A method for generating an OTP by a security token for authentication to an authentication module, wherein the security token has an electronic memory, which is not available for direct access via an interface of the security token, and only a processor of the security token may perform memory access, wherein first data and second data are stored in the electronic memory, and wherein a version of the first data and of the second data is stored additionally in a database, the method having the following steps: - coupling in electrical energy through a terminal in order to supply energy to the security token, - sending a command to generate the OTP from the terminal to the security token, - by means of the security token, cryptographically deriving the OTP from the first and second data, which are stored in the electronic memory, wherein the cryptographic derivation of the OTP is performed by a keyed hash function, wherein the second data are used as a secret key for encrypting a hash value calculated from an input value of the keyed hash function, wherein the first data, a value derived from the first data, or a value determined by the first data are/is used as input value, - displaying the OTP on a display device of the security token, - determining updated first data with the aid of a function by the security token, - by means of the security token, replacing the first data by the updated first data in the electronic memory, wherein the second data remain unchanged, - producing a network connection between a user computer system and the authentication module, - inputting the OTP into the user computer system, - transmitting an identifier and the OTP from the user computer system, via the network connection, to the authentication module, - accessing the database by the authentication module with the identifier as access key in order to read the version of the first and second data stored in the database, - cryptographically deriving (168, 186) a further OTP by means of the authentication module with the version of the first and second data read from the database, - checking, by the authentication module, whether the OTP and the further OTP match, and, if so, generating an authentication signal, determining updated first data with the aid of the function by means of the authentication module, and storing the updated first data in the database as the current version of the first data, on the condition that the OTP and the further OTP match. - coupling in electrical energy through a terminal in order to supply energy to the security token, - sending a command to generate the OTP from the terminal to the security token, - by means of the security token, cryptographically deriving the OTP from the first and second data, which are stored in the electronic memory, wherein the cryptographic derivation of the OTP is performed by a keyed hash function, wherein the second data are used as a secret key for encrypting a hash value calculated from an input value of the keyed hash function, wherein the first data, a value derived from the first data, or a value determined by the first data are/is used as input value, - displaying the OTP on a display device of the security token, - determining updated first data with the aid of a function by the security token, - by means of the security token, replacing the first data by the updated first data in the electronic memory, wherein the second data remain unchanged, - producing a network connection between a user computer system and the authentication module, - inputting the OTP into the user computer system, - transmitting an identifier and the OTP from the user computer system, via the network connection, to the authentication module, - accessing the database by the authentication module with the identifier as access key in order to read the version of the first and second data stored in the database, - cryptographically deriving (168, 186) a further OTP by means of the authentication module with the version of the first and second data read from the database, - checking, by the authentication module, whether the OTP and the further OTP match, and, if so, generating an authentication signal, determining updated first data with the aid of the function by means of the authentication module, and storing the updated first data in the database as the current version of the first data, on the condition that the OTP and the further OTP match.