Best Hardware Security Keys of October 2026: 7 Phishing-Resistant Keys Compared

Some links on this page are affiliate links, meaning we may earn a commission at no extra cost to you. See our affiliate disclosure. Editorial placement is decided on merit and is not for sale.

By Lennit Herrera, founder and editor, Shielded Browsing  ·  Last updated October 1, 2026

The verdict: the YubiKey 5C NFC, at $58, is the hardware security key most people should buy in 2026 — it is one of only two keys on this list that Apple names by model as compatible with Apple Account security keys (the other is the Lightning-only 5Ci), it plugs into USB-C and taps over NFC, and it carries every protocol a key can carry, from FIDO2 passkeys to smart-card and OpenPGP. If you only want phishing-proof logins and never plan to use the smart-card extras, the Security Key C NFC by Yubico does the FIDO half of the job for $29, which is half the price. Google’s Titan Security Key (from $30) stores more than 250 passkeys, the most of any mainstream key, and the Token2 PIN+ Release 3.3 is the cheapest way to get 300 passkey slots and a full protocol set in one $26 device. Whichever you pick, buy two: Apple will not let you enrol with fewer, and Google says to keep a spare in a safe place.

Prices, connectors, protocol lists and passkey capacities below were verified against each manufacturer’s own product page on October 1, 2026. Effectiveness figures come from Google’s published research and from the US Cybersecurity and Infrastructure Security Agency (CISA), not from us — we do not test security keys ourselves.

On this page

• The short list — seven picks at a glance
• Comparison table — price, connectors, protocols, passkey slots
• How we picked (and what we could not check)
• 1. YubiKey 5C NFC — best overall
• 2. YubiKey 5 NFC — best for USB-A computers
• 3. Security Key C NFC by Yubico — best budget key and best first key
• 4. Google Titan Security Key — best passkey capacity from a big-name vendor
• 5. Token2 PIN+ Release 3.3 — best cheap multi-protocol key
• 6. YubiKey 5Ci — best for iPhones with a Lightning port
• 7. YubiKey C Bio — best fingerprint key
• Who each one is right for
• Why a key stops phishing when a code does not
• Passkeys, security keys and authenticator apps — which is which
• What Apple, Google, Microsoft and your password manager require
• The buy-two rule, and a 20-minute setup order
• Firmware, the 2024 Infineon advisory and why YubiKeys can’t be updated
• What didn’t make the list and why
• What a security key can’t do
• Frequently asked questions

The short list

• YubiKey 5C NFC — best overall. USB-C plus NFC, every protocol, 100 passkey slots, $58.
• YubiKey 5 NFC — best for USB-A computers. The same key with the older plug, also $58.
• Security Key C NFC by Yubico — best budget key and the right first key for most people. FIDO2 and U2F only, $29.
• Google Titan Security Key — best passkey capacity from a big-name vendor: more than 250, from $30.
• Token2 PIN+ Release 3.3 (USB-C) — best cheap multi-protocol key. 300 passkeys, PIV, OpenPGP, TOTP and NFC for $25.99.
• YubiKey 5Ci — best for an iPhone or iPad that still has a Lightning port. $85.
• YubiKey C Bio (FIDO Edition) — best fingerprint key, if your key lives on a desk. $98, no NFC.

Comparison table

“Maker’s price” is the price on the manufacturer’s own store on October 1, 2026 (Token2’s is quoted at 0% VAT; Google shows “From $30” for the two Titan connector variants). Amazon prices move daily and are not shown. “Passkey slots” is the number of discoverable FIDO2 credentials the key stores; ordinary second-factor registrations (U2F-style) do not use a slot, so the number matters only if you plan to use the key for passwordless sign-in on many sites.

How we picked

We compared 18 hardware security keys — every current YubiKey 5 Series form factor (5 NFC, 5C NFC, 5C, 5 Nano, 5C Nano, 5Ci), both YubiKey Bio FIDO Edition keys, both Security Key by Yubico models, both Google Titan variants, Token2’s PIN+ Release 3.3 USB-C and PIN+ Dual Ace, Nitrokey’s 3A NFC and 3C NFC, FEITIAN’s ePass K9 and Kensington’s VeriMark Guard 2.1 — against each manufacturer’s own product page on September 19, 2026, and shortlisted seven.

We do not test security keys ourselves. There is no meaningful “speed” or “accuracy” to measure on a device whose whole job is a cryptographic signature; what separates keys is what they support, what they cost, what they can’t do, and whether the services you use will accept them. All of that is a published fact we can read on the maker’s page, and every figure on this page is one of those. Where we cite effectiveness, it comes from Google’s 2019 account-hijacking study and CISA’s phishing-resistant MFA fact sheet, and is linked.

Four things decided the ranking, in this order:

1. Will your accounts accept it? Apple, Google and Microsoft all require FIDO-certified keys, and Apple names specific models. A key that works with everything beats a key with a longer feature list.
2. Connectors. A key you can’t plug into your phone is a key you’ll leave at home. NFC plus USB-C covers the most devices in 2026.
3. Price per protocol. Most people only ever use FIDO2 and U2F. Paying for smart-card, OpenPGP and one-time-password features is worth it only if you know you’ll use them.
4. Honest limits. Passkey capacity, missing NFC, a fingerprint reader that only works on desktops — every key here has one, and we list it in every block.

What we could not check: the exact price of the USB-C Titan variant (Google’s store page shows a single “From $30” and prices the two connector versions separately in a picker we could not read this run), a USD price for Nitrokey (sold in euros), and a USD price on FEITIAN’s US store. Where a number could not be verified at the maker’s page, it is not on this page.

1. YubiKey 5C NFC: best overall

Price: $58 (Yubico)  ·  Connectors: USB-C, NFC  ·  Protocols: FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, smart card (PIV), OpenPGP  ·  Passkey slots: 100  ·  Notable limit: firmware cannot be updated, ever

Why the YubiKey 5C NFC?

The YubiKey 5C NFC is the one key that answers every compatibility question with “yes”. USB-C fits a current MacBook, Windows laptop, iPad, Android phone or iPhone 15 and later; NFC covers any phone you’d rather tap than plug. It ships on firmware 5.8 and carries the full YubiKey 5 protocol set, which means it works as a FIDO2 passkey, a U2F second factor, a one-time-password generator, a PIV smart card for Windows or macOS login, and an OpenPGP card for signing email and Git commits. The detail that settles it for us is on Apple’s own support page: when Apple lists example keys for its Apple Account security-key feature, the two it names are the YubiKey 5C NFC and the YubiKey 5Ci. Yubico rates the 5 Series IP68 and crush-resistant, with no battery and no moving parts. Since the May 2024 firmware update, passkey storage is 100 slots (up from 25), which is more than most people will ever fill.

What we like

• USB-C and NFC on one key, so it works with essentially every phone and laptop sold in the last five years.
• Named by Apple as a compatible key, and works with Google, Microsoft, Bitwarden and 1Password without caveats.
• The full protocol set means you never discover a missing feature later — PIV and OpenPGP are there when you grow into them.
• 100 passkey slots, 24 PIV certificates and 64 OATH accounts on 5.7-or-later firmware, per Yubico’s release notes.

Watch out for

• Yubico does not allow firmware updates, by design. When a flaw is found (see the 2024 Infineon advisory), the fix is a new key, not a patch.
• It costs twice what the Security Key C NFC does, and if you only ever use FIDO2 and U2F you are paying for protocols you’ll never touch.
• The OTP feature is on by default and a brush against the gold contact can “type” a long OTP string into whatever window is focused. Harmless, but it startles people until they disable the slot in Yubico Authenticator.

Best for: anyone who wants one key that will work with every account and every device they own for the next several years.  ·  Skip it if: you only want phishing-proof logins and $29 buys that in the same shape.

See the YubiKey 5C NFC on Amazon →

Pairs with: a password manager that supports keys — see our best password managers guide.

2. YubiKey 5 NFC: best for USB-A computers

Price: $58 (Yubico)  ·  Connectors: USB-A, NFC  ·  Protocols: FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, smart card (PIV), OpenPGP  ·  Passkey slots: 100  ·  Notable limit: no USB-C, so phones need NFC or an adapter

Why the YubiKey 5 NFC?

The YubiKey 5 NFC is the 5C NFC with a USB-A plug, at the same $58 and on the same firmware 5.8. Everything else is identical: the six protocols, the IP68 rating, the 100 passkey slots. Yubico’s page quotes crush resistance to 25 N·m for this model. It is the right choice if your desktop tower, docking station or older ThinkPad is USB-A and you would otherwise be using a dongle every day — a key you have to hunt for an adapter to use is a key you stop using. For phones, NFC does the tapping, and Yubico’s page says that works on NFC-enabled Android and iOS devices. If your laptop is USB-C only, buy the 5C NFC instead; if you split time between both, buy one of each and register both everywhere, which also solves the backup-key problem.

What we like

• Same protocols, capacity and price as the 5C NFC; you give up nothing but the connector.
• NFC means it still works with a USB-C phone even though it won’t plug into one.
• Yubico’s most established form factor, with the longest track record of “works with” listings.

Watch out for

• USB-A is disappearing from laptops. Buy this only if your main computer still has the port today.
• The same no-firmware-updates policy as every YubiKey.
• The USB-A key is physically larger than the C version and sits proud of the port; it is not a leave-it-in key.

Best for: desktop and dock users whose main machine is still USB-A.  ·  Skip it if: everything you own is USB-C — get the 5C NFC.

See the YubiKey 5 NFC on Amazon →

Pairs with: a locked-down home network — see how to secure your home network.

3. Security Key C NFC by Yubico: best budget key and best first key

Price: $29 (Yubico)  ·  Connectors: USB-C, NFC  ·  Protocols: FIDO2 (CTAP2 and CTAP2.1), FIDO U2F, WebAuthn  ·  Passkey slots: 100  ·  Notable limit: no PIV, OpenPGP, OATH or Yubico OTP

Why the Security Key C NFC?

The Security Key C NFC is what you get when you remove everything from a YubiKey 5C NFC except the part that stops phishing. FIDO2 passkeys, U2F second-factor logins, USB-C and NFC — all present, with the same 100 passkey slots. What is gone is the smart-card (PIV), OpenPGP, OATH and Yubico OTP applications, and Yubico’s product page lists each omission explicitly. For most people that is nothing lost: Google, Apple, Microsoft, Bitwarden, 1Password, GitHub and every bank that supports keys use FIDO2 or U2F, not PIV. At $29 it is half the price of a 5 Series key, which is exactly what makes it the right first key: buy two of these for $58 and you have a primary and a backup for the price of one full YubiKey. There is a $29 USB-A twin, the Security Key NFC, with the same firmware 5.8 and the same feature list.

What we like

• $29 for the same phishing resistance as a $58 YubiKey; the FIDO2 implementation is the same firmware family.
• USB-C plus NFC, so it works with phones as well as laptops.
• Two of them cost what one 5 Series does, which makes the buy-two rule painless.
• 100 passkey slots — the same as the 5 Series.

Watch out for

• No PIV smart card, so it can’t log you into Windows or macOS as a certificate-based user, and no OpenPGP, so it can’t sign email or commits.
• No OATH, so it can’t hold authenticator-app-style codes the way a YubiKey 5 can through Yubico Authenticator.
• Same no-updates policy as every Yubico key.

Best for: first-time buyers, and anyone who just wants to lock down email, a password manager and a bank.  ·  Skip it if: you know you want PIV or OpenPGP — the 5C NFC is the upgrade.

See the Security Key C NFC on Amazon →  ·  USB-A version →

Pairs with: a free password manager with key support — Bitwarden takes FIDO2 keys on its free tier; see Bitwarden vs 1Password.

4. Google Titan Security Key: best passkey capacity from a big-name vendor

Price: from $30 (Google Store)  ·  Connectors: USB-A + NFC or USB-C + NFC (two models)  ·  Protocols: FIDO2, FIDO U2F (CTAP1)  ·  Passkey slots: more than 250  ·  Notable limit: sold through the Google Store; no PIV, OpenPGP or OTP

Why the Titan Security Key?

Google relaunched the Titan Security Key in November 2023 as a pair of FIDO2 keys, one USB-A and one USB-C, both with NFC, and its announcement put the headline number front and centre: the keys “store more than 250 unique passkeys”. That is two and a half times a YubiKey’s 100 slots. Google’s support pages say the keys work over NFC with Android 9 and later and iOS 13.3 and later, and over USB with Chrome 67 and later; Google’s own Advanced Protection Program accepts “any FIDO compliant security key, like the Google Titan Security Key”. As of March 2025 Google sells them in 22 markets. Titan keys include firmware Google says is engineered to verify the key’s integrity, and the same 2023 announcement committed Google to giving 100,000 of them away to high-risk users during 2024. Feature-wise this is a Security Key by Yubico competitor, not a YubiKey 5 competitor: FIDO only, no smart card, no OTP.

What we like

• More than 250 passkey slots, the highest of any key on this list bar Token2’s 300.
• Both connector versions include NFC, so either works with a phone.
• From $30, in the same price band as the Security Key C NFC.
• It is the key Google itself hands to journalists, campaign staff and activists through its high-risk programme.

Watch out for

• Google’s store lists “From $30” and prices the USB-A and USB-C models separately; we could not read the USB-C price this run, so budget for it to be higher.
• FIDO only. No PIV, OpenPGP or OATH — the same gaps as the Security Key by Yubico.
• Distribution is through the Google Store in 22 countries; if yours isn’t one, third-party listings are the only route and we can’t vouch for them.

Best for: people who will use the key for passwordless passkeys on dozens of sites, and Google-first households.  ·  Skip it if: you want smart-card or OpenPGP features, or you’re outside Google’s 22 store markets.

See the Titan Security Key on the Google Store →

Pairs with: a hardened Google account — our online privacy checklist covers the account settings to change first.

5. Token2 PIN+ Release 3.3 (USB-C): best cheap multi-protocol key

Price: $25.99 at 0% VAT (Token2)  ·  Connectors: USB-C, NFC  ·  Protocols: FIDO2.1, FIDO U2F, OATH-TOTP/HOTP, PIV, OpenPGP  ·  Passkey slots: 300  ·  Notable limit: a small Swiss vendor; price excludes shipping and local tax

Why the Token2 PIN+ Release 3.3?

Token2 is a Swiss company that most people have never heard of, and its PIN+ Release 3.3 USB-C is on this list because its spec sheet reads like a YubiKey 5C NFC’s at less than half the price. Its product page lists FIDO2.1, U2F, TOTP, HOTP, PIV and OpenPGP, NFC, FIDO certification at Level 2, “up to 300 passkeys”, and a PIN-complexity rule enforced in firmware (six digits minimum). The 300-passkey figure was the largest on the market when Token2 introduced it in February 2024, and it still is among the keys we compared. The same range includes a $31.07 “Dual Ace” with both USB-A and USB-C plugs and a metal frame, and an $7.91 “Pico” FIDO2 key that is the cheapest phishing-resistant authenticator we found anywhere. The trade-off is brand: Token2 has none of Yubico’s or Google’s name recognition, its keys are not on Apple’s example list, and its US-dollar prices are quoted before shipping from Switzerland and any import handling.

What we like

• A full YubiKey-5-class protocol list — PIV and OpenPGP included — for $25.99.
• 300 passkey slots, the most of any key here.
• FIDO2.1 with firmware-enforced PIN complexity, which Yubico only added with firmware 5.7 in 2024.
• NFC on the USB-C model, so phones are covered.

Watch out for

• The price is quoted at 0% VAT and excludes shipping from Switzerland; the landed cost in the US will be higher than $25.99.
• Token2 is not named on Apple’s compatible-key examples. Apple says any FIDO Certified key works, and Token2 lists Level 2 certification, but you are relying on the standard rather than a named endorsement.
• Support, documentation and third-party “works with” listings are thinner than Yubico’s. If something doesn’t enrol, you’ll be reading forum posts, not a Yubico knowledge-base article.

Best for: technical users who want PIV, OpenPGP and 300 passkeys without paying $58 to $85.  ·  Skip it if: you want a brand your bank’s support desk has heard of, or you need it this week.

See the PIN+ Release 3.3 on Token2 →

Pairs with: an open-source password manager — see our password manager picks.

6. YubiKey 5Ci: best for iPhones with a Lightning port

Price: $85 (Yubico)  ·  Connectors: USB-C, Lightning  ·  Protocols: FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, smart card (PIV), OpenPGP  ·  Passkey slots: 100  ·  Notable limit: no NFC, and Lightning is on its way out

Why the YubiKey 5Ci?

The YubiKey 5Ci is a full YubiKey 5 with a USB-C plug on one end and a Lightning plug on the other, and it exists for one reason: iPhones and iPads that still have a Lightning port, which is every iPhone up to the 14 series. It carries the whole 5 Series protocol set and 100 passkey slots, and Apple names it, alongside the 5C NFC, as a compatible key for Apple Account security keys. Plugging in is more reliable than tapping — NFC on iOS asks you to hold the key just so — and for apps that authenticate over the Lightning port rather than the browser, the 5Ci is the key that works. At $85 it is the most expensive non-biometric key here, and its case is weaker than it looks: an iPhone 15 or later is USB-C, so the Lightning end becomes dead weight the day you upgrade. Buy it if you have a Lightning iPhone you intend to keep; otherwise a 5C NFC does everything the 5Ci does over NFC for $27 less.

What we like

• Plugs directly into Lightning iPhones and iPads; no tapping, no holding the key in the right spot.
• Named by Apple as a compatible key.
• Full protocol set and 100 passkey slots, identical to the rest of the 5 Series.

Watch out for

• No NFC. If you ever want to tap a phone, this is the wrong key.
• Lightning is a legacy port; Apple’s current phones are USB-C. The $27 premium buys a connector with a shrinking future.
• Two exposed plugs and no cap; it lives on a keyring and looks it after a year.

Best for: a Lightning iPhone or iPad you plan to keep for years, plus a USB-C laptop.  ·  Skip it if: your iPhone is a 15 or later — the 5C NFC covers it.

See the YubiKey 5Ci on Amazon →

Pairs with: a VPN on the same iPhone — see our best VPN for travel guide.

7. YubiKey C Bio (FIDO Edition): best fingerprint key

Price: $98 (Yubico)  ·  Connectors: USB-C only  ·  Protocols: FIDO2 (Level 2 certified), FIDO U2F, fingerprint with PIN fallback  ·  Passkey slots: 100  ·  Notable limit: no NFC, and Yubico says it is “built primarily for desktops”

Why the YubiKey C Bio?

The YubiKey C Bio replaces the PIN with a fingerprint: you plug it in, touch the sensor, and the key releases the credential only for an enrolled finger, with the PIN as a fallback. That turns a security key from “something you have” into “something you have plus something you are” without typing anything. Yubico’s page is unusually candid about its scope — the Bio is FIDO-only (no PIV, OATH or OpenPGP), has no NFC, and is “built primarily for desktops” running Windows, macOS, Chrome OS or Linux with Chrome or Edge, with fingerprints and the FIDO2 PIN managed through Yubico Authenticator. There is a $98 USB-A twin. At $98 it is the priciest key here by a wide margin, and for phones it is simply the wrong product. For a desk-bound key on a shared or family machine, where you want a stolen key to be useless without your finger, it is the one to buy.

What we like

• Fingerprint replaces the PIN for day-to-day use, with the PIN still there if the sensor misreads.
• A lost key is not a usable key: the fingerprint gate makes casual misuse impossible.
• FIDO2 Level 2 certification and 100 passkey slots.

Watch out for

• No NFC and desktop-first by Yubico’s own description — this is not a phone key.
• FIDO only: no PIV, OATH or OpenPGP, at $40 more than a 5C NFC that has all three.
• $98 each, and the buy-two rule still applies. Pair it with a $29 Security Key as the backup rather than a second Bio.

Best for: a desktop key on a shared or high-value machine where a stolen key must be useless.  ·  Skip it if: you use your key with a phone, or you want anything beyond FIDO.

See the YubiKey C Bio on Amazon →  ·  USB-A version →

Pairs with: antivirus on the same desktop — see best antivirus for 2026.

Who each one is right for

You want one key that works with everything, and you’ll grow into it. YubiKey 5C NFC. If your computer is USB-A, the 5 NFC. Either way, register both keys everywhere.

You want phishing-proof logins on email, a password manager and a bank, and nothing else. Security Key C NFC by Yubico. Buy two; that is still less than one 5 Series key.

You are going passwordless on a lot of sites. Titan (250+ passkeys) or Token2 PIN+ (300). For everyone else, 100 slots is plenty: a second-factor registration doesn’t use a slot, so only passkey-style logins count against it.

You want PIV, OpenPGP or TOTP on the key and don’t want to pay $58. Token2 PIN+ Release 3.3, and accept the thinner support ecosystem.

You have a Lightning iPhone you’re keeping. YubiKey 5Ci, paired with a 5C NFC or Security Key C NFC as the spare.

You want a key that’s useless to whoever picks it up. YubiKey C Bio, on a desktop, with a cheap Security Key as backup.

Why a key stops phishing when a code does not

Every other second factor — a text message, an authenticator-app code, a push prompt — can be relayed. The attacker sends you to a fake login page that looks exactly like your bank’s, you type your password and the six-digit code, and the fake page passes both to the real site in real time. The code was genuine; you just gave it to the wrong person. A FIDO security key can’t be relayed, because the key signs a challenge that includes the website’s real origin. On the fake site, the key signs for the fake domain, the real site rejects it, and the attacker gets nothing. You don’t have to notice the misspelled URL; the key notices for you.

The clearest public evidence is Google’s year-long study with New York University and UC San Diego, published in May 2019. Across Google’s own accounts, an SMS code sent to a recovery phone blocked 100% of automated bots, 96% of bulk phishing attacks and 76% of targeted attacks; on-device prompts blocked 100%, 99% and 90%. And, in Google’s words, “zero users that exclusively use security keys fell victim to targeted phishing during our investigation.” The gap between 76% and zero-victims is the entire argument for spending $29.

The US government reached the same conclusion. CISA’s October 2022 fact sheet on implementing phishing-resistant MFA calls it “the gold standard”, ranks authentication methods from strongest to weakest with FIDO/WebAuthn at the top, and says that FIDO/WebAuthn is “the only widely available phishing-resistant authentication”. SMS and voice codes, it says, “should only be used as a last resort”. NIST’s current digital-identity guideline, SP 800-63B Revision 4 (August 2025), goes further for its highest assurance level: an AAL3 authenticator “SHALL have a non-exportable private key and SHALL provide phishing resistance”, and syncable authenticators are excluded at that level. In plain terms, at the top tier the US standard requires a hardware key.

Passkeys, security keys and authenticator apps — which is which

Three things get muddled here, and the manufacturers don’t help by putting “passkey” on every box.

An authenticator app (Google Authenticator, Authy, Aegis) generates six-digit codes. It is better than SMS because nobody can SIM-swap it, but it is still phishable: you read the code and type it, and a fake page can relay it. CISA files it under “app-based authentication: vulnerable to phishing attacks”.

A passkey is a FIDO credential. The FIDO Alliance defines it as a credential “that can be stored on your phone or computer, or in a hardware security key”. The ones on your phone that sync through iCloud Keychain or Google Password Manager are “synced passkeys”; the ones that “never leave a single device (including those on FIDO security keys)” are “device-bound passkeys”. Both are phishing-resistant. The difference is what happens if your Apple or Google account is compromised: a synced passkey syncs to the attacker’s device too, and a device-bound one doesn’t.

A hardware security key is a passkey you can hold. In the FIDO Alliance’s words, “device-bound passkeys in modern hardware security keys offer the highest security assurance.” It is also the only form of passkey that works identically on a Windows PC, a Mac, an Android phone and an iPhone without belonging to any of those ecosystems, and it can double as an old-style U2F second factor on the many sites that still only support that.

The setup that works for most people is layered: passkeys on your phone where a site offers them, an authenticator app for the sites that only do codes, and a hardware key on the five or six accounts that can be used to take over everything else — primary email, password manager, bank, Apple or Google or Microsoft account, and any crypto exchange.

What Apple, Google, Microsoft and your password manager require

Each of the big accounts has rules that decide which key to buy and how many.

Apple Account. Apple’s security-keys support page requires “at least two FIDO Certified security keys that work with the Apple devices that you use on a regular basis”, allows up to six, and needs iOS 16.3, iPadOS 16.3 or macOS Ventura 13.2 or later on every device signed in to the account. The example keys it names are the YubiKey 5C NFC, the YubiKey 5Ci and the FEITIAN ePass K9 NFC USB-A, and it points to the FIDO Certified showcase for the full list. Two keys is not advice here; it is the enrolment rule.

Google Account. Google’s help page says “any FIDO1 or FIDO2 security key can be used as a second step for 2-Step Verification”, that passwordless sign-in needs a FIDO2 key, that newly registered keys no longer work on Android 8.0 and lower, and — this one surprises people — that “you may need to wait 7 days before a newly added security key is available at sign-in.” It also says to “get an extra key that you can keep in a safe place.” Google’s Advanced Protection Program, the high-risk tier, requires a passkey or security key outright.

Microsoft account. Microsoft’s setup page requires the Windows 10 May 2019 Update or later and a supported browser, and a PIN on the key: you “create your security key and give it a unique PIN” before it will sign you in. Every key on this list supports a FIDO2 PIN.

Password managers. Bitwarden’s documentation says FIDO2 WebAuthn two-step login “is available for free to all Bitwarden users”, with up to five keys on a standard account and ten on Premium. 1Password’s page asks for a FIDO U2F-compatible key and recommends keeping an authenticator app set up as well so a lost key doesn’t lock you out. Our password manager comparison covers which tiers include key support; the family plans mostly do.

The buy-two rule, and a 20-minute setup order

A security key with no backup is an account-recovery ticket waiting to happen. Apple requires two; Google tells you to keep a spare; 1Password tells you to keep another method. Treat two keys as the unit of purchase — two Security Key C NFCs cost $58, the same as one 5C NFC — and register both on every account in the same sitting, so the backup exists before you need it. Keep the second key somewhere that isn’t your keyring.

Then work through accounts in the order that limits damage:

1. Primary email. It’s the reset address for everything else. Add both keys, then check what other recovery methods are still active and remove the weak ones (an old phone number, a forgotten secondary address).
2. Password manager. Both keys, and note 1Password’s advice to leave an authenticator app in place as well.
3. Apple, Google or Microsoft account. Remember Google’s seven-day wait on a newly added key and Apple’s two-key minimum.
4. Bank, brokerage, crypto exchange. Support here is patchier; where a site only offers codes, a key can’t help and the authenticator app stays.
5. Everything with a “sign in with Google/Apple” button is already covered by step 3.

Two more habits. Set a FIDO2 PIN on each key during setup (Microsoft requires it, and it means a stolen key is useless on its own). And write down which accounts each key is registered on; if one is lost, Yubico’s advice is to “promptly deregister the key from all associated applications and services”, and that is much faster with a list.

Firmware, the 2024 Infineon advisory and why YubiKeys can’t be updated

Two things about YubiKey firmware decide whether an older key is worth buying second-hand or keeping.

Firmware 5.7 changed the numbers. Yubico’s May 6, 2024 release announcement raised capacity to “up to 100 passkeys, 24 PIV certificates, 64 OATH seeds, and 2 OTP seeds at once for a total of 190 credentials”, implemented FIDO CTAP 2.1 features such as Force PIN Change and Minimum PIN Length, and added RSA-3072, RSA-4096, Ed25519 and X25519 keys. Every YubiKey and Security Key sold new today ships on 5.7 or later (the product pages we checked all say 5.8). A key bought before mid-2024 has 25 passkey slots, not 100.

The Infineon side-channel. On September 3, 2024 Yubico published advisory YSA-2024-03: a flaw in an Infineon cryptographic library used in YubiKey 5 Series and Security Key Series devices with firmware before 5.7.0 — everything shipped before May 21, 2024. Yubico rated it Moderate (CVSS 4.9) because exploiting it requires “physical possession” of the key plus “specialized equipment”, and often the account password or PIN as well. Nobody is going to do this to a random person’s YubiKey; a nation-state might do it to a specific target’s. The part that matters for buyers is the advisory’s other statement: Yubico “does not allow firmware updates”, on the grounds that an un-updatable key can’t be maliciously updated either. So there is no patch. An affected key stays affected, and the remedy Yubico offers is a newer key. That is the real cost of the no-update policy, and it is why we would not buy a used YubiKey without checking its firmware version in Yubico Authenticator first.

What didn’t make the list and why

• YubiKey 5C ($65) and YubiKey 5 Nano ($68). Both are full 5 Series keys with no NFC, and both cost more than the 5C NFC and 5 NFC that have it. The Nano is the right shape for a leave-it-in laptop key; otherwise pay less and get NFC.
• Kensington VeriMark Guard 2.1 USB-C ($69.99). A credible fingerprint key: FIDO2, U2F and CTAP 2.1, ten fingerprints, Kensington quotes a 2% false-rejection and 0.001% false-acceptance rate, and it is $28 cheaper than the YubiKey C Bio. It missed the cut because Kensington publishes no passkey capacity, which matters for a FIDO-only key. If you want a cheaper fingerprint key and don’t need passwordless on many sites, it is the alternative.
• Nitrokey 3A NFC (€60) and 3C NFC (€65). Open-source firmware, an EAL 6+ certified secure element, FIDO2, OpenPGP and TOTP. Nitrokey sells in euros with no US-dollar price, so it fails our rule that every price be verified in dollars at the maker. If auditable firmware matters to you more than brand, it is the open-source pick.
• FEITIAN ePass K9 NFC. Apple names it as a compatible key, but FEITIAN’s own page lists “Maximum Residential Credentials: 22” — fewer than a quarter of a YubiKey’s passkey slots — and its US store showed no US-dollar price in this run.
• Token2 Pico ($7.91). The cheapest FIDO2 key we found, and worth knowing about as a spare. It is a bare-board design without the multi-protocol set of the PIN+, which is the Token2 we’d buy first.
• Any Bluetooth key. Google discontinued its Bluetooth Titan in 2021. Every key on this list is USB or NFC, which is simpler and has no battery to die.

What a security key can’t do

It can’t protect an account that doesn’t support it. Plenty of banks and most smaller sites still offer only SMS or app codes. There the key does nothing, and the weakest enabled recovery method is still the way in. Before buying, check the three or four accounts you most care about.

It can’t stop malware on the device you’re using. If your laptop is compromised, a session cookie can be stolen after you’ve signed in with the key. The key proves who logged in; it doesn’t police what happens next. That is what antivirus and keeping the OS updated are for.

It can’t recover a lost account. Lose both keys with no other recovery method and you are into the account provider’s manual recovery process, which for Apple and Google can take days and can fail. This is the second reason for the buy-two rule.

It can’t hide what you do online. A key authenticates you; it doesn’t encrypt your traffic or mask your IP. That is a separate problem with a separate tool — see our VPN comparison — and neither replaces the other.

It can’t undo data that’s already out there. Phishing often starts with details bought from data brokers. Locking the door is step one; getting your address and phone number off people-search sites is a different job, covered in our data-removal comparison.

When not to buy one: if you haven’t yet moved to a password manager with unique passwords everywhere, do that first — it fixes more accounts for less effort. The key is the layer you add on top.

Frequently asked questions

Do I really need a hardware security key?

For the accounts that can reset everything else — primary email, password manager, your Apple, Google or Microsoft account, bank and any crypto exchange — yes, if they support it. Google’s study found no security-key-only users fell to targeted phishing, against a 76% block rate for SMS codes. For accounts that only offer codes, a key can’t help and an authenticator app is the ceiling.

Why should I buy two security keys?

Because losing your only key means falling back to the account’s recovery process, which is slow and is often the weak point attackers target. Apple won’t enrol you with fewer than two, Google tells you to keep a spare, and two $29 Security Keys cost the same as one $58 YubiKey 5C NFC. Register both on every account at the same time.

YubiKey 5C NFC or Security Key C NFC — what’s the $29 difference buying?

Smart card (PIV), OpenPGP, OATH codes and Yubico OTP. The FIDO2 and U2F parts — the parts that stop phishing — are the same, and both have 100 passkey slots. If you don’t know what PIV or OpenPGP are, you don’t need them, and the Security Key is the right buy.

How many passkeys do I actually need room for?

Fewer than you’d think. Only passwordless, passkey-style logins take a slot; a key registered as a second factor after your password (the U2F style most sites still use) does not. 100 slots covers most people for years. Titan’s 250+ and Token2’s 300 matter if you are deliberately going passwordless everywhere.

Will a security key work with my phone?

Any key with NFC taps against an Android phone (Google says Android 9 and later for Titan) or an iPhone (iOS 13.3 and later). USB-C keys plug straight into USB-C phones. The YubiKey 5Ci plugs into Lightning iPhones. The YubiKey Bio has no NFC and Yubico describes it as desktop-first, so it is the one to avoid for phone use.

Can a YubiKey be updated if a security flaw is found?

No. Yubico’s policy is that firmware cannot be updated, and its 2024 advisory on the Infineon side-channel offered newer keys, not a patch, as the remedy. Check the firmware version in Yubico Authenticator before buying used; anything shipped before May 21, 2024 is on pre-5.7 firmware.

What happens if I lose my only key?

You fall back to whatever other sign-in or recovery method the account still allows. If none is set up, you are into manual account recovery. Yubico’s advice for a lost key is to deregister it from every service straight away — which is why we suggest keeping a list of where each key is registered.

Is a passkey on my phone as good as a hardware key?

Against phishing, yes — both are FIDO credentials and neither can be relayed to a fake site. The difference is that a synced passkey follows your Apple or Google account, so compromising that account compromises the passkey. A hardware key’s passkey is device-bound and never leaves the key, which is why the FIDO Alliance calls it the highest assurance and why NIST’s top assurance level excludes syncable authenticators.

Bottom line

The YubiKey 5C NFC is the key to buy if you want one answer: every connector that matters, every protocol, Apple’s named endorsement, $58. If you only want phishing-proof logins, two Security Key C NFCs for $58 total are the better purchase, because the second key is not optional. Titan and Token2 are the picks if passkey capacity is the thing you’re optimising for, the 5Ci is for Lightning iPhones, and the Bio is for a desk. What none of them replaces is a password manager with unique passwords everywhere; a key is the layer on top of that, and it is the cheapest big upgrade to your security that exists.

About the author

Lennit Herrera is the founder and editor of Shielded Browsing. He compares VPNs, password managers and security hardware against the vendors’ own published specifications, independent security audits and government guidance rather than marketing claims, and he does not accept payment for placement. Every price and specification on this page was checked against the manufacturer’s own site on the date shown under the byline. More about this site →

Related reads

• Best Password Managers 2026
• Bitwarden vs 1Password
• Best Family Password Manager
• How to Stay Anonymous Online: A Practical Guide
• How to Secure Your Home Network
• Best Data Removal Services of September 2026