An apparatus comprises a processing device configured to receive a request for access to a given protected resource, to receive a tokencode for validating the request for access to the given protected resource, to determine whether the processing device is connected to a network, to send the tokencode to a remote server over the network for validation responsive to determining that the processing device is connected to the network, and to validate the tokencode in the processing device to access the given protected resource responsive to determining that the processing device is not connected to the network.