A hardware security key is a small physical device that proves you are present during sign-in. It is one of the strongest ways to protect high-value accounts because it resists phishing better than typed codes.
Does this affect you?
Use this for Google, Apple ID, Microsoft, password managers, and other major accounts on Windows, Mac, iPhone, or Android that support security keys, FIDO2, WebAuthn, or passkeys.
What a security key protects against
It is strongest against phishing and stolen-password attacks.
- In most setups, the key is a second factor after the password.
- Unlike SMS codes, a hardware key cannot be tricked into giving a reusable code to a fake site.
- The key checks the real website address before responding, which blocks many lookalike phishing pages.
- It does not need cell service or a charged phone. USB and NFC keys can work offline.
- The main downside is losing the physical key, which is why backup methods matter.
- Security keys are most useful for primary email, financial accounts, password managers, administrator accounts, and accounts you would hate to lose.
Set one up using Google as the example
Microsoft, Apple, and other providers use similar menus with different names.
- Buy a reputable FIDO2 or WebAuthn-compatible key with the connection you need, such as USB-A, USB-C, or NFC.
- Go to myaccount.google.com/security.
- Open 2-Step Verification.
- Choose Security keys and select Add security key.
- Insert or tap the key when prompted, then touch the key’s contact when it flashes.
- Name the key something recognizable.
- Add a second key or save backup codes immediately.
- Store the backup key somewhere separate from the primary key.
More control
Choose reputable hardware
Look for FIDO2 or WebAuthn support from an established manufacturer. Since the key protects critical accounts, trust in the maker matters.
Remove lost keys
If a key is lost but you still have another method, sign in and remove the lost key from account security settings so it cannot be used.
Security keys and passkeys are related
Both use FIDO2/WebAuthn ideas. A hardware key can act like a portable physical holder for passkey-style authentication.
Support is broad, but not universal
Check each account’s security settings for Security key, FIDO2, or Passkey options before buying several keys.
Sources
- FIDO Alliance – Security keys (2025)
- Google – Security keys for 2-Step Verification (2025)
- CISA – Implementing phishing-resistant MFA (2025)