A security key is a small device, about the size of a car key fob, that protects your accounts better than any code. This guide is part of our two-factor login and passkeys guide.
What a security key does
When you log in, you enter your password and then touch the key. It uses public key cryptography, based on standards known as FIDO2 and WebAuthn, to prove to the site that you have it.
The crucial detail is that the key checks the address of the site. It is tied to the real domain, so it will not respond properly on a lookalike. This stops phishing, even if you are fooled.
Why it beats codes
| Attack | App code | Security key |
|---|---|---|
| Stolen password | Blocked | Blocked |
| Fake login page | Can be fooled | Blocked |
| SIM swap | Blocked | Blocked |
| Push flooding | Not applicable | Blocked |
Who needs one
- Anyone with high-value accounts, including crypto holders. See securing exchange logins.
- Journalists, activists and public figures.
- People whose jobs make them a target.
- Anyone who wants the strongest protection for email.
What to look for
- Connection: USB-A, USB-C, Lightning or NFC, to suit your devices.
- Standards: FIDO2 support, so that it can also hold passkeys.
- Maker: buy from the maker or an authorized seller, because a used key cannot be trusted.
How to set one up
- Buy two keys.
- Open your account's security settings and choose "security key".
- Follow the prompts, and tap the key when asked.
- Add the second key the same way.
- Keep one on your keyring and one in a safe place.
- Save your backup codes too.
Start with your email. Our email security checklist shows how this fits in.
The trade-offs
Keys cost money, can be lost, and are not supported by every site. They also do nothing against malware that controls your device after you log in. Some banks still do not accept them.