How do I choose a hardware security key?

A good hardware security key should do one job extremely well: make it hard for someone else to log in as you. Microsoft describes a security key as a physical device used with a unique PIN, and Yubico says its Security Key Series uses hardware-based authentication with public key cryptography to help eliminate account takeovers.

When you choose one, check device compatibility first. If you use a laptop and a phone, a key with USB-C plus NFC is usually the most flexible. If you travel with older devices, make sure it also supports USB-A or keep a small adapter handy. It is also smart to buy two keys: one for daily use and one stored somewhere safe as a backup.

Look for FIDO2/WebAuthn support, because that is what makes the key useful on modern services like Google, Microsoft, GitHub, and many password managers. Also check whether the accounts you care about allow security keys as a sign-in method, not just as a recovery method. The key is strongest when it protects your primary email and password manager first.

Do not buy only one. If your only key is lost, broken, or locked in a bag while you are traveling, recovery can become painful. Register both keys at the same time, label the backup, and store it somewhere boring and safe.

If your main accounts are email, cloud storage, or banking, this is one of the rare security purchases that pays for itself in peace of mind. A YubiKey security key is the most common starting point because it supports the major standards and works across a lot of popular services.

If you are still sorting out the concept, start with the phishing-resistant MFA explainer. If you need the broader account-security ladder, the two-factor authentication guide explains where security keys fit.