DSC token password reset & unlock guide (ePass2003, ProxKey, mToken)

Forgotten your DSC token PIN, or locked it out with too many wrong tries? This happens all the time, and the fix depends on the token and whether you still have the admin PIN. Here is exactly how to change, reset and unlock the password on the common tokens — ePass2003, HYP2003, Watchdata ProxKey and mToken.

First: which token do you have?

Every token has its own small manager application, installed with its driver. Install the correct driver first if it is not already present: mToken, HYP2003 or ProxKey. Then open that token's manager to change or reset the PIN.

Change your PIN (you know the current one)

1. Plug in the token and open its manager tool (ePass2003 / SafeNet token manager, WD ProxKey manager or mToken manager).
2. Click Login and enter your current user PIN.
3. Choose Change PIN (or Change Password).
4. Enter the old PIN, then a new PIN twice, and save.

Reset a forgotten PIN (using the Admin / SO PIN)

If you have forgotten the user PIN but know the Admin PIN (also called SO PIN or PUK), you can set a new user PIN without losing the certificate:

1. Open the token manager and look for Unlock, Reset PIN or Admin Login.
2. Enter the Admin / SO PIN.
3. Set a new user PIN and confirm.
4. Log in with the new PIN to verify.

The exact menu wording differs slightly between ePass2003, ProxKey and mToken managers, but the flow — admin login, then set new user PIN — is the same.

Token locked or blocked — what now?

Entering the wrong PIN too many times (usually 3–10 attempts, depending on the token) locks the user PIN. At that point:

• If you know the Admin PIN, use it to unlock and set a new user PIN (steps above).
• If the Admin PIN is also exhausted or unknown, the token is permanently blocked. The certificate inside cannot be recovered, and the DSC must be re-issued on a new token.

This is why you should set your own PIN on day one and keep the admin PIN safe — it is the only key that unlocks a locked token.

Good PIN habits

• Change the default PIN on first use (some tokens ship with a default such as 12345678).
• Store the Admin/SO PIN somewhere safe and separate.
• Do not share the PIN — it authorises legally valid signatures.
• If unsure of the current PIN, stop and check before you exhaust the attempts and lock the token.

Frequently asked questions