Choose a physical FIDO2 security key if an important account lets you register one and you can use it on the computers where you sign in without your phone. Check the account settings, workplace permissions and available USB or NFC connections before choosing a key, and set up a permitted backup route before relying on it. A passkey on a trusted personal device may meet your needs instead, but it will not help when that device is unavailable.
If you sign in to an important account from a shared or borrowed computer, a physical key is worth considering when the account, browser and computer support it. For a work or school Microsoft account, the administrator must also enable security-key sign-in.
The National Cyber Security Centre identifies unreliable mobile connectivity and places where phones cannot be used as reasons to consider a roaming FIDO2 key. You still need a connection method that works with the devices you expect to use.
If losing a key would leave you unable to sign in, arrange a permitted recovery method before depending on it. Apple requires at least two compatible keys for its Apple Account security-key feature; other accounts have their own backup options.
For important accounts you need to access without your phone, check whether the account accepts a key before deciding how to connect it. Then make sure you have a way back in if the key is unavailable.
| Concern | What to check | Who this matters to |
|---|---|---|
| Account compatibility | Check each account’s security settings for security-key or hardware-passkey registration. For work or school accounts, confirm that an administrator permits the method. | If I sign in to a work account on a shared computer, I need to know it will accept my key; around 36% of consumers put account compatibility first. |
| Recovery if a key is lost | Register and test a permitted backup method. Check whether the account lets you add a second key and remove a lost one. | I do not want one missing key to keep me out of an important account; for around 29% of consumers, a recovery route is the primary concern. |
| Device connections | Match USB-A or USB-C to the computers you will use. If you need NFC, check the device, operating system and sign-in flow. | A key that connects to my laptop may not connect to the shared desktop I use elsewhere; around 21% of consumers put connection flexibility first. |
| Whether to carry a key | Check whether your accounts offer passkeys and whether your trusted device or credential manager will be available when you sign in. | If I can use my trusted personal device, I may not need another item to carry; around 14% of consumers put that decision ahead of choosing a physical key. |
A USB connector, NFC and FIDO2 support on the key do not enable security-key sign-in on an account that does not offer it. Workplace settings can also restrict the option.
Open the security settings of each account you need to use, and ask your administrator about work or school accounts before choosing a key.
A lost key can leave you dependent on the account’s recovery process. Apple warns that losing all trusted devices and security keys can permanently lock you out of an Apple Account using its security-key feature.
Register and test a permitted backup method before travelling. Where the service allows it, register a second key and keep it separately.
A USB-C key will not plug directly into a USB-A-only computer, and NFC works only where the device and sign-in flow support it.
Check the ports, browsers and operating systems of the computers you actually use, including shared ones. Verify the exact mobile connection method if you plan to use one.
Yubico describes its Security Key C NFC as FIDO-only, while its YubiKey 5C NFC supports additional functions including OATH, PIV and OpenPGP. They are not interchangeable when an account or workflow needs one of those functions.
Identify the sign-in method each account requires. Consider additional protocols only if you have a specific use for them.
Relevant if you are comparing a FIDO-only key with a model that supports additional authentication protocols.
Relevant if a Google Account is a priority and you are choosing between USB-C/NFC and USB-A/NFC key variants.
Relevant if you are considering a USB-and-NFC FIDO2/U2F key for compatible computers and mobile devices.
Google Accounts, personal Microsoft accounts and Apple Accounts offer security-key options under their respective setup conditions. For a work or school Microsoft account, an administrator may need to enable the method. Check the security settings of the exact account you intend to use before buying.
Have a tested backup route before relying on one key. Apple requires at least two FIDO Certified keys for its Apple Account security-key feature, while Google advises an additional way to prove your identity or an extra key. Check what your own account allows and store any backup key separately.
A USB-C key will not plug directly into a USB-A-only port. A suitable adapter may provide a connection if you can use one there, but the browser and account must also support the security-key flow. NFC is another possibility only on a compatible device and sign-in flow.
Not necessarily: a passkey on a trusted personal device may cover the sign-ins you need. The National Cyber Security Centre recommends passkeys over passwords where available. Consider a physical key if you also need to sign in from a compatible shared computer or somewhere your trusted device cannot be used.