Method for generating a soft token, comprising the following steps: - a secure element is provided, wherein the secure element is a device of a user, wherein a secret key of a first asymmetric cryptographic key pair is stored in a protected memory area of the secure element, - a first cryptographically secured connection is established between an electronic device (174; 100) of the user and a service computer system , - a request to generate the soft token is transmitted from the electronic device to the service computer system via the first connection, - a one-time password is generated by the service computer system as a result of receiving the request, - the one-time password is registered by the service computer system as an identifier of the first connection, - the one-time password is transmitted from the service computer system to the electronic device via the first connection, - the one-time password is output via a user interface of the electronic device, - a second cryptographically secured connection is established between a user computer system (100; 174) of the user and the service computer system, - the one-time password is input into the user computer system, - the input one-time password is transmitted from the user computer system to the service computer system via the second connection, - the service computer system checks whether the registered one-time password matches the one-time password received via the second connection, and, only if this is the case, at least one attribute stored in an ID token of the user is read, the soft token linked to the secure element is generated as a result of the service computer system signing the at least one attribute and the public key of the first cryptographic key pair, the soft token is transmitted by the service computer system to the electronic device via the first connection and/or the soft token is transmitted to the user computer system via the second connection. - a secure element is provided, wherein the secure element is a device of a user, wherein a secret key of a first asymmetric cryptographic key pair is stored in a protected memory area of the secure element, - a first cryptographically secured connection is established between an electronic device (174; 100) of the user and a service computer system , - a request to generate the soft token is transmitted from the electronic device to the service computer system via the first connection, - a one-time password is generated by the service computer system as a result of receiving the request, - the one-time password is registered by the service computer system as an identifier of the first connection, - the one-time password is transmitted from the service computer system to the electronic device via the first connection, - the one-time password is output via a user interface of the electronic device, - a second cryptographically secured connection is established between a user computer system (100; 174) of the user and the service computer system, - the one-time password is input into the user computer system, - the input one-time password is transmitted from the user computer system to the service computer system via the second connection, - the service computer system checks whether the registered one-time password matches the one-time password received via the second connection, and, only if this is the case, at least one attribute stored in an ID token of the user is read, the soft token linked to the secure element is generated as a result of the service computer system signing the at least one attribute and the public key of the first cryptographic key pair, the soft token is transmitted by the service computer system to the electronic device via the first connection and/or the soft token is transmitted to the user computer system via the second connection. <EOS>