This post contains affiliate links. If you buy through them, Securely Sorted may earn a commission at no extra cost to you. As an Amazon Associate, we earn from qualifying purchases. Learn more.
Most account hacks start with a fake login page that tricks you into typing your password and a text-message code. A security key is a small device, about the size of a house key, that makes that trick useless. It’s one of the strongest protections available, and it costs less than a dinner out.
What a security key does
When you log in to a supported account, you plug in the key (or tap it on your phone) instead of typing a code. The key checks that it’s talking to the real website before it answers. A fake site can’t get a response, so even if you fall for a convincing phishing page, the attacker gets nothing.
Security keys use an open standard called FIDO2. They also work as passkeys, the newer password-free way to sign in.
Who should get one
- Anyone whose email or social accounts would be a big problem to lose
- Small business owners, especially for email, banking, and admin accounts
- Creators with valuable YouTube, Instagram, or TikTok accounts (a common hacking target)
- People who’ve been hacked before or receive a lot of phishing attempts
Where they work
Major services support security keys, including Google, Microsoft, Apple accounts, Facebook, X, Dropbox, and many password managers and banks.
Which one to buy
| Key | Best for | Where to buy |
|---|---|---|
| YubiKey 5C NFC | Newer laptops and phones with USB-C; tap-to-use on phones | Check price on Amazon |
| YubiKey 5 NFC | Older computers with USB-A ports | Check price on Amazon |
| Yubico Security Key series | Budget option for everyday accounts (fewer advanced features) | Check price on Amazon |
| Google Titan Security Key | People mostly in the Google ecosystem | Check price on Amazon |
Always buy two
Register a main key and a backup key on every account, and keep the backup somewhere safe at home. If you lose one, you’re not locked out. Also save each account’s backup codes in your password manager.
How to set one up (5 minutes per account)
- Go to the account’s security settings (look for “2-Step Verification,” “Security keys,” or “Passkeys”).
- Choose Add security key.
- Insert or tap the key when asked, and touch its button.
- Repeat with your backup key.
- Start with your main email, then banking, then social media.
Setting one up on a single account takes about five minutes once you’re in the right settings menu. The honest time cost is doing it for every account that matters, so pace yourself: start with email, since that’s usually the account a hacker can use to reset everything else.
The bottom line
Text-message codes are better than nothing, but they can be phished. A security key can’t be. For the price of two keys, you can make your most important accounts dramatically harder to steal.
Sources: FIDO Alliance: Passkeys, CISA: Turn On MFA, Yubico.