YubiKey and Hardware Security Keys: The Guide

"Yubikey" gets typed into Google roughly 50,000 times a month, and a large share of those searches come from people who don't yet know what they're looking for — a coworker mentioned one, a security warning suggested one, or a "protect your account" checklist told them to buy one without explaining why. If that's you, this page is the map, not another ranked list.

What a hardware security key actually is

It's a small physical device — USB-A, USB-C, or NFC — that you tap or plug in to prove a login attempt is really you. Instead of typing a code that a phishing site could steal and replay, the key performs a cryptographic handshake tied to the exact website you're on, so a fake login page simply can't complete it. That's the core advantage over SMS codes and even authenticator apps: it isn't phishable the same way.

Do you actually need one?

If you have accounts worth protecting hard — primary email, admin access to servers, work single sign-on, cryptocurrency — a hardware key closes a real gap that SMS and even app-based codes leave open. I run a Proxmox homelab and use a YubiKey 5C NFC daily for SSH login and 2FA on my main accounts; it's the one security purchase I'd make again without hesitation. It replaced juggling a phone authenticator app every time I SSH into a server, and it's one tap instead of typing a six-digit code correctly before it expires. If your accounts are mostly casual logins with nothing catastrophic behind them, a free authenticator app is a reasonable stopping point, and you don't need to keep reading — come back if that ever changes.

The 6-question decision map

This table is the actual point of this page — match your situation to the article that answers it, instead of reading all six in order.

If you're here because...	Read this next
You're brand new to this and want the full explanation	What Is a YubiKey? Security Keys Explained
You already bought one and need to set it up	How to Set Up a YubiKey: 2FA and SSH
You're comparing YubiKey's own models (5 NFC, 5C, Nano, Bio)	YubiKey 5 Series: Which Model Do You Need?
You want options besides YubiKey itself	YubiKey Alternatives Worth Considering
You keep getting prompted to "create a passkey" and aren't sure if that replaces this	Passkey vs Security Key: Which to Use?
You just want to be told which one to buy	Best Hardware Security Key: A Decision Guide

The short version of each guide in this series

What it is (full guide): a hardware key replaces "something you know" (a password) with "something you have" — a physical object that can't be phished remotely the way a code can.

Setting one up (full guide): registering a key takes under five minutes per account, and SSH key auth setup takes maybe fifteen more — both walked through step by step with real commands.

Which YubiKey model (full guide): the 5 Series splits by connector (USB-A, USB-C, Nano) and whether you need fingerprint auth (Bio) — the comparison table there matches model to device.

Non-YubiKey alternatives (full guide): Google Titan, Nitrokey 3, and others trade protocol breadth for price — worth reading if €69 for a 5C NFC feels steep for what you actually need.

Passkeys vs a physical key (full guide): passkeys are convenient but usually synced to one ecosystem (Apple, Google, Microsoft) — a physical key stays portable across all of them and isn't lost if your phone is.

The final decision (full guide): a scenario-matched table — SSH/OpenPGP users, casual web-login users, non-technical family members, and backup-key buyers each get a different answer.

Where hardware keys fit in your broader security setup

A hardware key is one leg of a practical personal-security stack, not the whole thing. Pair it with a password manager so weak, reused passwords aren't still your fallback everywhere a key isn't required, and with basic home network security so the device you're typing from isn't already compromised. None of the three replaces the other two — a hardware key stops phishing on the accounts it protects, a password manager stops reuse everywhere else, and a locked-down home network stops the device itself from being the weak point none of the above can fix.

Frequently asked questions

What is a YubiKey used for?

Proving you're really you when logging in — as a second factor alongside a password, or as passwordless login on sites that support it. It also handles SSH key authentication and OpenPGP signing on the models that support those protocols.

Which hardware security key should I buy first?

If you're not sure yet, start with our decision guide — it matches your devices, protocols, and budget to a specific model instead of naming one "best" key for everyone.

Do I still need a YubiKey if I use passkeys?

Often yes. Most passkeys sync within one ecosystem (Apple, Google, or Microsoft) — if you lose your phone or switch ecosystems, a synced passkey can strand you. A physical key stays portable and works as an independent backup. See our full comparison.

Are there cheaper alternatives to YubiKey that still work well?

Yes — Google Titan and Yubico's own Security Key C NFC line cost around $30 and cover FIDO2/passkeys, though they drop SSH and OpenPGP support. See alternatives worth considering for the full tradeoff list.