The token has the same code as the app for the password. If one sucks, so does the other ...