If you want the strongest account protection available, it fits on a keyring: a hardware security key. Unlike codes that can be phished or intercepted, a physical key proves it is really you in a way attackers cannot fake remotely. Our GetMyPassword team explains how to set up and use a security key like a YubiKey, and how to do it without ever locking yourself out.
What a security key is
A security key is a small physical device — it plugs into USB or taps via NFC — that serves as your second factor when logging in. Instead of typing a code, you insert or tap the key to confirm. Because the login is tied to the real website and requires the physical key, it is resistant to phishing: a fake site cannot complete the check, even if you are fooled into trying.
How to set one up
- In your account’s Security settings, open two-factor authentication and choose “Add a security key.”
- Insert or tap the key when prompted, and touch its button to register it.
- Give it a name, and confirm two-factor authentication is now on.
- Register a second, backup key while you are there.
The golden rule: get a backup key
The one mistake to avoid is owning a single key. If it is lost, you could be locked out. So buy two keys and register both on your important accounts, then keep the spare somewhere safe at home. Save any recovery codes the site offers as well. With a backup in place, a hardware key is all upside.
A security key is the gold standard precisely because it cannot be phished — a fake site has no way to use it. The only real risk is losing your only key, which is why the rule is simple: always own two.
Where to use it, with a strong password
Put your security key on the accounts that matter most: email, banking, crypto and work logins. A hardware key is the second factor; the first is still a strong password, so give each account a unique one from our password generator. Together — a unique password plus a physical key — they form the toughest everyday protection a personal account can have.
Frequently asked questions
How do I set up a security key like a YubiKey?
In your account’s security settings, open two-factor authentication, choose “Add a security key,” then insert or tap the key and touch its button to register it. Register a second backup key at the same time.
What happens if I lose my security key?
If you registered a backup key or saved recovery codes, you simply use those to get in and remove the lost key. This is why owning two keys, or keeping recovery codes, is essential before relying on one.
Is a security key better than an authenticator app?
For security, yes. A hardware key is phishing-resistant because the login is tied to the real site and needs the physical key, which a fake page cannot use. An authenticator app is still strong and a great option where keys are not supported.