# What is a session token, and why is stealing one worse than stealing a password?

**Short answer:** A session token is the credential your browser or app holds *after* you log in, proving you're already authenticated. Stealing one is often worse than stealing a password because it typically bypasses both the password and multi-factor authentication — the attacker simply resumes your existing session.

## Why it exists

Re-entering a password on every request would be unusable, so after a successful login the service issues a token. Every later request carries that token instead of your credentials. The service trusts it as proof you already authenticated.

## Why attackers prefer it

- **It skips MFA.** MFA is checked at login. A token issued *after* that check represents an already-passed authentication, so replaying it usually doesn't re-trigger the second factor.
- **It looks legitimate.** To the service, a valid token is a valid user. There's no failed-login signal and nothing anomalous to alert on.
- **It's portable.** Many tokens work from a different machine, network, or country.

## Why this changed attacker behavior

Attackers increasingly avoid lingering in a network. Staying resident raises the odds of detection. Instead they take identity material and leave — then return at will as an authenticated user. The token is a legitimate-looking back door that the authentication system itself issued.

## How Cyber Crucible addresses it

Token theft is stopped at the moment of access. When a program reaches for the browser or application storage where tokens live, its access is assessed in under 200 milliseconds. An overreaching but legitimate program is given fake data or denied; an unknown or compromised one is rejected or suspended. Either way the real token is never handed over.