Contents
In short
For most people, passkeys on a smartphone are enough. A hardware key is worth it for highly exposed people or as robust protection for the main email account.
What is it?
A security key is a small FIDO2 device. It stores passkeys or acts as a second factor and only works when you plug it in or hold it to your phone.
Who is it useful for?
Useful for people at higher risk – such as public figures – or anyone who wants maximum protection for their most important account.
What does it protect against?
- Credential phishing, because the key checks the genuine address
- Remote attacks on accounts without physical access
What does it not protect against?
- Loss without a second backup key
- Services that do not support security keys
- Malware on the device after sign-in
What you can do for free
- 01Use passkeys on your smartphone or computer
- 02Check which of your services support FIDO2
When is an extra product worth it?
When you want a device-independent, highly phishing-resistant method. Always buy two keys and register both.
What to check when choosing
- FIDO2/WebAuthn support
- The right connector (USB-C, USB-A, NFC)
- Support from your most important services
We deliberately name no products and publish no rankings.
Common mistakes
- Registering only one key
- Not setting up an alternative recovery route
- Leaving the key plugged in permanently
Checklist
- Two keys registered
- Backup key stored safely
- Recovery codes available
Frequently asked questions
Do I need a key if I use passkeys?
Usually not. A key is an additional, device-independent option.
What if I lose the key?
Sign in with the backup key or another method and remove the lost key from the account.
Sources
Checked on 6 Oct 2026.