What is a security key?
Definition
A security key is a small physical device, usually USB or NFC, that you plug in or tap to prove it's really you when you sign in. It's a hardware form of two-step verification.
- Category
- Security
- Also called
- hardware security key, FIDO security key, physical security key
- Last updated
A security key stores a cryptographic secret that never leaves the device. When you sign in to a supported site, you enter your password and then touch or tap the key. The site and the key check each other, and the key only answers a genuine request from the real site.
That last part is what matters. A texted code or an authenticator-app code can be typed into a fake login page by a person who has been tricked. A security key won't work on the fake page, because it's tied to the real site. CISA says only FIDO authentication is phishing resistant, and its guidance ranks hardware-based FIDO keys at the top of the list of multifactor options, with passkeys as an acceptable alternative and SMS codes as the weakest.
Security keys follow the FIDO2 and WebAuthn standards, so one key works across many services that support them. Because the key is separate from your phone and laptop, someone who steals your device doesn't automatically get the key.
Security key vs. related terms
- Two-factor authentication is the general idea of using two proofs. A security key is one strong way to do the second one.
- A passkey is a similar FIDO credential that usually lives on your phone or computer instead of a separate device.
- A security code is a number sent to you or generated by an app. A key doesn't need you to type anything.
The trade-off is practical: you can lose a key. Buy two and register both.
How to protect yourself
- 1
Start with your email and main accounts
Your email account can reset every other password, so protect it first. Then add a key to your password manager, bank and social accounts where it's offered.
- 2
Register a backup key
Register two keys and keep one somewhere safe, such as a drawer at home. Losing your only key can lock you out of the account.
- 3
Keep a fallback method on file, but make it a good one
Many sites still let you sign in with a text code if you lose your key. Use the strongest backup the site offers and remove SMS if you can.
- 4
Check the key is real FIDO
Buy from the maker or a known retailer and look for FIDO2 or WebAuthn support on the box and in the product listing.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a security key better than an authenticator app?
For phishing, yes. CISA notes that authenticator codes can still be phished, while FIDO authentication is phishing resistant. An app is still much better than no second step.
What happens if I lose my security key?
Use your backup key or the recovery method you set up, then remove the lost key from your account. That's why registering a second key matters.
Do I need a security key if I use passkeys?
Not necessarily. CISA treats passkeys as an acceptable alternative to hardware keys. A separate key is the stricter choice if you'd rather not keep the credential on your phone.
Can a security key be hacked remotely?
The secret stays on the device and the key checks which website is asking, which is why remote phishing doesn't work against it. Someone who physically holds your key may still need your password or PIN.
Sources
Something wrong or out of date? Tell us and we'll re-check it.