To set up a hardware security key, buy two FIDO2-certified keys, then register both of them in the security settings of each account that matters most, usually under Security, 2-Step Verification or Sign-in options. Start with your main email account, because it can reset almost everything else, then move on to your Apple, Google or Microsoft account, social media and any financial accounts that support keys. Keep one key on your keyring and the other somewhere safe at home.
A hardware security key is a small USB or NFC device that proves who you are using public-key cryptography, and it only responds to the real website it was registered with. That is why it blocks the fake-login-page phishing that can defeat text-message codes and authenticator apps.
Key takeaways
- Register at least two keys on every account, at the same sitting, so losing one never locks you out. Apple requires two before it will turn keys on.
- Security keys and other FIDO credentials are phishing-resistant; SMS codes, app codes and push approvals are not, according to NIST SP 800-63B-4.
- Set up recovery options (backup codes, a second key, a trusted device) before you need them. Apple warns that losing every key and trusted device can mean a permanent lockout.
- Start with email, then your phone platform account (Apple, Google or Microsoft), then social and money accounts.
- A key works alongside your password manager and passkeys; it does not replace them.
What is a hardware security key, and why does it stop phishing?
When you register a key with a website, the key creates a new pair of cryptographic keys just for that site and that account. The website stores only the public half. The private half never leaves the physical key, according to the FIDO Alliance, the industry group behind the standard. Each time you sign in, the site sends a random challenge, you touch the key (and sometimes enter a PIN), and the key signs the challenge.
The part that matters for phishing is that the credential is tied to the site's real web address. If a scam email sends you to a convincing copy of your bank or email login page, the key simply has no credential for that lookalike address, so there is nothing for a criminal to capture. A six-digit code, by contrast, works wherever you type it, including on a fake page that relays it to the real site in real time.
Security keys use the same FIDO technology as passkeys. The difference is where the private key lives: a passkey is usually synced across your devices by a password manager or by Apple, Google or Microsoft, while a security key is a "device-bound" credential that stays inside one piece of hardware. For more background on how these fit together, see our complete guide to passwords, 2FA and passkeys.
How does a security key compare with other two-factor methods?
NIST, the US standards agency, updated its digital identity guidelines in 2025 as SP 800-63B-4. They classify authenticators by assurance level. The highest level, AAL3, requires a phishing-resistant authenticator whose private key cannot be exported, which is exactly what a hardware key provides. At AAL2, services must at least offer a phishing-resistant option. CISA, the US cybersecurity agency, calls phishing-resistant MFA built on FIDO the gold standard, while stressing that any MFA beats none.
| Method | How NIST SP 800-63B-4 treats it | Phishing-resistant? | Main weak spot |
|---|---|---|---|
| Text message or voice code | Allowed only as a "restricted" authenticator, with alternatives required | No | SIM swaps, number porting and codes typed into fake pages |
| Authenticator app code | One-time password; explicitly not phishing-resistant | No | A fake page can ask for the code and relay it |
| Push approval | Out-of-band; explicitly not phishing-resistant | No | Repeated prompts until someone taps Approve; number matching helps but is not phishing-resistant, per CISA |
| Synced passkey | Cryptographic and can be phishing-resistant; syncable keys are not allowed at AAL3 | Yes | Only as safe as the cloud account that syncs it |
| Hardware security key | Cryptographic, non-exportable key; can meet AAL3 | Yes | It is a physical object you can lose, so you need a spare |
Classifications from NIST SP 800-63B-4 and CISA's phishing-resistant MFA fact sheet, as of October 2026. NIST does not give numeric scores, so this is shown as a comparison table rather than a chart.
What should you buy before you start?
Look for a key that is FIDO2-certified. Google notes that any FIDO1 (U2F) or FIDO2 key works as a second step for its 2-Step Verification, but only FIDO2 keys can hold passkeys, and Apple requires FIDO Certified keys. Buying FIDO2 keeps your options open.
- Connector: match your devices. USB-C covers most current laptops and recent phones; USB-A suits older PCs; NFC lets you tap the key on the back of many phones.
- Two keys, not one: a primary for daily use and a backup. Apple supports up to six on an Apple Account.
- A trusted seller: buy from the maker or a retailer you trust, as Google advises, rather than a random marketplace listing.
- A PIN: many FIDO2 keys let you set a PIN. Microsoft's setup flow asks you to create one, so a stranger who finds the key still cannot use it alone.
Which accounts support security keys, and where is the setting?
Start with the accounts that can reset other accounts. The table below shows where to find the option on major services as of October 2026, and what to rely on if a key goes missing.
| Account | Where to add the key | If you lose a key |
|---|---|---|
| Google (Gmail, Drive) | Google Account > Security > 2-Step Verification > Security keys (in a browser such as Chrome) | Use your other key, a passkey, a Google prompt or backup codes; otherwise Google account recovery, which can take 3 to 5 business days |
| Apple Account (iCloud) | iPhone/iPad: Settings > your name > Sign-In & Security > Two-Factor Authentication > Security Keys. Mac: System Settings > your name > Sign-In & Security > Two-Factor Authentication > Security Keys > Set Up | Your second key or a nearby iPhone or iPad that is already signed in. Losing all keys and trusted devices can mean permanent lockout |
| Microsoft account (Outlook, OneDrive) | account.microsoft.com > Security > More security options > Add a new way to sign in or verify > Use a security key | Other verification methods listed under Advanced security options; remove the lost key there |
| X | Settings and privacy > Security and account access > Security > Two-factor authentication > Security key | X's help page does not describe lost-key recovery. Register a second key and keep another two-factor method on the account |
| Other social, banks and brokerages | Varies. Search the security settings for "security key", "passkey" or "FIDO" | Varies; many financial services still rely on text or app codes |
Paths from Google Account Help, Apple Support, Microsoft Support and the X Help Center, checked October 2026. Menus change; if a label differs, search the service's help page for "security key".
How to set up a hardware security key, step by step
- Update first. Install the latest version of your phone or computer OS and browser. Apple requires iOS 16.3, iPadOS 16.3 or macOS Ventura 13.2 or later on every device signed in to your Apple Account.
- Make sure two-factor is already on. Most services add security keys as an extra method inside existing two-step settings. Apple requires two-factor authentication before you can add keys.
- Open the account's security settings using the paths in the table above, and choose the option to add a security key.
- Insert or tap the key when prompted, create or enter its PIN if asked, and touch the key's button or metal contact.
- Name it clearly, for example "Keyring key" or "Backup key - home", so you can tell them apart later.
- Repeat right away with the second key before leaving the settings page.
- Save backup codes or confirm another recovery method, and store them away from your devices.
- Test it. Sign out and sign back in with each key before you rely on it.
Google lets you rename or delete each key from the Security keys page, which also shows when a key was added and last used. Google notes that a newly added key can take up to seven days to be offered at sign-in, so keep your existing method in place for the first week. If you want the strictest setup, Google's Advanced Protection Program requires at least one passkey or security key and recommends recovery options so you are not locked out.
Apple
Once keys are active on an Apple Account, they replace six-digit verification codes for signing in on new devices. During setup, Apple asks you to review which devices stay signed in, and devices that have not been used or unlocked in more than 90 days are signed out. Managed Apple Accounts and child accounts cannot use security keys, and an Apple Watch paired with a family member's iPhone is not supported.
Microsoft
Microsoft's setup asks whether your key is USB or NFC, then has you create a PIN and touch the key. To sign in on the web, choose the option to use Windows Hello or a security key instead of a password, then insert or tap the key.
Why you really need two keys, and where to keep the spare
A single key is a single point of failure. Register both keys on every account at the same time, because a backup key that was never added to your email account will not help you get into it. Apple suggests keeping keys in separate places, such as one at home and one at work.
Keep a short written list of which accounts have which keys. Each time you add a new account to a key, add the backup too, or the list drifts out of date. Store printed backup codes with the same care as a passport, and include them in your wider plan from our complete guide to backups.
What should you do if you lose a security key?
- Sign in with your backup key or another method you set up, such as a passkey, a trusted device or backup codes.
- Remove the lost key from every account it was registered on. On Google it is the trash icon next to the key; on Microsoft it is under Advanced security options; on Apple it is in the Security Keys screen.
- Buy a replacement and register it everywhere, so you are back to two keys.
- If you have no other way in, use the service's account recovery. Google's recovery page can take 3 to 5 business days to verify you. If you just cannot use your key, Google lets you generate a security code at g.co/sc on any device that is still signed in to your account.
A key protected by a PIN or fingerprint is much harder for a finder to misuse, because the key will not sign in without it. Some services let a key replace your password entirely, so set a PIN and remove a lost key promptly rather than counting on your password as a backstop.
How do security keys fit with passkeys and a password manager?
Think of them as layers. A password manager stores strong, unique passwords for the many sites that still use them. Passkeys on your phone are the convenient everyday phishing-resistant option. A hardware key adds a device-bound credential for the accounts where a takeover would hurt most: email, your phone platform account and money. If your password manager itself offers security-key sign-in, it is worth considering, since it holds everything else.
For families, setting this up for an older parent can be worthwhile, but only if someone can help with recovery. Our family tech safety guide covers other safeguards to set up at the same time.
When a security key isn't the right move
- Accounts that do not support keys: many banks and smaller services still rely on texts or app codes. Use the strongest option they offer, and a passkey where available.
- Older devices: Apple devices that cannot update to a supporting OS version cannot sign in once keys are on, and Google says newly registered keys no longer work on Android devices running 8.0 or lower.
- Child and managed accounts: Apple child accounts and Managed Apple Accounts cannot use security keys.
- People who lose small objects often: synced passkeys may be a better fit, because they live on devices you already carry and back up.
- Stricter recovery: keys make account takeover harder for everyone, including you. If you remove all other recovery options, a lost key can turn into days of waiting or a permanent lockout.
- Cost: you need at least two keys, which is an up-front expense compared with free app codes.
Frequently asked questions
Do you need two security keys?
Yes, in practice. Apple will not turn on security keys for an Apple Account without at least two, and both Apple and Google recommend a spare kept in a separate, safe place. Register both on every account at the same time.
What happens if you lose your security key?
Sign in with your backup key or another recovery method, remove the lost key, and register a replacement. If you have no other way in, use the service's account recovery, which can take several days. On an Apple Account, losing every key and trusted device can lock you out permanently.
Is a security key better than a passkey on your phone?
Both are phishing-resistant. A security key keeps its private key inside one device that cannot export it, which NIST requires for its highest assurance level, while a synced passkey is easier to use and harder to lose. Many people use passkeys day to day and add hardware keys to their most important accounts.
Can someone use your security key if they find it?
A key with a PIN or fingerprint lock will not sign in without it, which is the main protection if it is found. With passwordless sign-in the key can stand in for your password, so do not rely on the password alone. Remove a lost key from your accounts as soon as you can.
Does a security key work with a phone?
Usually, yes. Many keys connect over USB-C or tap over NFC, and X's iPhone instructions also mention Bluetooth keys. Check the connector matches your phone before you buy.
Sources
- NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management (accessed October 2026)
- CISA: Implementing Phishing-Resistant MFA (fact sheet) (accessed October 2026)
- FIDO Alliance / Passkey Central: How passkeys work (accessed October 2026)
- Google Account Help: Use a security key for 2-Step Verification (accessed October 2026)
- Google: Advanced Protection Program FAQ (accessed October 2026)
- Apple Support: About Security Keys for Apple Account (accessed October 2026)
- Microsoft Support: Sign in to your account with a security key (accessed October 2026)
- X Help Center: How to use two-factor authentication (accessed October 2026)
Top image: "U2F Hardware Authentication Security Keys (Yubico Yubikey 4 and Feitian MultiPass FIDO)" by Tony Webster, CC BY 2.0, via Wikimedia Commons (resized). Charts and tables by Thank You Robot.
0 Comments