What happens if I lose my key?

This is why you register two. If one is lost, you log in with the backup and remove the missing key from your accounts. Never rely on a single key as your only second factor.

Do security keys work with my accounts?

Most major services now support hardware keys: email, password managers, social, and banking increasingly do. The keys use the open FIDO2 and WebAuthn standards, so they are not tied to any one company.

Hardware Security Keys for Phishing-Proof 2FA in 2026

Private alternatives to SMS codes, Authenticator apps, vetted against our public criteria.

YubiKey 5 Series

Full-featured hardware security key from Yubico supporting FIDO2/WebAuthn, TOTP/HOTP, smart card (PIV), and OpenPGP across multiple form factors including USB-A, USB-C, and NFC variants.

Win Mac Linux Android iOS Closed-Source Sweden

Visit site →

Yubico Security Key

Yubico's entry-level hardware security key offering FIDO2/WebAuthn support at a lower price point, available in USB-A and USB-C variants, with NFC on select models.

Win Mac Linux Android iOS Closed-Source Sweden

Visit site →

Nitrokey

Open-source hardware security key line from Berlin-based Nitrokey, with models ranging from the FIDO2-only Nitrokey Passkey to the Nitrokey 3, which adds PIV smart card, OpenPGP, and TOTP support.

Win Mac Linux Android Open Source Germany

Visit site →

A hardware security key is a small device that plugs into USB or taps over NFC to prove it is really you logging in. It is the strongest second factor available, because the secret never leaves the key and it cannot be phished the way a code can.

What to look for in a security key

Look for FIDO2 and WebAuthn support, the modern phishing-resistant standard, plus the connectors your devices actually use: USB-C, USB-A, NFC, or Lightning. Buy two so you have a backup, and consider whether you also want TOTP, smart-card, or OpenPGP features beyond basic login.

Why a key beats an app or SMS

Codes from an app or text message can be phished: a fake login page simply asks you to type them in. A security key checks the real web address before it responds, so it will not authenticate to an impostor site. That single property stops the most common account takeovers.

How to set one up

Register the key on your important accounts, email first, then add a second key as backup and store it somewhere safe. Keep one on your keyring and the other at home, and your logins become both easier and far harder to steal.

Frequently asked

What happens if I lose my key?: This is why you register two. If one is lost, you log in with the backup and remove the missing key from your accounts. Never rely on a single key as your only second factor.
Do security keys work with my accounts?: Most major services now support hardware keys: email, password managers, social, and banking increasingly do. The keys use the open FIDO2 and WebAuthn standards, so they are not tied to any one company.