Security keys: who they're for and why you always need two
A security key is a physical object that doesn't get lost with your phone and that blocks phishing better than any code. The problem isn't the key: it's having only one.
Some links on this page are affiliate links: if you buy, we may earn a commission at no cost to you. It doesn't change what we recommend or the order. We will never ask you for a password.
What does a security key do for your recovery?
It confirms it's really you through a physical object, using the FIDO2 and WebAuthn standards, instead of a code someone could steal with a fake link. Unlike your phone, a key has no battery to run out and doesn't update itself, and it doesn't disappear if you lose your phone. But for that same reason, if you lose the only key you registered, you're just as locked out: every manufacturer repeats the same warning — a spare key you never registered is useless the moment you need it.
What to look at when choosing
- Does the service where you'll use it (Google, GitHub, your manager) support several registered keys at once?
- Does it have NFC, in case your phone has no USB-C port?
- Are you going to buy two from the start, one for daily use and one as a spare?
- Are you going to keep it somewhere different from where you keep your phone?
Comparison
| Key | What it is | Rough price | Who it's for |
|---|---|---|---|
| YubiKey 5 NFC (Yubico) | The best-known; USB-A or USB-C with NFC, compatible with iOS, Android, Windows, Mac and Linux | ≈€70 — see current price | Anyone who wants the option with the most support and best reputation |
| Google Titan Security Key | Google's key with its own Titan chip; USB-A/NFC or USB-C/NFC | ≈$30-35 (US) — see current price at the Google Store | Anyone already living in the Google ecosystem who wants its brand |
| Nitrokey 3 / Nitrokey Passkey | German manufacturer, FIDO2/WebAuthn and OpenPGP, open source | From ≈€32 (Nitrokey Passkey) — see current price | Anyone who prioritizes open source and privacy |
| Feitian ePass / BioPass | A manufacturer that supplies many "white-label" keys sold on Amazon | From ≈$20 — see current store price | Anyone looking for the cheapest option |
| Token2 | Swiss manufacturer; includes an NFC card format, less intimidating than a USB key | From ≈€18 (NFC card) — see current price | Anyone who prefers something card-shaped |
Yubico and Google don't run their own affiliate programs for these keys: if you buy a YubiKey or a Google Titan through a link of ours, it may be via Amazon, not directly from the manufacturer. Price and availability depend on that store at any given time.
Our default pick
YubiKey 5 NFC, for support and reputation, always buying two from the start: one for everyday use and one as a spare, registered on the same accounts from the very first moment, not "whenever you get around to it." If price is the barrier, Token2's NFC card does the same job for less money and is less intimidating to carry in your wallet.
If what you want is open source and transparency about how the device works, Nitrokey is the alternative to look at: same technical base (FIDO2/WebAuthn), with OpenPGP added for anyone who also signs or encrypts email. For most people who just want to protect their email, their password manager and little else, that extra layer isn't needed, and the YubiKey remains the simplest option to recommend.
Where do I keep it?
Having two keys does you no good if you keep them together, in the same drawer as your phone. The idea is the same as with backup codes: one key can travel with you, on your house keys or in your bag; the second should stay somewhere physically different (another room, a trusted friend's place, a safe), so a single theft, fire or badly organized move doesn't take both at once.
Common mistakes
The most costly to fix: buying a single key, losing it, and discovering the "spare key" in a drawer was never registered on any account. The second: using the key on only one account (say, Google) and still relying on SMS or push notifications on the rest, which leaves your phone as the single point of failure for everything that isn't that one account.
The third: thinking a security key replaces your password manager or your authenticator app. It doesn't: it's one more second factor, the most phishing-resistant one, but it still needs a password or a passkey behind it. The three pieces work together, not one instead of another.
Official sources: Yubico — Store