a method and system for generating and authorizing a dynamic password , which relate to the field of identity authentication . the method comprises : a token receiving a command for generating a dynamic password , and generating a first dynamic factor according to a first timer ; acquiring current data from a first data set according to a first offset pointer , and generating a first dynamic password according to the first dynamic factor and the current data ; a server receiving a second dynamic password input by a user , and obtaining a second dynamic factor according to a second timer ; obtaining an authentication window according to the second dynamic factor and an authentication window value ; and according to the dynamic factor in the authentication window and the data in a second data set , calculating to generate a group of dynamic passwords , and verifying whether there is a dynamic password consistent with the second dynamic password in the group of dynamic passwords or not . with the above - mentioned solution , the problem that a time - type token cannot be generated a plurality of times within a short time is solved , and that the situation where the event - type token causes desynchronization with the server because of continuous generation of dynamic passwords is avoided .