If you do one thing on this entire site, do this one. Every other measure here reduces risk at the margin; this one removes an entire category of attack, and it is the category that actually happens to people doing this work. It costs less than a pair of shoes and takes an afternoon.
01Why a code can be stolen and a key cannot
You have seen the attack even if it has not worked on you. An email or message says there is a problem with your account. The link goes to a page that is a pixel-perfect copy of the real login. You enter your password. It asks for your authenticator code. You enter that too.
Behind the scenes, the attacker's server is logging into the real site at the same moment, relaying everything you type, in real time. Your code was genuine. It was valid for thirty seconds. You just typed it into the wrong window, and thirty seconds is plenty.
An app generates a number from a shared secret and a clock. It has no idea what site you are looking at, so it cannot tell a real login page from a copy. The code is not the weakness, the human eye is. Any defence that depends on you spotting a fake domain will eventually fail, because the fakes are very good and you will be tired.
A security key works differently. When you register it with a site, it stores a secret tied to that site's real domain. At login the site sends a challenge; the key signs it, but only after checking that the domain asking matches the domain it registered with. A lookalike domain asks, and the key simply does not answer. There is nothing to relay, nothing to type, and nothing for you to get wrong.
Google moved its entire workforce — tens of thousands of people, to security keys and reported zero successful phishing takeovers of employee accounts afterwards. That is the strongest evidence in consumer security for any single measure, and it is why this guide is first rather than fifth.
02What is on the key
A YubiKey 5 is not one thing. It is several independent security devices in the same piece of plastic, and most people use one of them and never know the rest are there. Here is all of it, in plain terms.
| Feature | Use it? | What it is for |
|---|---|---|
| FIDO2 / WebAuthn | Yes, this is the one | The modern standard. Phishing-proof login, and the basis of passkeys. This is what you will use on Google, Microsoft, GitHub, Cloudflare, Proton and most things that matter. |
| Passkeys (resident keys) | Yes | The same thing, but the key stores the account identity too, so you can log in without typing a username or password at all. Storage is limited — see the note below. |
| U2F | Automatic | The older version of the same idea. Still used by some sites; the key handles it without you choosing. |
| OATH-TOTP | Situational | Stores your ordinary six-digit codes on the key instead of in a phone app, read through Yubico Authenticator. Useful for sites that do not support FIDO2. It is still a code and still phishable, it protects the secret, not the login. |
| Challenge-response (HMAC-SHA1) | Yes, with KeePassXC | Makes your password database require the physical key to open. Covered in the KeePassXC guide, this is the pairing that makes both tools substantially stronger. |
| PIV / smart card | Advanced | Holds certificates. Used for SSH keys that cannot be copied off the device, and for some corporate and government systems. |
| OpenPGP | Advanced | Holds GPG keys on hardware, so signing and decryption happen on the key and the private key never touches your computer. |
| Yubico OTP | Rarely | A legacy one-time-password scheme predating FIDO. Some older services use it. Leave it alone unless something asks. |
| Static password | No | Types a fixed string when you touch the key. A convenience feature from another era. Do not use it for anything that matters. |
Resident keys, the ones that let you log in with no username, take permanent slots on the device, and there is a fixed number of them. Older YubiKey 5 firmware holds around 25; recent firmware holds considerably more. Ordinary FIDO2 second-factor registrations are not limited this way, so you can add a key to hundreds of sites without filling anything up. If you run out, it will be because of passkeys, not 2FA.
03Which one to buy
The decision is mostly about the plug on the end and whether you want the extra features. Match the connector to your phone and your computer, and if they differ, buy one of each rather than carrying an adapter you will lose.
| Model | Best for | Notes |
|---|---|---|
| Security Key series (the blue ones) | Most people | FIDO2 and U2F only, which is the part you need. Roughly half the price of a YubiKey 5. If you are not going to use PGP, PIV or the KeePassXC pairing, this is the honest recommendation. |
| YubiKey 5 NFC | USB-A computer + any phone | The full-feature key. Tap it against a phone for NFC, plug it into a laptop for USB. The default choice if you want everything in the table above. |
| YubiKey 5C NFC | USB-C computer + any phone | Identical, with a USB-C plug. Most likely the right one if your laptop is recent. |
| YubiKey 5Ci | iPhone with Lightning | Has both USB-C and Lightning. Only relevant for older iPhones; newer ones are USB-C and can use NFC anyway. |
| YubiKey 5 Nano | Leave-in-laptop | Tiny, sits flush in the port permanently. Convenient, and it removes the physical-separation benefit, if the laptop is taken, the key is taken with it. |
| Bio series | Shared spaces | Fingerprint instead of a PIN. Genuinely nice; more expensive; consider carefully whether a biometric is the right unlock where you live, since in many jurisdictions you can be compelled to provide a fingerprint more easily than a PIN. |
A single key is a single point of failure: lose it and you can be locked out of your own accounts permanently, which is its own kind of disaster. Register both keys on every account, carry one, and keep the second somewhere physically separate, a drawer at home, a safe, someone you trust. The second key is the backup plan, and it costs less than the recovery would.
Not a marketplace listing, not secondhand, not a gift from someone you do not know well. A security key is a device you will trust with everything; the supply chain is part of the product. Yubico's firmware is deliberately not updatable, which is good for tamper-resistance and means a compromised key can never be fixed, only replaced.
04Setting it up, in the right order
The order matters. Start with the account that can reset all the others, and make sure you cannot lock yourself out along the way.
-
Start with your email
Every other account you own recovers through it, which makes it the real target. Go to your email provider's security settings and add both keys before you touch anything else. If your email provider does not support security keys, that is a reason to change provider, not a reason to skip this.
-
Register both keys at the same time
Do it in one sitting, on every account. The failure mode people hit is registering one key now and "adding the spare later" — later never comes, and then the first key goes through a washing machine.
-
Save the recovery codes properly
Every site gives you a set of one-time recovery codes. These are a complete bypass of your key, so they deserve the same care as the key itself. Put them in your password manager, or print them and keep them somewhere physically secure. Do not photograph them, and do not leave them in a downloads folder.
-
Now review the weaker methods
If SMS codes remain a fallback, a SIM swap can bypass the key. Once both keys work, turn off SMS wherever the service lets you. Keep an authenticator code only where you need it as a recovery path, protect its seed and recovery codes in your password manager, and never remove a method until you have tested the remaining ways back in.
-
Work down the list
After email: your password manager if it supports keys, then cloud storage, then social accounts you post from, then anything with a payment method attached, then code hosting. Anything left over can wait for an idle evening.
-
Test the spare before you put it away
Log out and log back in using the backup key specifically. An untested backup is a guess.
05What it does not protect you from
A security key is the strongest single control available to an ordinary person, and it is still narrow. It defeats phishing. It does not defeat these.
- Phishing pages, however convincing, including real-time relay attacks.
- Credential stuffing, your password from some other site's breach is now useless on its own.
- Password guessing and spraying.
- Most SIM-swap attacks, once SMS is removed as a fallback.
- Malware already on your computer. If something is watching your session after you log in, the key has already done its job and been bypassed.
- Session cookie theft. An attacker who steals a live session token does not need to log in at all.
- The recovery route. If support staff can be talked into resetting your account, your key is irrelevant. This is now the most common way keyed accounts fall.
- Physical seizure of you and the key together.
- Accounts you forgot to protect, which is where attackers will go next.
It closes the front door completely, and the attacker moves to the windows. That is still an enormous improvement, the front door is where nearly all the traffic was, but it is a reason to keep reading the rest of this site rather than to stop here.
06If you do not want a YubiKey
YubiKey is the default because it is the most widely supported and the most thoroughly reviewed, not because it is the only option. We take no money from any of these.
Nitrokey
German, with open-source firmware and hardware designs, the choice if "I want to be able to inspect it" matters more to you than maximum compatibility. Covered as an alternative in the guide's security-key section.
nitrokey.com ↗Token2
Swiss, inexpensive, FIDO2-focused. A reasonable way to buy two keys on a tight budget without dropping to an unknown brand.
token2.com ↗Your phone as a passkey
Modern phones can act as a FIDO2 authenticator, which gets you the same phishing resistance for free. Weaker in one specific way: the phone is the device most likely to be taken, unlocked, or compromised. Good as a second factor, not as your only one.
07Questions people actually ask
What happens if I lose the key?
Nothing, if you did this properly: you use the second key, and then you remove the lost one from every account and register a replacement. This is precisely why the guide insists on buying two. If you did not, you fall back to your recovery codes, and if you do not have those either, you are relying on the provider's account-recovery process, which can take weeks and sometimes fails.
Can someone who steals my key get into my accounts?
Not on its own. The key is a second factor, they still need your password, and for most configurations they need the key's PIN as well, which locks the device after a small number of wrong attempts. A stolen key is an inconvenience to you, not a breach. Remove it from your accounts anyway.
Do I have to carry it everywhere?
Only when logging in somewhere new. Most sites let you mark a device as trusted, so day to day you will touch the key rarely — typically when setting up a new machine or after clearing your cookies. The NFC models work by tapping against a phone, which removes most of the friction people imagine.
Is a passkey the same thing?
A passkey is the same cryptography with the same phishing resistance. The difference is where it lives. A passkey in your phone or in a browser account syncs through a company's cloud, which is convenient and means the strength of that account becomes the strength of your passkey. A passkey on a hardware key cannot be synced, copied or extracted. For accounts that matter, put it on hardware.
Which accounts should get one first?
Email, always. Then your password manager, then anything you publish from, then anything holding money. If you document or report on this subject, the account you post from is worth more to an adversary than your bank — losing it means someone else speaking in your name, which cannot be undone by a chargeback.
08Sources and further reading
- Yubico — official site and model comparison yubico.com
- FIDO Alliance, the FIDO2 / WebAuthn standard fidoalliance.org
- Nitrokey — open-source hardware and firmware alternative nitrokey.com
- EFF Surveillance Self-Defense — account security ssd.eff.org
- Privacy Guides — multi-factor authentication privacyguides.org
Last reviewed: 25 September 2026