Security Keys Explained: Do You Need a YubiKey?

Last updated: October 10, 2026

Hardware security key used to sign in on a laptop and a phone

A security key is a small physical device, often shaped like a USB stick or a fob, that you use to prove it is really you signing in. You plug it in, tap it or hold it near your phone, and the website lets you in. Brands such as Yubico (YubiKey), Google (Titan Security Key) and others make them.

They have a reputation as the strongest form of two-factor authentication for ordinary users, and US government guidance backs that up. That does not mean everybody needs one. This guide explains what a key does, why it resists phishing, how to choose the right type and connector, how to set one up on Google, Apple, Microsoft and X accounts, and how to decide whether it is worth buying.

What Is a Security Key?

A hardware security key is "something you have." In the classic setup it is a second factor: you still enter your password, and then the key confirms that you are present. Google's help page on security keys says they can be used with 2-Step Verification to help keep hackers out of your account, and that any FIDO1 or FIDO2 key can be used as a second step. Newer keys can also hold passkeys, which can replace the password entirely (see below).

FIDO stands for Fast IDentity Online, a set of open standards managed by the FIDO Alliance. Because modern keys follow these standards, one key can work with many services: Google accounts, Apple Accounts, Microsoft accounts, X, many password managers and others. Check that the services you care about support keys before you buy.

Many keys add their own lock. Microsoft explains that a FIDO2 security key used to sign in to a Microsoft account must be unlocked with a fingerprint or PIN, so even someone holding your key can't sign in without it.

Why Keys Are Strong Against Phishing

Text-message and app codes can be stolen by fake login pages. A scammer sends you to a look-alike site, you type your password and the six-digit code, and the scammer immediately uses them on the real site. The Cybersecurity and Infrastructure Security Agency (CISA) describes exactly this technique in its fact sheet on phishing-resistant MFA. A security key works differently. It cryptographically ties the sign-in to the real website address, so a look-alike site cannot get a valid response.

CISA calls phishing-resistant MFA "the gold standard" and states that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication." Security keys are one form of it; passkeys stored in your phone or computer are another. CISA's fact sheet ranks the common methods like this:

Method	Phishing (fake login pages)	Push bombing (spam approval prompts)	SIM swap and phone-network attacks
FIDO/WebAuthn: security key or passkey	Resistant	Not applicable	Not applicable
Authenticator app codes, or push with number matching	Vulnerable	Resistant	Not applicable
Push approval without number matching	Not rated separately by CISA	Vulnerable	Not applicable
SMS or voice codes	Vulnerable	Not applicable	Vulnerable; CISA calls this a "last resort" option

CISA also stresses that any form of MFA is better than no MFA. Because nothing is sent to your phone number, keys avoid the SIM-swap problem entirely. Our article on SIM swaps explains that risk.

Security Keys and Passkeys

Passkeys are a newer sign-in method that replaces passwords with a cryptographic credential protected by your device unlock, such as a fingerprint, face scan or screen lock. Apple's support page on passkey security describes them as a replacement for passwords that is resistant to phishing.

Security keys and passkeys are related. Google says you can create a passkey on a hardware security key if the key supports the FIDO2 protocol, and then sign in with just the key, skipping your password when possible. Google notes that a passkey on a key bypasses the separate second step, since possession of the key already verifies you. If you added a FIDO2 key to your Google Account before May 2023, Google says you may need to remove it and add it again before you can create a passkey on it. Our article on passkeys covers the wider picture, including passkeys that sync between your devices.

Types of Keys: FIDO-Only vs Multi-Protocol

Keys differ in what they can do, which is one reason prices vary. Using Yubico's current lineup as an example:

FIDO-only keys. Yubico's Security Key Series supports FIDO2/WebAuthn and FIDO U2F, which covers sign-in for Google, Microsoft, X, Facebook, password managers and many other services. For most home users, this is all the key needs to do.
Multi-protocol keys. The YubiKey 5 Series adds older and business-oriented protocols such as one-time passwords (OTP), smart card (PIV) and OpenPGP. These matter mainly for workplaces, developers and some legacy systems.
Passkey storage is limited. A key can store only a set number of passkeys. Yubico lists 100 passkey slots for YubiKey 5 Series keys on firmware 5.8. Older keys and other brands may hold fewer, so check the specifications if you plan to use many passkeys.
No battery. Yubico says its keys need no batteries or network connection. Most keys draw power from the USB port or NFC reader.

Choosing the Right Connector

A key is useless if it doesn't fit your devices. Apple's guide to Security Keys for Apple Account gives a clear breakdown, and Google's page confirms NFC and USB keys work with Android:

Connector	Works with	Notes
NFC (tap)	iPhone; Android phones with NFC turned on	Apple says NFC keys work only with iPhone among its devices. On Android, Google says to remove cases or stickers that may block the signal.
USB-C	iPhone 15 or later and most Mac models (Apple); Android devices over USB, sometimes with an adapter (Google)	Apple says keys with both NFC and USB-C work with most Apple devices.
Lightning	iPhone 14 and most earlier iPhone models	Useful only if you keep an older iPhone.
USB-A	Older Mac models and other computers with USB-A ports	Apple notes they can work on newer Macs with a USB-C-to-USB-A adapter.

A practical rule: pick a connector that fits the devices you use every day, and choose keys that are FIDO Certified, which Apple requires.

Who Should Consider a Key?

People whose accounts are especially valuable or targeted, such as journalists, activists and campaigners. Google points people at risk of targeted online attacks to its Advanced Protection Program. Apple describes its own security key feature as designed for people who want extra protection from targeted attacks.
Anyone whose email is the master key to everything. Your main email account can reset most other accounts.
People who manage money, business accounts or social media pages, where a takeover would be costly.
People who have been phished or SIM-swapped before and want stronger protection.
People who keep a lot inside a password manager. Check whether your password manager supports keys.

For many people, an authenticator app already gives a large jump in security over SMS. If you use Google Authenticator today, see how to set it up and back it up. A key is an upgrade, not a requirement. If the cost, or the effort of carrying a key, would stop you from turning on two-factor authentication at all, use an app instead. Some security is always better than none.

Downsides and Limits

Cost. Keys cost money, and you should buy at least two. Prices vary by model and connector, so check with the maker or a reputable seller.
Support varies. Not every website or app accepts keys, and some accept them only as a second factor or not on every device.
Connections. Keys come with different connectors, such as USB-A, USB-C, Lightning or NFC. See the table above.
Losing every key. If you lose your only key and have no other way in, recovery can be slow. Google warns that without another second step, verification can take up to 3 to 5 business days. Apple goes further: with Security Keys turned on, if you lose all of your trusted devices and security keys, you could be locked out of your Apple Account permanently.
Not a cure for everything. A key will not protect you if you install malware, hand over your account to a scammer by phone, or fall for a scam that tricks you into approving something.
Convenience. You need the key with you when signing in on a new device.

How to Set Up a Security Key on Major Accounts

Start with your main email account, then your password manager, financial accounts and social media. Always register at least two keys and keep the spare somewhere safe, away from the first.

Google Account

Get your keys. Google says you can buy Titan Security Keys from the Google Store or order a compatible key from a retailer you trust. To use passkey sign-in, the key must support FIDO2.
Add the key. Open your 2-Step Verification settings in a compatible browser such as Chrome and enroll the key, following the prompts. Google notes that newly registered keys no longer work on Android 8.0 and lower.
Expect a waiting period. Google says you may need to wait 7 days before a newly added key is available at sign-in, which protects you if someone else adds a key without permission. If you already have a trusted passkey or key, this may be faster.
Watch for warnings. If Google detects a suspicious security key, it disables it and notifies you. You then have 30 days to confirm you added it, or it is deleted.
Name and review your keys. Your 2-Step Verification settings list each key with its name, the date it was added and the date it was last used.

Apple Account

Apple's requirements are stricter than most, according to its Security Keys page:

You need at least two FIDO Certified keys, and you can add up to six.
Every device signed in to your Apple Account needs iOS 16.3, iPadOS 16.3, macOS Ventura 13.2 or later, and two-factor authentication must already be on.
Child accounts and Managed Apple Accounts aren't supported.
During setup, you're signed out of devices you haven't used or unlocked in more than 90 days.
On iPhone or iPad: Settings, tap your name, then Sign-in & Security, then Two-Factor Authentication, then Security Keys, then Add Security Keys.
On Mac: System Settings, click your name, then Sign-in & Security, then Two-Factor Authentication, then Set Up next to Security Keys.

Once enabled, you need a key or another trusted Apple device to sign in on a new device or the web, reset your password, or add and remove keys. Apple suggests keeping keys in more than one place, for example one at home and one at work.

Microsoft Account

Microsoft's support page gives these steps for a personal Microsoft account: go to the Microsoft account page and sign in, select Security, then More security options, then Add a new way to sign in or verify, then Use a security key. Choose USB or NFC, insert or tap the key, create or enter a PIN, touch the key when asked, and give it a name.

X (Twitter)

In X, go to Settings and privacy, then Security and account access, then Security, then Two-factor authentication, and choose Security key. X's help page says a security key can be your only two-factor method, with no other method turned on, and that you can add more keys later under Manage security keys.

If You Lose a Key

Sign in using your spare key, a passkey or another second step.
Remove the lost key from the account's security settings. On Google, click the trash icon next to the key in your 2-Step Verification settings.
Add a new key, and consider buying a replacement spare.

If a key is locked after too many wrong PIN entries, Google explains you can reset it in Chrome under Settings, then Privacy and security, then Security, then Manage security keys (or go to chrome://settings/securityKeys). Before you reset a key, make sure you have other ways into your accounts.

A lost key is also a reason to keep strong recovery options. Save backup codes securely, check your recovery email and phone, and keep a strong, unique password on accounts that still use one.

Frequently Asked Questions

Can I use one security key for multiple accounts?

Yes. A single key can be registered with many services, but you should still register a second key as a backup for each one.

Do security keys need batteries?

Usually not. Yubico says its keys need no batteries or network connection, because they draw power from the USB port or NFC reader. Check the specifications of the model you are considering.

Is a security key safe if someone steals it?

A thief would still need your password in most second-factor setups, and keys that require a PIN or fingerprint, as Microsoft's sign-in does, add another check. If a key goes missing, remove it from your accounts right away.

What is the difference between FIDO U2F and FIDO2?

Both are FIDO standards. Google accepts either type as a second step for 2-Step Verification, but only a FIDO2 key can hold a passkey for passwordless sign-in. If you are buying a new key, choose one that supports FIDO2.

Are cheap security keys from online marketplaces safe?

Buy from the manufacturer or an authorized seller, as Google advises using a retailer you trust. A tampered or fake device would defeat the purpose. Apple requires FIDO Certified keys.

Do I still need a strong password?

Yes, unless you sign in only with passkeys, and even then some accounts keep passwords for recovery. Keep strong, unique passwords, ideally in a password manager.

Related Guides

Conclusion

A hardware security key is the kind of phishing-resistant sign-in that CISA calls the gold standard, and it is worth serious consideration for your email, password manager and any account that would hurt to lose. It is not necessary for everyone: an authenticator app is a big step up from text codes and easier to start with. If you do buy keys, get two FIDO Certified keys with connectors that fit your devices, register both, keep backup options and store the spare safely.

Search This Blog

Safe Sign In