Hardware security keys: what they are and how they differ

What is a hardware security key? It’s a small device, about the size of a house key, that proves it’s really you when you sign in. You plug it into a computer’s USB port or tap it on the back of a phone, then touch it. Because the key has to be physically there, a criminal who has stolen your password still can’t get in.

The Australian Signals Directorate (ASD) says a FIDO2 security key bought “from a reputable store” can “provide increased protection of your passkeys”. This guide explains how security keys work, whether they’re needed at all, what to compare, and how four widely sold keys describe themselves.

How security keys work

Security keys use the FIDO standards, the same technology behind passkeys. When a key is registered with an account, it creates a pair of cryptographic keys. The private half never leaves the security key. At sign-in, the website sends a challenge, the key signs it, and the website checks the signature.

The useful part is that the key also checks which website is asking. A look-alike phishing site gets nothing it can reuse. The FIDO Alliance describes phishing resistance as “a core design goal of FIDO Authentication”, and says that “device-bound passkeys in modern hardware security keys offer the highest security assurance”.

A security key can be used in two ways:

• As a second step, after a password, in what’s called multi-factor authentication (MFA).
• As a passkey, replacing the password altogether. Google’s help page notes that to create a passkey, a key must support the FIDO2 protocol.

ASD’s guidance for organisations says MFA is most effective when one factor uses public key cryptography and is physically separate from the device being used, giving “a security key rather than a physical OTP token” as an example. Microsoft’s authentication methods documentation lists FIDO2 security keys among the methods it describes as phishing-resistant.

Do you need one?

Not necessarily. Many people already have a phishing-resistant option built in:

• Passkeys on a phone or computer. ASD says “You can create and store passkeys on modern Apple and Android smartphones and tablets”, and that you can decide whether to store a passkey on your device or on a FIDO2 security key. The FIDO Alliance says phishing resistance applies “whether or not the cryptographic keys are bound to hardware”. Our guide to what passkeys are and how to set them up has the steps for Apple, Google and Microsoft accounts.
• Other MFA methods. Authenticator apps and similar methods are explained in the guide to securing online accounts, and the MFA readiness checklist helps track which accounts have it.

When a security key adds something

• Extra protection for the most important accounts. ASD describes a FIDO2 key as providing “increased protection of your passkeys”, and says “This is useful for your most important online accounts.”
• A passkey that never leaves one device. A synced passkey is copied to your other devices; a passkey on a key stays on the key. ASD notes that every device a passkey syncs to is another opportunity for theft.
• Workplace requirements. Some employers require keys for particular accounts. Microsoft’s emergency access documentation, for example, lists “Passkey (FIDO2) (Recommended)” for emergency administrator accounts. Microsoft 365 MFA methods compared explains how Microsoft classifies the options.

What to compare

Where it’s bought. ASD refers to buying a FIDO2 security key “from a reputable store”.

FIDO2 support. ASD’s guidance refers specifically to FIDO2 keys. Makers list which versions a key supports, such as FIDO2 with CTAP 2.1, or the earlier FIDO U2F, which works as a second step but not for passkeys.

Connectors. Keys come with USB-C or USB-A, and many add NFC so they can be tapped on a compatible phone. The right connector depends on the devices the key will be used with.

Passkey storage. Some makers publish how many passkeys a key can hold, 100 or 300 in the products below. Not every maker states this.

Other protocols. Some keys also support smart card (PIV), OpenPGP or one-time-code (OATH) standards. These matter mainly for some workplace and technical systems.

PIN and durability. Makers may describe PIN rules, whether a key needs a battery, and a water and dust resistance rating.

Availability in Australia. Makers’ sales channels differ by country, so it’s worth checking whether a maker or its resellers sell in Australia.

How the products compare

Based on makers’ published specifications, checked October 2026. Listed alphabetically, not ranked. Specifications and availability change, so each maker’s site has the current details. Pricing varies; check the maker’s site.

The product summaries further down this page set out what each maker states, with links to their pages.

How to set up a security key

ASD’s passkeys page sets out these general steps (checked October 2026; ASD’s page has the latest version):

1. Check whether the account provider supports passkeys as a way to log in.
2. Decide whether to create and store the passkey on your device or on a FIDO2 security key.
3. Follow the account provider’s instructions to set up the passkey.
4. Once the passkey is created, ASD says to ensure that logging in to the account with a password is disabled.

ASD also recommends creating a backup passkey on a second FIDO2 security key.

How to add a security key to a Google Account

Based on Google’s instructions (checked October 2026). Menus can change; Google’s guide has the latest steps.

1. Turn on 2-Step Verification for the Google Account, since Google says security keys are used with it.
2. Update the browser or operating system, and use a compatible browser such as Chrome.
3. In the 2-Step Verification settings, open the option to add a security key, signing in again if asked.
4. Add more ways to prove it’s you, which Google describes so that a lost key doesn’t lock you out.

Google says any FIDO1 or FIDO2 key can be used as a second step, but creating a passkey needs FIDO2. It also notes that newly registered keys no longer work on Android 8.0 and lower.

Other services have their own steps, so each provider’s help page is the reference. For Microsoft work accounts, an organisation’s IT process governs which keys are allowed and how they’re registered.

Things to watch for

• Losing the only key. ASD’s backup-key recommendation exists for this reason. Google’s page says that without another second step, recovery can take 3 to 5 business days while Google confirms it’s you. The guide to planning account recovery covers other ways back in.
• Passwords left switched on. ASD’s steps describe disabling password sign-in once a passkey is set up, where the provider allows it.
• A short wait after adding a key. Google’s page says: “You may need to wait 7 days before a newly added security key is available at sign-in”, and that this delay helps secure the account.
• U2F-only keys. Google notes that passkeys need FIDO2. A key or service that only supports the older standard works as a second step instead.
• Where it comes from. ASD refers to buying from a reputable store.
• Deleting a passkey. Removing a passkey from a key, or from a password manager, doesn’t remove it from the website account. 1Password’s help notes this for its own product, and the same idea applies generally.

Common questions

What is a hardware security key and how does it work?

A hardware security key is a small device, about the size of a house key, that proves it’s really you when you sign in. It’s plugged into a USB port or tapped on a phone, then touched. It holds a private cryptographic key that never leaves the device, and it checks which website is asking, so a look-alike phishing site gets nothing it can reuse. See how security keys work.

Do I need a security key if I already use passkeys?

Not necessarily. ASD says passkeys can be stored on modern Apple and Android phones and tablets or on a FIDO2 security key, and the FIDO Alliance says phishing resistance applies whether or not the keys are bound to hardware. ASD describes a FIDO2 key as providing increased protection of passkeys, useful for the most important accounts, and some employers require keys. See when a security key adds something.

Do I need a backup security key?

ASD’s guidance recommends storing a backup passkey on a second FIDO2 security key, in case the first is lost, stolen or damaged. Google’s help page also says a newly added security key may take 7 days to become available at sign-in, a delay Google says helps secure the account. ASD’s general setup steps, and Google’s steps for adding a key, are in how to set up a security key.

Is a security key better than an authenticator app?

Official sources compare methods for organisations rather than for individuals. ASD’s guidance for organisations says MFA is most effective when one factor uses public key cryptography and is physically separate from the device being used, giving a security key as an example. Microsoft lists FIDO2 security keys among phishing-resistant methods. An authenticator app still adds a second step to accounts without passkeys. MFA methods compared explains Microsoft’s classification.

Can a security key store passkeys?

FIDO2 keys can. Google’s help page says a key must support FIDO2 to create a passkey, while older U2F-only keys work as a second step after a password instead. Makers list capacities of 100 passkeys for Yubico’s Security Key C NFC and YubiKey 5C NFC, and 300 for the Token2 PIN+; the Google pages checked don’t state the Titan key’s capacity. See how the products compare.

What do I do if I lose my security key?

A backup key, recovery phone, recovery email or recovery code is what gets an account back. Google’s page says that without another second step, recovery can take 3 to 5 business days while Google confirms it’s you. ASD’s recommendation of a backup passkey on a second FIDO2 key exists for this situation. Our guide to planning account recovery covers the options.

Where to get official help

ASD’s passkeys guidance is the official Australian reference for individuals, and its MFA guidance for organisations covers workplaces. See also what passkeys are and how they work and how password managers store passkeys.