What Is a YubiKey? Security Keys Explained

You already did the responsible thing: you set up an authenticator app instead of SMS codes. Then a phishing simulation at work (or a too-close-for-comfort fake login page) still got your six-digit code, and now you're wondering what actually stops that. The short answer is a small piece of hardware that costs less than a month of a streaming subscription.

TL;DR

A YubiKey is a small hardware device (USB-A/C or NFC) that proves who you are with a single touch — no code to type, no battery, no app.
Its edge over an authenticator app isn't convenience, it's phishing resistance: the key checks the website's actual domain before it responds, so a lookalike site gets nothing.
A TOTP code from an app can still be phished, because you're the one who has to notice the fake domain — the code works on any site you paste it into.
You don't need one for every login. It matters most for your email, password manager, and any admin/SSH access — the accounts that unlock everything else.
Setup takes under five minutes per account once you have the key in hand.

KEY-STAT: 2 — the number of pieces of information a FIDO2 hardware key checks before it ever responds: the cryptographic challenge, and the exact domain that sent it. Get either wrong and the key stays silent.

What a YubiKey actually is

A YubiKey is a small hardware authentication device made by Yubico, usually about the size of a house key, that plugs into a USB-A or USB-C port or taps against a phone over NFC. It has no battery, no screen, no network connection, and runs no software you have to install or update. You register it once with a service, and from then on, logging in means plugging it in (or tapping it) and pressing the metal contact.

"YubiKey" is a brand name, the way "Kleenex" is used for tissues. The underlying open standard it implements is called FIDO2/WebAuthn, and other manufacturers (Google's Titan Security Key, Feitian, SoloKeys) make FIDO2-compatible hardware too. Everything below applies to any FIDO2 hardware key, not just Yubico's.

How it actually stops phishing

This is the part most explainers skip past, and it's the entire reason a hardware key beats an authenticator app for your most important accounts.

A time-based one-time password (TOTP) — the six-digit code your authenticator app generates — is just a number. It doesn't know or care what website you type it into. If a phishing page looks convincing enough, you can be tricked into typing that code into the attacker's form, and they relay it to the real site within the 30-second window before it expires. You did everything "right" and still lost the account.

A FIDO2 hardware key works differently. When you try to log in, the browser sends the key a cryptographic challenge that includes the requesting site's actual domain. The key signs that challenge using a private key that never leaves the hardware — but only if the domain matches what was registered during setup. Point a lookalike phishing page at the same login flow, and the key checks the domain, finds a mismatch, and produces nothing. There's no code for you to notice is wrong; the hardware notices for you.

Note

This origin-check is why hardware keys are called "phishing-resistant" rather than just "more secure." An authenticator app adds a second factor; a hardware key removes the specific failure mode — a convincing fake page — that phishing attacks rely on.

YubiKey vs. authenticator app vs. passkey

Four ways to add a second factor exist in practice, and they trade off differently on cost, phishing resistance, and what happens if you lose the device.

Method	Phishing-resistant?	Setup cost	If you lose it
SMS code	No — SIM-swappable and phishable	Free	Carrier account recovery, often slow
Authenticator app (TOTP)	No — code can be typed into a fake page	Free	Recovery codes, or re-enrollment per service
Hardware key (FIDO2, e.g. YubiKey)	Yes — domain-bound cryptographic response	€25–€70 per key	Use a registered backup key, or account recovery
Synced passkey (phone/laptop)	Yes — same origin-binding as FIDO2	Free (built into OS)	Recovers via your device's cloud account (iCloud Keychain, Google Password Manager)

A synced passkey gets you the same phishing resistance as a hardware key for free, with one tradeoff: it lives inside your phone or laptop's ecosystem, so losing that device (or being locked out of the associated cloud account) can lock you out too. A hardware key is a separate, portable object you control independently of any device or account — which is exactly why it's the better fit for the handful of accounts that would be catastrophic to lose.

Who actually needs one

Buying a hardware key for every login you have is overkill. The accounts worth the €25–€70 are the ones that, if compromised, unlock everything else:

Your primary email — almost every other account's password reset goes through it.
Your password manager's master account, as covered in our password manager decision guide — one key protects everything stored inside.
SSH and server admin access, if you self-host anything.
Any account holding money or crypto directly.

Everyday logins — a forum account, a streaming service, a newsletter signup — are fine behind an authenticator app. The point isn't to hardware-key everything; it's to put the strongest lock on the doors that open every other door.

Warning

Buy at least two keys and register both wherever possible — one for daily use, one stored somewhere safe as backup. A single key with no backup turns "I lost my key" into "I'm locked out of my email," which is a worse afternoon than any phishing attempt it was protecting against.

What setting one up actually looks like

My own admin and SSH logins run through a hardware key day to day, registered alongside the Vaultwarden instance I run in my homelab. In practice, registration is the same three-step flow on almost every service: open the account's security settings, choose "add a security key," and press the metal contact on the key when the browser prompts for it. No code to copy, no app to switch to.

The one habit worth building immediately: register the backup key in the same sitting as the primary one. Services differ in how easy it is to add a second key after the fact — some make it trivial, others require you to already be logged in on a trusted device — so doing both at once avoids a second, more annoying visit to account settings later.

Tip

Keep the backup key physically separate from the primary — a different room, a bag you take when traveling, or a safe deposit box. The whole point of a backup is that whatever takes out the first key (lost bag, house fire, theft) doesn't also take out the second.

Frequently asked questions

Is a YubiKey better than an authenticator app?

For your highest-value accounts, yes — a hardware key is phishing-resistant in a way a TOTP code from an app fundamentally isn't, because it checks the website's domain before responding. For everyday, lower-value logins, an authenticator app remains a solid, free second factor.

What happens if I lose my YubiKey?

If you registered a second, backup key with the same accounts, you log in with that one and can revoke the lost key from your account settings. Without a backup key registered, you fall back on each service's account-recovery process, which is exactly why buying and registering two keys from the start matters.

Do I need a YubiKey if I already use an authenticator app?

Not for everything — but consider one for your email, password manager, and any admin or SSH access, since those accounts can unlock or reset everything else if compromised. An authenticator app is fine for lower-stakes logins.

Can a YubiKey be hacked?

The private key material never leaves the hardware and can't be extracted over USB or NFC, so remote compromise isn't really the risk. The realistic risk is physical loss or theft, which is why registering a backup key matters more than worrying about the cryptography being broken.

Does a YubiKey work on a phone?

Yes — most current models support NFC, so you tap the key against the back of an NFC-enabled phone instead of plugging it into a port. USB-C models also plug directly into phones that use that port.