Obtaining and/or validating user credentials at client devices is described. A phrase may be generated based on one or more index values determined according to a function of time and a credential identifier identifying a user credential. The phrase may be output by the client device for validating the user credential.