A secure on-line system for printing a value bearing item comprising: a client system (220a-220n) for interfacing with a plurality of users; and a server system (222a-222m) capable of communicating with the client system (220a-220n) over a communication network comprising: a secure database remote from the users including information about the users; and computer executable code for password authentication to prevent unauthorized access to the database; a plurality of cryptographic modules (52, 110) for authenticating any of the users, each of the cryptographic modules being capable of user authentication, postage purchase and the generation of the value bearing item, wherein the cryptographic modules (52, 110) are external to the database and configured to load a user's data base record from the database, wherein an available cryptographic module (52, 110) loads the user's data base record and becomes the user's postal security device for (52, 110) loads the user's data base record and becomes the user's postal security device for generating the value bearing item, and wherein the user's data base record is signed by a private key known only to the cryptographic modules (52, 110); and a postal server subsystem (41, 109) to which the cryptographic modules (52, 110) are connected, the postal server subsystem (41, 109) acting as gatekeeper to prohibit unauthorized users from entering the postal server subsystem (41,109) and the database in such a way that information in the database can be retrieved or altered only by accessing the database through the postal server subsystem (41,109). a client system (220a-220n) for interfacing with a plurality of users; and a server system (222a-222m) capable of communicating with the client system (220a-220n) over a communication network comprising: a secure database remote from the users including information about the users; and computer executable code for password authentication to prevent unauthorized access to the database; a plurality of cryptographic modules (52, 110) for authenticating any of the users, each of the cryptographic modules being capable of user authentication, postage purchase and the generation of the value bearing item, wherein the cryptographic modules (52, 110) are external to the database and configured to load a user's data base record from the database, wherein an available cryptographic module (52, 110) loads the user's data base record and becomes the user's postal security device for (52, 110) loads the user's data base record and becomes the user's postal security device for generating the value bearing item, and wherein the user's data base record is signed by a private key known only to the cryptographic modules (52, 110); and a postal server subsystem (41, 109) to which the cryptographic modules (52, 110) are connected, the postal server subsystem (41, 109) acting as gatekeeper to prohibit unauthorized users from entering the postal server subsystem (41,109) and the database in such a way that information in the database can be retrieved or altered only by accessing the database through the postal server subsystem (41,109). a secure database remote from the users including information about the users; and computer executable code for password authentication to prevent unauthorized access to the database; a plurality of cryptographic modules (52, 110) for authenticating any of the users, each of the cryptographic modules being capable of user authentication, postage purchase and the generation of the value bearing item, wherein the cryptographic modules (52, 110) are external to the database and configured to load a user's data base record from the database, wherein an available cryptographic module (52, 110) loads the user's data base record and becomes the user's postal security device for (52, 110) loads the user's data base record and becomes the user's postal security device for generating the value bearing item, and wherein the user's data base record is signed by a private key known only to the cryptographic modules (52, 110); and the cryptographic modules (52, 110) are external to the database and configured to load a user's data base record from the database, wherein an available cryptographic module (52, 110) loads the user's data base record and becomes the user's postal security device for (52, 110) loads the user's data base record and becomes the user's postal security device for generating the value bearing item, and wherein the user's data base record is signed by a private key known only to the cryptographic modules (52, 110); and a postal server subsystem (41, 109) to which the cryptographic modules (52, 110) are connected, the postal server subsystem (41, 109) acting as gatekeeper to prohibit unauthorized users from entering the postal server subsystem (41,109) and the database in such a way that information in the database can be retrieved or altered only by accessing the database through the postal server subsystem (41,109).