USB DSC token or .pfx file?
These two look interchangeable and are not. One can never be used by a website; the other can be copied in seconds. Knowing which you hold determines your options.
Every digital signature rests on a private key. The only real question is where that key lives, and the two answers have very different consequences.
The USB crypto token
A small USB device — ePass2003, ProxKey, HYP2003, Watchdata, TrustKey and similar. It looks like a flash drive but works nothing like one.
The private key is generated inside the token's secure chip and is built so it can never be read out. When you sign, the document hash is sent into the token, the chip performs the signing operation internally, and only the finished signature comes back. The key never touches your computer's memory or disk.
This is why tokens are mandated for company filings, tax returns and tender portals: the key cannot be copied, emailed, stolen from a hard drive, or used by someone who does not physically hold the device and know its PIN.
What to use instead
Install the token vendor's driver and middleware, then sign with desktop software: Adobe Acrobat (the paid version), the utility your CA supplied, or the signing applet built into whichever government portal you are filing on. The token must be plugged in and you enter its PIN each time.
The .pfx or .p12 file
A single file holding your certificate and your private key together, encrypted under a password. The format is PKCS#12; .pfx and .p12 are the same thing under different extensions.
Because it is an ordinary file, any software that understands the format can use it — desktop tools, scripts, servers, and browser-based tools that read it locally.
Telling them apart
| USB token | .pfx file | |
|---|---|---|
| Where the key lives | Inside the chip, unreadable | In the file, on your disk |
| Can be copied | No | Yes, trivially |
| Works in a browser | Never | Yes |
| Needs drivers | Yes | No |
| Accepted for MCA, GST, tenders | Yes | Often not |
| If lost | Revoke and reissue | Revoke and reissue, and assume misuse |
Can a token be converted to a file?
No. That is the entire point of the hardware. If a token's key could be exported, it would offer nothing over a file. Any tool or service claiming to extract a key from a crypto token is either misunderstanding what it does or lying to you.
What you can do is ask your Certifying Authority whether they issue a software certificate for your use case. Some do for certain certificate types; many decline, because CCA guidelines push toward hardware storage for exactly the reasons above.
Which should you ask for?
If you are filing with MCA21, the Income Tax portal, GST, EPFO or a government e-tender system, you almost certainly need a token — most of these portals require hardware-held keys and will reject anything else.
If you are signing internal documents, approvals, reports or correspondence where the counterparty just needs to confirm the file is intact and came from you, a software certificate is far more convenient and works with more tools.
Plenty of people end up holding both, for different purposes.
Common questions
- Can I use my USB DSC token on a website?
- No. Browsers cannot reach token hardware at all. You need desktop software with the vendor's driver installed, or the signing applet provided by whichever portal you are using.
- Can I copy my .pfx to another computer?
- Technically yes, which is exactly the risk. Each copy is a full working ability to sign as you. Keep copies to a minimum and protect them as carefully as the original.
- I lost my token. What now?
- Contact your Certifying Authority and have the certificate revoked, then apply for a replacement. Signatures made before the revocation date generally remain valid; the revocation stops future misuse.
- What if I forgot my .pfx password?
- There is no recovery. The file is encrypted under that password and the CA does not hold it. You will need a new certificate issued.
- Is one more legally valid than the other?
- The signature carries the same legal weight either way, provided the certificate is from a CCA-licensed authority. The difference is practical: individual portals impose their own hardware requirements.