Comment by cybojanek

Yes you can - take the hash of the input and token, and compare those. Now you're trying to cause a sha256 collision. Good luck!