryptographic USB dongle) that securely stores your Digital Signature Certificate and its private key. It looks like an ordinary pen drive but works very differently. Instead of storing files you can copy, it holds your private signing key inside a tamper-resistant secure chip that never lets the key leave the device.<\/p>\n
These tokens are built to the internationally recognised FIPS 140-2<\/strong> security standard (typically Level 2 or Level 3). When you sign a document, the signing happens inside<\/em> the token — the private key is never exposed to your computer, your browser, or the internet.<\/p>\n The requirement comes from the framework laid down under the Information Technology Act, 2000 and enforced by the Controller of Certifying Authorities (CCA). Certifying Authorities such as eMudhra, Capricorn, VSign, PantaSign and others issue every Class 3 DSC directly onto a FIPS-compliant crypto token. The rules require that the private key be generated and stored in a secure cryptographic device that does not allow the key to be exported.<\/p>\n Because of this, a Class 3 DSC is no longer issued as a downloadable software file. It must sit on a token — which is why portals like MCA21, GST, Income Tax, ICEGATE, DGFT, e-Procurement (GeM and CPPP) and EPFO all expect a hardware token.<\/p>\n Certifying Authorities support several CCA-approved token models. The most common ones you will encounter are listed below. All of them are FIPS 140-2 certified; the choice usually comes down to which model your CA supplies and driver familiarity.<\/p>\n The token hardware itself is inexpensive. In 2026, a blank FIPS-compliant USB token generally costs around Rs 400 to Rs 800<\/strong>, depending on the brand and vendor. Many CAs and resellers bundle the token free with the certificate, so what you actually pay is for the DSC plus token together:<\/p>\n Prices vary by Certifying Authority, validity period, and whether you buy from the CA directly or a partner. Always confirm the final quote includes GST and the token.<\/p>\n A token only works after its driver (also called the token management utility) is installed. The general steps are the same across brands:<\/p>\n The flow is simple but secure: you plug in the token, the portal asks you to select your certificate, you enter the token PIN, and the token performs the signing internally. Your private key never leaves the chip — only the finished digital signature comes back out.<\/p>\n Yes. A single crypto token can typically store more than one DSC — for example your Signing and Encryption certificates, or the DSCs of two or three people, subject to the token’s memory. That said, mixing several users’ keys on one device is a convenience-versus-control trade-off, so many people prefer one token per individual.<\/p>\n Every token has a User PIN<\/strong> (used for daily signing) and usually an Admin PIN \/ SO PIN<\/strong> (used to manage or unlock it). Handling of a forgotten password depends on which one you lost:<\/p>\n The takeaway: never lose the Admin PIN. There is no “forgot password” email link for a hardware crypto token — the security that protects you also means a lost Admin PIN can mean re-issuing the certificate.<\/p>\n The token itself does not “expire” — it is reusable hardware. What expires is the DSC inside it. Class 3 DSCs in India are typically issued for 1, 2, or 3 years<\/strong>. When the certificate expires, you renew or buy a new DSC and load it onto the same working token; there is no need to discard the token, which can serve across several certificate cycles.<\/p>\nWhy is a token mandatory for Class 3 DSC?<\/h2>\n
\n
Popular DSC tokens in India<\/h2>\n
\n\n
\n \nToken<\/th>\n Maker \/ Notes<\/th>\n Typical use<\/th>\n<\/tr>\n<\/thead>\n \n ePass2003 \/ ePass2003 Auto<\/td>\n Feitian; the most widely issued token in India<\/td>\n All-purpose Class 3 DSC<\/td>\n<\/tr>\n \n ProxKey<\/td>\n Watchdata-based; very popular with resellers<\/td>\n All-purpose Class 3 DSC<\/td>\n<\/tr>\n \n mToken (CryptoID)<\/td>\n Longmai; compact and reliable<\/td>\n All-purpose Class 3 DSC<\/td>\n<\/tr>\n \n Watchdata ProxKey<\/td>\n Watchdata; auto-run drivers<\/td>\n All-purpose Class 3 DSC<\/td>\n<\/tr>\n \n HYP2003<\/td>\n Newer FIPS token, auto-driver<\/td>\n All-purpose Class 3 DSC<\/td>\n<\/tr>\n \n Aladdin (eToken)<\/td>\n SafeNet \/ Thales; legacy but still seen<\/td>\n Older installations<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n How much does a DSC token cost?<\/h2>\n
\n
Drivers and setup<\/h2>\n
\n
How the token works when you sign<\/h2>\n
Can one token hold multiple certificates?<\/h3>\n
Resetting or forgetting the token password<\/h2>\n
\n
Validity<\/h2>\n
Practical tips<\/h2>\n
\n