The Best Security Keys for Multi-Factor Authentication (2024)

One of the greatest threats to your personal security is an attacker taking control of an online account. With such control, a bad actor can do all sorts of nefarious deeds in your name, and if they get into your email account, they can use password recovery features to take control of even more of your accounts. Fortunately, multi-factor authentication (MFA) can help protect against account takeovers.

Although there are many ways to do MFA, one of the best (and definitely the coolest) is with a security key—a tiny device that fits on your keychain. These devices offer the most secure way to handle MFA and are required for the most advanced account protection offered by an increasing number of major companies, including Apple and Google.

Read on for the top security keys we've tested, followed by everything you need to know about choosing and using one.

Deeper Dive: Our Top Tested Picks

Buying Guide: The Best Security Keys for Multi-Factor Authentication

What Is Multi-Factor Authentication?

The authentication method most of us are familiar with is being required to enter a username and password. But passwords have a lot of problems. For instance, we're bad at remembering them and even worse at picking unique, complex passwords that can stand up to attacks. People also tend to reuse passwords, meaning that if one account is compromised, all other accounts with the same password are also at risk.

Multi-factor authentication, sometimes called two-factor authentication or 2FA, changes that by using more than one authentication factor. That doesn't mean a second password, but at least any two from a list of three possible factors:

• Something you know.

• Something you have.

• Something you are.

Something you know is typically a password. It lives in your head and is ideally known only to you. Something you have could be a security key such as those we've listed here, an authenticator app on your phone, or a code sent via SMS to your phone. It's something not easy for a stranger to access or obtain. Finally, something you are is a physical characteristic that can be read with a biometric scan, such as a fingerprint or your face, though using the latter ranks among the worst mistakes in technology.

Because it's extremely unlikely an attacker will have access to more than one of these forms of authentication, MFA makes it much harder for bad guys to take over accounts. It's been proven in the real world, too. When Google required employees to use hardware MFA keys, account takeovers effectively vanished.

What Is a Security Key?

While they can take many forms, most security keys are small, key-sized devices that uniquely identify themselves to sites and services. They're something you have.

To use a security key, you first have to enroll it with each site or service you want to protect. Support for security keys is increasing, but don't be surprised if they're not accepted at every site you try. You'll still need another form of MFA for all the sites and services that don't accept security keys.

Enrolling a key is slightly different for each key and site, but it usually goes something like this: Somewhere in the site or service settings is an option to enroll your security key. Click it, insert the key, tap the key's button when prompted, and give the key's record a name so you know what it is. Some sites and services limit you to just one key, while others allow or even require more than one. Many sites require you to enable an alternate form of MFA or generate one-time use security codes, to act as backups to your key.

The next time you go to log in, you're prompted to present your security key after entering your username and password for an account. You connect the key through some kind of data transfer connection—typically USB-A or USB-C—and then press a button on the device to verify you're a real person and not a clever malware attack impersonating a key. If both the password and the key check out, you log in as normal.

Some hardware keys include wireless communication capabilities, usually through near-field communication (NFC), to interact with mobile devices. Other keys have biometric authentication for an added layer of protection.

Are All MFA Factors Equal?

While two factors are always better than one, each MFA scheme has potential advantages and drawbacks.

Receiving one-time-passcodes via SMS text message is one of the oldest and most widespread forms of MFA, but it has two major drawbacks: it requires you to have a functioning phone, and the code can potentially be intercepted through SIM jacking. Login codes generated by authenticator apps are more secure than SMS codes and don't require a network connection, but your phone does need to be available and powered.

If you're new to MFA, we recommend starting with app-generated codes. They're free, secure, and easy to use and understand. But if you're already familiar with MFA and are interested in upping your security game, hardware security keys are the next step.

Hardware-based security keys solve most of the problems of other MFA schemes. The best hardware keys have no batteries and require no network connection. They also have no moving parts, making them difficult to break. Because they work on purpose-made hardware they're much harder to attack, unlike a phone that has is running lots of software and has numerous means of connecting to the internet. Finally, it can be kind of fun to have a special tool for logging in.

There are downsides to using hardware keys for MFA, of course. Unlike other authentication factors hardware keys cost money—from $20 to as high as $95. Hardware keys can also be lost and aren't as widely supported as app-based MFA codes.

That said, it's important to remember that MFA of any kind can't protect against all the dangers the modern world presents. We strongly recommend using antivirus software as well as a password manager to create unique and complex passwords for each site and service you use.

How Do Security Keys Work?

The most widespread means of hardware security key authentication is based on the standards from the FIDO Alliance. All these standards do fundamentally the same thing: They use asymmetric cryptography to authenticate you to a site or service.

Each device can generate any number of public keys from its private key, without exposing the private key. That allows a single hardware key to be used for multiple sites and services but most importantly, it means a failure or change at any one site or service won't affect the other. You can easily remove and enroll your hardware key as many times as you like.

When shopping for a hardware security key, you should look for at least FIDO U2F certification, because it means the key will work in just about every basic security key context. FIDO2/WebAuthn are the next-generation standards, which support additional types of authentication. If you want to use a device for biometric MFA or passwordless login, you need FIDO2/WebAuthn.

Are Security Keys Safe?

Going from a password that (ideally) is a complete secret to a little bauble like a security key can sometimes feel like being less secure. After all, what happens if your key is stolen or lost?

It's extremely unlikely someone would have the means to track down an individual user and steal their security key. Most cybercrime is committed en masse with thousands or millions of compromised accounts. One security key isn't worth the effort.

Still, it's not impossible that a determined attacker could use a stolen key to access your accounts. That's why it's important to keep your key safe, but also to use strong passwords secured in a password manager. If the thief gets the key but can't crack your password, they're still not getting in.

It's far more likely that you lose your key, and that can be a real problem. Yubico recommends enrolling a second key and storing it as a secure backup. Many services that support security keys also allow (and some require) you to enroll multiple MFA factors, so you could set up an authenticator app as a backup MFA option and use that if you don't have your key.

Services often let you generate backup codes you can write down offline or store in a password manager. These codes grant you access in emergencies. If none of that works, find a device where you are still logged in and unenroll the key or add a new MFA factor you do have. The bottom line is that losing your security key is not the end of the world.

How to Choose a Security Key

The first thing to look at when choosing a security key is how the key literally fits with the rest of your devices. If you don't have any devices with USB-C, you should stick to keys with a USB-A connector. If you intend on using your key with mobile devices (and you should) select a key with either a connector that fits your phone or NFC, if your phone supports NFC.

You also need to consider your budget. The most expensive keys we've reviewed cost up to $95, which is a significant chunk of change. If you're new to hardware security keys, we strongly recommend starting with a cheaper key and upgrading later. The Security Key NFC and Security Key C NFC, both from Yubico, work well for basic MFA and offer NFC for mobile devices. Either is great for first-time buyers.

Most security keys just authenticate you, and that's enough. But some go further with additional features. Kensington has a line of biometric keys that require the correct fingerprint to authenticate you. High-end YubiKeys have numerous additional features: the ability to play back a static password, working with a desktop or mobile app to provide app-generated passcodes, supporting PGP key management, and offering their own form of one-time passcodes.

More obscure facets of each key may be significant to the most discerning buyers. NitroKeys and SoloKeys use all open-source code and hardware, making them a strong choice for a particular crowd. Yubico locks down all its devices from firmware changes to protect them from tampering, while NitroKey celebrates its updatable firmware.

Passkeys vs. Security Keys

Passkeys are a secure authentication system that may one day replace passwords. Several major players have thrown their weight behind this technology, making it far more likely to catch on than any other previous effort to replace passwords. Apple, Google, and Microsoft have all added support for passkeys to their platforms, so you're likely to start seeing them appear as an option soon. If you want to try out passkeys, look at our instructions on how to use passkeys with your Google account or your Apple account.

A super-secure authentication scheme might sound like a death knell for security keys, but not so! Some security keys can store passkeys, keeping them safe and separate from your phone or computer. We tested the Security Key NFC, Security Key C NFC, and YubiKey Series 5 key, all of which can store passkeys.

The number of passkeys on a security key may be limited, however. The documentation from Yubico says that the company's devices can hold only 25 passkeys per security key.

Which Security Keys Work With Apple and Google Accounts?

Google has long supported hardware security keys for MFA on Google Accounts, and as of January 2023, Apple does as well for AppleID.

Apple and Google have different suggestions about what kind of security keys to use. In its instructions, Google simply links to a Google search for FIDO U2F keys. Apple says you must use two "FIDO Certified" hardware security keys, referring people to the FIDO Alliance list of certified devices. This list is difficult to navigate and doesn't include all the devices we've listed above, such as the Nitrokey. Apple does, however, suggest YubiKey 5C NFC, YubiKey 5Ci, and Feitan ePass K9 NFC USB-A specifically. We haven't yet tested Apple's implementation of security key support and don't know how restrictive it might be.

In addition to technical requirements, you'll need to consider compatibility. Apple's system has particular requirements about which version of iOS, iPadOS, and macOS you can use with security keys, so be sure to check them. You also need to use one of these up-to-date Apple devices to authenticate HomePod and Apple TV devices, as neither works directly with hardware security keys. Apple also requires the use of two security keys (one for a backup) while Google will let you enroll just one.

One key difference between Apple and Google's implementation of security keys is that Apple warns, "If you lose all of your trusted devices and security keys, you could be locked out of your account permanently." Google, however, has a recovery process.

In addition to their support for security keys for MFA, both Apple and Google have launched optional programs that place additional security measures around accounts and data. Google's Advanced Protection Program focuses on preventing account takeovers, but Apple's Advanced Data Protection for iCloud goes further, storing the encryption keys for your data on your devices. Apple doesn't require hardware security keys for Advanced Data Protection for iCloud, but you do have to enable MFA. Google requires two hardware security keys to enroll in its Advanced Protection Program.

The Key to Security

Hardware security keys are the best, most secure method of MFA. We highly recommend them. But for some, the idea of paying for a key or having to fetch it for every login is too much bother, and that's just fine. What's most important is that you find an MFA scheme that works for you and that you use it.