Short answer: Both use the same FIDO2 cryptography and both are phishing-resistant. The difference is where the private key lives. A YubiKey keeps it on a physical device that never syncs — maximum security, but lose it and it is gone. A passkey usually syncs through iCloud, Google, or a password manager — far more convenient, but its safety now depends on that cloud account. For most people, passkeys. For crypto, high-value targets, and anyone whose account compromise affects others, a YubiKey.
Same foundation, different storage
Both create a private/public key pair per website. The site keeps the public half. To log in, your authenticator signs a challenge with the private key, and the signature is bound to the site’s domain — so a fake login page cannot use it.
That domain binding is what makes both categories phishing-resistant, and it is the reason either one beats a TOTP code. As we cover in how TOTP works, a six-digit code has no idea what site you are typing it into. A passkey does.
So the security question is not about the cryptography. It is about where the private key sits and who could reach it.
Head to head
| YubiKey | Passkey | |
|---|---|---|
| Private key location | Secure chip on the device | Device secure enclave, usually synced |
| Syncs across devices | No | Yes (iCloud, Google, password manager) |
| Phishing-resistant | Yes | Yes |
| Survives losing your phone | Yes | Yes, if synced |
| Cost | ~$25–70 each | Free |
| Depends on a cloud account | No | Yes |
| Works on a borrowed computer | Yes | Via phone + QR |
| Site support | Good | Good and growing faster |
Where the YubiKey wins
No cloud dependency. The private key is generated inside a tamper-resistant chip and cannot be extracted — not by malware, not by a cloud breach, not by you. A passkey synced through iCloud is only as secure as your Apple account.
It resists device compromise. Malware on your laptop cannot use a YubiKey without someone physically touching it. Synced passkeys are unlocked by biometrics on a device that may itself be compromised.
It is genuinely separate. Something you have, in the original sense — a distinct object, not a credential replicated across everything you own.
It works anywhere with a USB port, including locked-down or borrowed machines where you cannot sign into a password manager.
Where passkeys win
Free and already on your devices. No purchase, no shipping, no waiting.
Recovery is far easier. Lose your phone, sign into your Apple or Google account on a new one, and your passkeys are back. Lose your only YubiKey with no backup registered and you are into account recovery.
Faster adoption. Sites are shipping passkey support faster than security key support, because passkeys need no hardware purchase from users.
Better daily experience. Face or fingerprint beats finding a key, plugging it in, and touching the contact.
The honest recommendation
Use passkeys as your default. They are free, strong, and dramatically better than passwords or SMS. The realistic alternative for most people is not a YubiKey — it is doing nothing.
Add a YubiKey for accounts where compromise is unrecoverable:
- Cryptocurrency exchanges and wallets — blockchain transfers cannot be reversed. See our Coinbase guide.
- Your primary email, which can reset everything else
- Your password manager account
- Developer accounts that publish code others depend on — see 2FA on GitHub
- Domain registrar and hosting
Buy two YubiKeys. Register both on every account. Carry one, store one. This is not optional advice — a single key is a single point of failure. More on this in what a hardware security key is.
And keep offline backup codes either way.
Frequently asked questions
Can a YubiKey store passkeys?
Yes. Modern YubiKeys hold discoverable credentials — passkeys that do not sync. You get passkey convenience with hardware-level isolation, limited by the key’s storage capacity.
What if I lose my YubiKey?
Use your second registered key or your backup codes, then revoke the lost one from every account. A finder cannot use it alone — it still requires your password or PIN.
Are synced passkeys less secure?
Marginally. Sync means your provider’s infrastructure and your account security become part of the picture. For the threats most people face, the trade is worth it.
Do I still need an authenticator app?
Yes, for the many services that support neither. See our authenticator app roundup.
Can I use both on one account?
Yes, and you should where possible — a passkey for daily use and a YubiKey as a strong backup.
The bottom line
This is not really a versus. Passkeys are the right default for almost everything; a YubiKey is the right addition for the handful of accounts where losing control would be irreversible. Start with passkeys today, and buy two keys when you are ready to protect your email and your money properly.