Hardware security key
Also known as: security key, FIDO security key, FIDO2 key, U2F key, physical security key
A hardware security key is a small physical device, usually plugged into a USB port or tapped against a phone using NFC, that proves your identity when you sign in.
It uses FIDO standards, so it only works with the genuine website, which makes it nearly immune to phishing. While security keys are the gold standard for protecting high-value accounts, you need a backup key in case you lose one, and not every service supports them.
Hardware security key, explained at three levels
At home
A security key is like a personal seal you carry on your keyring. When you sign in, the website sends a small puzzle, and the key stamps its answer using a secret locked inside its chip, but only after you touch it. The stamp also records which website asked, so a fake look-alike site gets an answer the real site will reject. That is why these keys stop phishing so well.
At work
A hardware security key is a small USB or NFC device that employees plug in or tap to prove who they are when signing in. The secret it uses never leaves the device and only works with the genuine website, so a stolen password or a convincing fake login page isn't enough to break in. Businesses usually issue them first to staff who can move money or change IT systems.
At home
A security key holds private keys inside a tamper-resistant chip that never hands them over, even to the computer it is plugged into. When a site asks you to sign in, the browser passes along a challenge and the exact web address you are on. The key signs that combination only after you touch it. Because the address is part of what gets signed, a phishing site at a look-alike address gets a signature that the real site will refuse.
At work
Most keys speak FIDO2 for passkeys and the older FIDO U2F standard for second-factor sign-ins, and many also act as smart cards for certificate logins or store one-time password seeds. FIDO2 keys can hold resident credentials, which means the key itself remembers the account so you can sign in without typing a username. Each key has limited storage for these, so heavy users can fill it. Keys connect by USB, NFC or Bluetooth, and the identity provider registers each one to a specific user.
At home
While a security key is very hard to fool, it has one weakness: it is a single physical object. Each website stores the public half of a key pair made for that specific key, so a second key is not a copy and must be registered separately on every account. In my view, that is the real reason to buy keys in pairs. Register both on every account the day you get them, then keep one at home as the spare.
At work
At registration a key can return an attestation certificate identifying its model, which lets an identity provider such as Entra ID or Okta allow only approved keys, including FIPS 140 validated models for regulated work. The signature counter and user-verification flag let the server detect cloned devices and require a PIN rather than just a touch. Because the browser binds each signature to the site's origin, keys defeat adversary-in-the-middle phishing kits that relay codes and push approvals in real time.
Real-world examples
At home
Jerome, a journalist in Ottawa, uses two security keys for his email and social media. When attackers sent him a convincing fake login page, his key refused to work with it.
At work
Nadia leads IT at a Calgary energy company. She issued security keys to every administrator with access to cloud systems, closing off the phishing route attackers had been trying.
How it compares
| feature | Hardware security key | Authenticator app codes |
|---|---|---|
| Phishing resistance | Very strong | Weak, codes can be phished |
| Cost | Purchase per key | Free |
| Loss risk | Need a backup key | Tied to phone |
| Ease of use | Tap or plug in | Type a six-digit code |
Security keys stop phishing outright. App codes are cheaper but can be tricked out of you.
For analysts
I'd make security keys mandatory for anyone who can move money or change IT systems. The cost is small compared with a single compromised admin account.
History & origin
Physical tokens that generated one-time codes, such as RSA SecurID, were used by businesses from the 1980s; RSA suffered a major breach of its SecurID systems in 2011. Yubico, founded in Sweden, released the first YubiKey in 2008. Google and Yubico helped create the FIDO U2F standard, published by the FIDO Alliance in 2014, which lets one key work with many websites. In 2018, Google said that none of its more than 85,000 employees had been successfully phished for work accounts since it required security keys in early 2017. FIDO2 and WebAuthn, finalized in 2019, extended keys to passwordless login, and many keys now store passkeys. In my view, a pair of security keys is the best-value security purchase for anyone who could be a target, from executives to journalists.