A handle is a 44-byte identifier for a token or an object. The format of the handle is as follows:

The token name in the first 32 bytes of the handle is provided by the PKCS #11 application when the token or object is created. The first character of the name must be alphabetic or a national character ("#", "$", or "@"). Each of the remaining characters can be alphanumeric, a national character ("#", "$", or" @"), or a period(".")

The sequence number is a hexadecimal number stored as the EBCDIC representation of 8 hexadecimal numbers. The sequence number field in a token is EBCDIC blanks. The token record contains a last-used sequence number field, which is incremented each time an object associated with the token is created. This sequence number value is placed in the handle of the newly-created object.

The ID field is 4 characters. The first character contains an EBCDIC "T" if the handle belongs to a token object, "S" if the handle belongs to a session object, or blank if the handle belongs to a token. The last three characters must be EBCDIC blanks.