A short-range wireless token for facilitating authentication, the token comprising: a secure component comprising memory configured to store one more keys; one or more processors programmed with computer program instructions that, when executed, cause the token to: obtain, from a client device, a first challenge as plaintext and a first encrypted message, the first encrypted message comprising the first challenge; cause the first challenge to be presented as plaintext on a display of the token; obtain, subsequent to the first challenge being presented on the display of the token, a user confirmation of validity of the first challenge; power or increase power to the secure component based on the user confirmation of the validity of the first challenge; determine to which challenge type of multiple challenge types the first challenge corresponds; cause the secure component to decrypt the first encrypted message to extract the first challenge as plaintext from the first encrypted message based on the user confirmation of the validity of the first challenge; cause the secure component to use a key associated with a first challenge type to generate a first challenge response for the first challenge based on (i) the first challenge corresponding to the first challenge type and (ii) the extracted first challenge matching the first challenge obtained as plaintext from the client device; and provide the first challenge response to the client device. a secure component comprising memory configured to store one more keys; one or more processors programmed with computer program instructions that, when executed, cause the token to: obtain, from a client device, a first challenge as plaintext and a first encrypted message, the first encrypted message comprising the first challenge; cause the first challenge to be presented as plaintext on a display of the token; obtain, subsequent to the first challenge being presented on the display of the token, a user confirmation of validity of the first challenge; power or increase power to the secure component based on the user confirmation of the validity of the first challenge; determine to which challenge type of multiple challenge types the first challenge corresponds; cause the secure component to decrypt the first encrypted message to extract the first challenge as plaintext from the first encrypted message based on the user confirmation of the validity of the first challenge; cause the secure component to use a key associated with a first challenge type to generate a first challenge response for the first challenge based on (i) the first challenge corresponding to the first challenge type and (ii) the extracted first challenge matching the first challenge obtained as plaintext from the client device; and provide the first challenge response to the client device. obtain, from a client device, a first challenge as plaintext and a first encrypted message, the first encrypted message comprising the first challenge; cause the first challenge to be presented as plaintext on a display of the token; obtain, subsequent to the first challenge being presented on the display of the token, a user confirmation of validity of the first challenge; power or increase power to the secure component based on the user confirmation of the validity of the first challenge; determine to which challenge type of multiple challenge types the first challenge corresponds; cause the secure component to decrypt the first encrypted message to extract the first challenge as plaintext from the first encrypted message based on the user confirmation of the validity of the first challenge; cause the secure component to use a key associated with a first challenge type to generate a first challenge response for the first challenge based on (i) the first challenge corresponding to the first challenge type and (ii) the extracted first challenge matching the first challenge obtained as plaintext from the client device; and provide the first challenge response to the client device.