What a security key is (YubiKey, Titan…)
A security key is a physical object, about the size of a USB stick, that confirms it's you without a password or a code. You plug it in or tap it against your phone or computer and press a button.
- What it is
- Physical identification object
- Since
- 2014
- Verdict
- Yes, but…
What it is
A security key is a small device (USB-A, USB-C, NFC or Bluetooth) that cryptographically proves it's you. There's no number to type and no code that can be intercepted: you plug the key in or tap it against your phone and touch the metal contact. The best-known brands are YubiKey (from Yubico), Google Titan and Nitrokey.
Under the hood it uses the same standards as a passkey: when you log into a website, the key and the browser exchange proof based on FIDO2. That's why a security key can't be "phished" with a fake website: the key checks the real domain before responding.
Since when
Yubico, the Swedish company that makes YubiKeys, was founded in 2007. In 2012 it started collaborating with Google's security team to create an open standard, and in 2014 it launched the first U2F ("Universal 2nd Factor") key at the same time Google turned on support in Gmail and Chrome. Google introduced its own key, the Titan Security Key, in July 2018. The standard later expanded into FIDO2 and WebAuthn, which lets you use the same key to log in with passkeys too.
Why it's used
It blocks phishing better than any code: even if someone takes you to a website that's identical to your bank's, the key won't respond because the domain doesn't match. For anyone with accounts they can't afford to lose (main email, password manager, bank), it's the strongest option that exists today.
The flip side: the key doesn't depend on your phone, so losing your phone doesn't leave you without it. But if you only have one and it always travels with your house keys, losing both at once (a stolen bag, for example) does leave you locked out. That's why two keys are always recommended, one for daily use and another kept separately.
Do we use it?
Yes, if you have accounts that genuinely matter to you, and always with two keys. With only one, you trade one single point of failure for another.
Check this
- Do you have a security key registered on your main email or your password manager?
- Do you have a second key stored somewhere different from the first?
- Do you know another way to log in if you lose both keys at once?
Official sources: Yubico · FIDO Alliance