Restricting access to a device includes obtaining a passphrase for a user, obtaining access credentials for the user, obtaining a PIN value for the user, one-way encrypting at least the access credentials and the PIN using a secret key provided with the device. The user is allowed access to the device if the result of one-way encrypting equals the passphrase. The user is denied access to the device if the result of one-way encrypting does not equal the passphrase. The device may be a storage device. The access credentials may include a username that identifies the user and may include a role for the user. The access credentials may include a time period for which access is allowed. Access may be subsequently revoked in response to the current date and time being greater than the time period for which access is allowed.