What is Hardware Security Keys (2025)

By Xah Lee. Date: .

What is Hardware Security Keys

Hardware security keys (also called security keys or hardware tokens) are physical devices that provide the strongest form of two-factor authentication (2FA) and are increasingly the best way to protect high-value accounts (Google, Microsoft, GitHub, X/Twitter, crypto wallets, password managers, etc.).

Why they're better than SMS/app codes

  • Immune to phishing (the key checks the real domain name before releasing the credential)
  • Immune to SIM-swapping
  • No codes to intercept or leak
  • Work even if your phone is stolen or compromised

Major standards

  • FIDO2 / WebAuthn → passwordless login + 2FA (modern standard, works everywhere now)
  • FIDO U2F → older 2FA-only standard (still widely supported)
  • Some keys also do OTP (TOTP/HOTP), OpenPGP, or store SSH keys

Best hardware security keys in 2025

Top recommendations

  • 1. Yubico YubiKey 5 Series (most popular, bulletproof)
  • Models: 5C NFC, 5 NFC, 5Ci (Lightning + USB-C), 5 Nano (for always-plugged)
  • Supports: FIDO2, FIDO U2F, OTP, OpenPGP, Smart Card (PIV)
  • Price: ~$50–$90
  • Best for: most people
  • 2. Yubico Security Key Series (cheaper, FIDO-only)
  • Security Key C NFC or Security Key NFC
  • Only does FIDO2/U2F (no OTP or OpenPGP)
  • Price: ~$25–$30
  • Best if you just want phishing-resistant 2FA and don't need extras
  • 3. Google Titan Security Key (discontinued in 2024, but still works)
  • Replaced by basically rebadged YubiKeys now
  • 4. Nitrokey 3 (open-source firmware, European)
  • Supports FIDO2, OTP, OpenPGP, password manager
  • Price: ~€60–80
  • Good if you want fully open-source everything
  • 5. OnlyKey (open-source, can store static passwords too)
  • Niche, but popular in privacy circles

  • 6. Thetis, Feitian, etc. – cheaper Chinese brands, work fine for FIDO2/U2F but less trustworthy firmware

Newer options (2025)

  • Yubico YubiKey 5C NFC Pro / 5Ci Pro – added secure element improvements
  • SoloKeys Solo 2 – fully open-source FIDO2 key (~$40)
  • Keysmith Mirage – new entrant with display and biometric versions coming

How to use them

1. Buy at least two keys (always have a backup!) 2. Register both with every account that supports them 3. Store the backup in a safe place (safe deposit box, parents' house, etc.) 4. Many services now support passwordless login with just the key (Google Advanced Protection, Microsoft, GitHub, etc.)

Services that support hardware keys (2025)

  • Google / Gmail
  • Microsoft accounts
  • X/Twitter (supports them since 2023)
  • GitHub
  • GitLab
  • Dropbox
  • Most password managers (Bitwarden, 1Password, Dashlane)
  • Apple iCloud (limited, only as 2FA, not passkey yet)
  • Most crypto exchanges/wallets (Ledger and Trezor also act as FIDO2 keys)

Quick recommendation for most people

  • Primary: YubiKey 5C NFC (~$55)
  • Backup: Yubico Security Key C NFC (~$29)

If you want the absolute cheapest that still works everywhere: two Yubico Security Key C NFC (~$60 total) is hard to beat.

Any specific use case (e.g., only iPhone, crypto, enterprise, open-source only) you're looking for? I can narrow it down further.

password related