An authentication system including: (i) a user device, such as a mobile phone or media player, for storing random identification data for a user of the user device, and for processing entered token data to generate response data on the basis of the identification data; (ii) a client device, such as a personal computer, for use by the user to request a session, such as an online banking session, with a server system, for receiving the token data in response to the request, and for sending the response data to the server system; and (iii) a server of the server system, for storing the random identification data for the user, generating the token data for the client device on the basis of the identification data in response to the request, and for processing the response data to determine authentication for the client device for the session.