Hardware security keys: what a YubiKey does and how to set one up

Most two-factor methods send or show you a code. The weakness is that you can be tricked into typing that code into a fake sign-in page, and a criminal relays it to the real one in seconds. A security key works differently. When you sign in, the website sends a challenge, the key signs it with a private key that never leaves the device, and the browser includes the website's real address in what gets signed. A lookalike domain gets a signature that is useless on the real site. There is no code to type and nothing to hand over.

That is why the US Cybersecurity and Infrastructure Security Agency, in its fact sheet on implementing phishing-resistant MFA, calls phishing-resistant MFA the gold standard and says the only widely available form of it is FIDO/WebAuthn authentication: security keys and passkeys.

Where this sits among the other options is laid out in our two-factor authentication guide.

Passkeys use the same FIDO standard, but the private key lives on your phone, computer or password manager and syncs between your devices. They are free and you already own the hardware. A physical key keeps the secret on a separate device that cannot be copied or synced. That suits the accounts where losing control would be worst.

A sensible split for most people: passkeys wherever they are offered, plus a pair of keys on the two or three accounts that can reset everything else, usually your main email, your Apple or Google account and your password manager.

• Google: add a key under 2-Step Verification in your Google Account. For people at higher risk, Google's Advanced Protection Program requires a passkey or security key to sign in and adds stricter checks on downloads and third-party app access.
• Apple Account: Apple requires at least two and allows up to six FIDO-certified keys, and every device signed in to the account must run iOS 16.3, iPadOS 16.3, macOS Ventura 13.2 or later (Apple's security key guide). Keys are not available for child accounts or Managed Apple Accounts.
• Microsoft account: add a security key from the Advanced security options in your Microsoft account.
• Password managers: Bitwarden's paid plans support up to 10 hardware keys for two-step login, according to its pricing page; 1Password and Proton Pass also support them.
• Others: many social networks, cloud services and some banks accept keys. Look in each account's security or two-factor settings for "security key" or "passkey".

Three things decide it:

1. Connector: USB-C for most recent laptops and Android phones and for iPhone 15 and later; USB-A for older computers.
2. NFC: lets you tap the key on a phone instead of plugging it in. Worth having.
3. FIDO certification: Apple requires it, and it is the safe default. Yubico's keys and Google's Titan keys are FIDO certified; buy from the maker or a reputable seller rather than an unknown brand.

Yubico sells a basic "Security Key" line that does FIDO only, and the YubiKey 5 line, adding older standards some workplaces use. For personal accounts the basic FIDO key is enough.

1. Make sure your account already has two-factor authentication on and you have saved its backup codes.
2. Open the account's security settings and choose to add a security key.
3. Insert or tap the first key when asked, touch it, and give it a name such as "keyring".
4. Repeat straight away with the second key and name it "home safe".
5. Sign out and sign back in with each key to prove both work.
6. Put the spare somewhere safe at home, not in the same bag as the first.

Once your email and password manager are on keys, the rest of your accounts can be reset only through them, which closes the door most account takeovers walk through. The security checklist lists the other accounts to tighten next.