The present invention relates to a user authentication server which mixedly uses both a password and biometric information. The user authentication server comprises: a variable keypad generation unit for generating a variable keypad including encryption keys and a biometric authentication key, wherein the position of each encryption key and the position of the biometric authentication key are changed in each generation of the keypad; an authentication information storage unit for storing authentication information of portable terminal users; and an authentication unit for authenticating a user by remotely providing information of the generated variable keypad to a portable terminal, and comparing biometric information and information of the positions of the encryption keys in accordance with the order of input by the user, received from the portable terminal, with the authentication information stored in the authentication information storage unit.