identifier 105 may be art internally masked token serial number or another obfuscated identifier unique to the security token the token pin unblock applet 25 communicates 155 with the client unblock application 30 and is the only token based applet that a user can successfully initiate after the security token has been blocked due to sequential incorrect pin entries a one way message digest hash o 110 of the original answers to the set of passphrases is stored inside the security token and associated with the pin unblock applet 25 the pin unblock applet 25 includes the ability to compare the reference one way message digest hash o 110 passphrases against a later hashed passphrase result passed to the applet by the client unblock application 30 the one way message digest preferably uses sha 1 however other common message digest functions such as md 5 may be used as well so long as consistency is maintained between the digest function used to create the reference hash and the subsequent response hash an administrative shared secret secret t 115 is used to unblock an existing pin block applet 120 the counterpart shared secret is securely stored on the remote sever and is only passed to the pin unblock applet 25 after a user has correctly entered the proper passphrases.