In a server for authenticating a user, an acquiring unit acquires current authentication information that is created using an arbitrary value and that is used for a current authentication process, from user. A receiving unit receives first transmission information in which next authentication information to be used for a next authentication process is hidden using the current authentication information, and second transmission information in which the arbitrary value is hidden using the next authentication information, from the user. A calculating unit calculates the next authentication information based on the first transmission information and the current authentication information, and the arbitrary value based on calculated next authentication information and the second transmission information. A determining unit determines whether to authenticate the user based on the arbitrary value and the current authentication information.