Why a token at all
A Class 3 Digital Signature Certificate is not stored as a loose file on your laptop. It is loaded onto a small **USB crypto token** — a secure device that holds your private key and never lets it leave. You plug it in to sign, and nobody can copy the key off it. This is a requirement under the CCA's guidelines.
FIPS-certified, by rule
The token must meet the **FIPS 140-2 Level 2** security standard. That certification is what makes the device trustworthy enough to hold a legal signing key.
Supported token models
The commonly supported tokens include:
- **HYP2003**
- **Watchdata ProxKey**
- **Gemalto SafeNet eToken 5110**
- **mToken**
- **PRECISION InnaITKey**
One token, one-time cost
A token is a one-time purchase. Once you own a compatible one, you can load a renewed certificate onto the same device later and avoid buying the hardware again.
Looking after it
- Keep the PIN private and memorised — too many wrong attempts will lock the token.
- Do not leave it plugged in when you are not signing.
- If it is lost, stolen or damaged, the certificate on it must be revoked and a new one issued.
Drivers
Before the token will work you install its small driver for your version of Windows. Each model has its own driver; we cover those on our support site.
Buying
We are putting together straightforward token deals. In the meantime, make sure any token you buy is one of the FIPS-certified models listed above.