Short answer: Buy two keys, not one. Match the connector to your computer (USB-C for anything modern) and make sure at least one supports NFC so it works by tapping your phone. A YubiKey 5 series covers everything; a Google Titan or a cheaper FIDO2 key from a reputable maker is fine for most people. Register both on every account, keep the spare somewhere else, and you are done for years.
Buy two. Genuinely.
This is the single most important decision, and it comes before brand or connector.
A security key is deliberately unrecoverable. There is no cloud backup, no sync, no reset — that is the point, and it is what makes it strong. Which means one key is a single point of failure sitting in your pocket next to your house keys.
Register both keys on every account you protect. Keep the primary on your keyring, and the backup somewhere physically separate: a drawer at home, a safe, a desk at work. If the primary is lost, you carry on with the spare and register a replacement at leisure.
People who buy one key either lose it eventually and have a bad week, or never quite commit to using it because they are nervous. Two solves both.
Match the connector to your devices
USB-C — the right default in 2026. Modern laptops, Android phones, iPads and recent iPhones all use it.
USB-A — still worth having if you use an older desktop, a work machine you cannot change, or a docking station. A common setup is one USB-C key and one USB-A key as the backup, so you are covered either way.
Lightning — only relevant for older iPhones. If your phone has Lightning, either get a key with a Lightning connector or rely on NFC.
NFC — not a connector but a capability, and the one people underestimate. An NFC key is tapped against the back of your phone, no plugging in at all. Since most of us authenticate on a phone more often than a laptop, at least one NFC-capable key makes daily use painless.
Bluetooth — largely superseded by NFC. Extra pairing hassle, battery to charge, and rarely worth it.
What to actually buy
YubiKey 5 series (5C NFC, 5 NFC). The default recommendation. Supports FIDO2/WebAuthn, U2F, TOTP storage, smart card and OpenPGP. Well built, well supported, and the version most services test against. More expensive than the alternatives, and worth it if you want one purchase to cover everything.
YubiKey Security Key series. FIDO2 and U2F only, no smart card or TOTP features. Cheaper, and perfectly sufficient if all you want is passwordless and 2FA login — which is what most people want.
Google Titan. USB-C with NFC, solid, and often keenly priced. A good mainstream choice.
Nitrokey, SoloKeys, Token2. Open-source or lower-cost FIDO2 options. Genuine alternatives if you prefer open hardware or need to buy several for a team.
Biometric variants (YubiKey Bio, others) have a fingerprint sensor, so the key itself verifies you rather than a PIN. Nice, noticeably more expensive, and unnecessary for most people.
What to avoid: unbranded keys from marketplace sellers with no security track record. This is a device holding your credentials — provenance matters more than saving a few dollars.
What the key actually does
It holds a private key that never leaves the hardware. When you sign in, the site sends a challenge, the key signs it after you touch the contact, and the site verifies with your public key.
Because the credential is bound to the site’s exact domain, a phishing page cannot use it — the browser refuses before you get a chance to make a mistake. That is the property nothing else offers, and the reason a key beats even a good authenticator app. Background: what is a hardware security key, WebAuthn and FIDO2 and phishing-resistant MFA.
Where to use them first
Work down by consequence, not by convenience:
- Your primary email — it resets everything else.
- Your password manager.
- Your domain registrar and DNS.
- Financial platforms — Stripe, Kraken, your bank if it supports keys.
- Business tools — Shopify, GitHub, cloud consoles.
- Social accounts that carry a reputation.
Setup habits worth adopting
- Register both keys at the same time, on each account. Doing it later means repeating the whole exercise.
- Set a PIN on the key where supported, so a stolen key is not usable on its own.
- Keep backup codes anyway as a third layer — where to store them.
- Remove SMS afterwards. Leaving it enabled means an attacker takes that route and your key never comes into play.
- Label them physically, so you know which is registered where.
Frequently asked questions
Can one key work for all my accounts?
Yes — a single key can hold credentials for a large number of sites, and for FIDO2 there is effectively no practical limit for most users. We cover the details in can one security key protect all your accounts?
What happens if someone steals my key?
They still need your password, and on passwordless accounts they need the key’s PIN or your fingerprint. Remove the lost key from your accounts and carry on with the spare.
Does it need a battery or charging?
No. USB and NFC keys draw power from the port or the phone. Nothing to charge, nothing to expire.
Will it work with my iPhone?
Yes — NFC keys work by tapping, and USB-C keys plug in directly on recent models. Apple supports security keys for Apple Account sign-in too; see our Apple Account guide.
Are they worth it if I already use an authenticator app?
For your most important accounts, yes. An app is strong against everything except being typed into a fake page; a key removes that last gap. Keep the app for services that do not support keys.
Can I travel with one?
Yes — small, no battery, no signal needed. Take one and leave the spare at home. See 2FA while travelling.
The bottom line
Two keys, USB-C, at least one with NFC, from a maker with a real security reputation. Register both everywhere, put the spare somewhere safe, remove SMS afterwards. It is perhaps an hour of setup for a level of protection that then requires no maintenance and no thought for years.
Not ready to buy hardware? A passkey gives you most of the same protection using the phone you already own.
One Response