Last updated: October 22, 2026. Key recommendations come from Wirecutter (updated July 22, 2026) and ZDNET, and the security ranking comes from CISA's phishing-resistant MFA fact sheet (October 2022), all read October 22, 2026.
Disclosure: As an Amazon Associate I earn from qualifying purchases. Some links below are affiliate links, which means this site may earn a small commission at no extra cost to you.
Quick answer- A FIDO2 security key is the most phishing-resistant way to sign in, according to CISA, and it can also store passkeys.
- Wirecutter's top pick is the Yubico Security Key C NFC, with the YubiKey 5C NFC as a pricier upgrade for advanced features.
- Buy two keys if you can, enroll both, and keep a second sign-in method in case one is lost.
Passwords and text-message codes are the weak points in most account takeovers, and a physical security key closes many of those gaps. This guide explains why CISA ranks FIDO/WebAuthn at the top, how passkeys and hardware keys fit together, which keys Wirecutter and ZDNET recommend, and how to set up and back up a key. It also covers the limits, so you can decide whether a key is worth buying for your accounts.
1. Why a security key beats codes
CISA's fact sheet on phishing-resistant MFA ranks authentication methods from strongest to weakest. At the top is FIDO/WebAuthn, which CISA calls the gold standard and the only widely available phishing-resistant option. App-based codes and push approvals with number matching come next, but CISA lists them as vulnerable to phishing. SMS and voice codes sit at the bottom: CISA says they should be a last resort because they are open to phishing, SS7 attacks, and SIM swapping.
Wirecutter explains the practical difference. A security key proves its legitimacy to the site cryptographically, so a phishing page that tricks you into typing a password and a code cannot capture what the key does. Keys also need no data connection, and the best ones need no battery.
Both sources add a caveat: any multi-factor authentication is better than none. Wirecutter says that if you are new to MFA, an authenticator app is probably the easier first step because it is free and widely accepted.
2. How passkeys and security keys fit together
Wirecutter describes passkeys as a technology championed by Apple, Google, and Microsoft that aims to replace passwords with digital keys unique to each account. Passkeys cannot be phished, and they can sync across your devices. A hardware key can also store passkeys, which Wirecutter calls a great option for an offline backup or for people who do not want passkeys stored in the cloud.
CISA describes two kinds of WebAuthn authenticators. Roaming authenticators are separate physical tokens that connect by USB or NFC. Platform authenticators are built into laptops or phones. Both can add a PIN or biometric check on top of possession of the device.
For you, that means there are two good paths. You can rely on the passkeys in your phone or computer for everyday sign-ins, and add a hardware key for your most important accounts or as a backup. Look for FIDO2/WebAuthn support in any key you consider. Wirecutter says that support is what allows passwordless sign-in and passkey storage, and it is the newer version of the protocol that powers security keys.
3. Best security keys in 2026
Wirecutter assessed 13 security keys for its latest round and tested them with Google accounts on Windows, macOS, iOS, and Android devices. Its top pick is the Yubico Security Key C NFC, which it calls affordable and compatible with nearly every site and service that supports keys and passkeys. It has USB-C and NFC and can hold up to 100 passkeys. The upgrade pick is the YubiKey 5C NFC, which adds Yubico OTP, OATH codes for up to 64 sites, smart card, and OpenPGP, but Wirecutter notes most people will not need those extras.
| Key | Passkeys stored | Wirecutter note |
|---|
| Yubico Security Key C NFC | Up to 100 | Top pick; USB-C and NFC |
| Yubico YubiKey 5C NFC | 100 | Upgrade pick; more protocols |
| Google Titan Security Key | Up to 250 | Often out of stock; made in China |
| Thetis Pro-C | 200 | Listed at $30; no durability rating |
| Kensington VeriMark NFC+ USB-C | 50 | Listed at $55 |
| GoTrust Idem Key | 30 | Listed at $40 |
ZDNET's 2026 list also names the YubiKey 5C NFC as best overall, at $58 in its table, and lists the Google Titan key at $30 to $35. Prices and stock change, so check the current listing.
4. How to set up a key and back it up
Wirecutter walks through a Google account as an example, and the steps are similar on other sites. On a desktop browser, sign in, open Manage your Google Account, go to Security, then Passkeys and security keys, and choose Create a passkey. Pick Use another device, insert the key, and tap its touch disc. You may be asked to set a PIN, and you can then name the key.
On a phone, Wirecutter says to hold the key near the top of an iPhone, slowly move it across the back of an Android phone until it buzzes, or plug it in directly if it has the right connector.
Enroll a second key the same way and store it somewhere safe. Wirecutter's experts recommend a backup key, which effectively doubles the cost. Many sites also offer backup codes that should be kept in a secure place. Wirecutter's experts warn that enabling phishable backup methods can leave you open to being tricked, so be skeptical of any message claiming you cannot use your security key.
- Enroll your primary key.
- Enroll a backup key and store it separately.
- Save backup codes securely.
5. Limits to know before you buy
Wirecutter lists several drawbacks. Keys cost money, can be lost or damaged, and are not accepted everywhere, so you will likely still need an authenticator app for some sites. Wirecutter also says keys are not immune to every attack, but they are much harder to attack than other 2FA options. Its guide notes that the Yubico Security Key's firmware cannot be upgraded, and that Yubico does not use open-source firmware, though it runs a vulnerability-disclosure program and offers a tool to verify that a new key is genuine.
Wirecutter found biometric keys too expensive and fiddly for practical use after testing several, and it advises against Yubico's enterprise FIPS lines for home users. Shipping charges also ruled out some open-source options in its guide.
CISA suggests starting where the data is most valuable. It points to email as a good first target because most hosted mail and SSO systems support FIDO. If a service you use does not support keys, keep a strong, unique password and an authenticator app there.
Frequently Asked Questions
Are security keys better than authenticator apps?
CISA ranks FIDO/WebAuthn above app-based codes because keys resist phishing. Wirecutter adds that apps are free, widely accepted, and probably easier for beginners, and that any MFA is better than none.
Do I need two security keys?
Wirecutter's experts recommend a backup key, which doubles the cost. Backup codes or another MFA method are free alternatives, but they can be exposed to phishing if you mix methods.
Can a security key store passkeys?
Yes. Wirecutter says the Yubico Security Key C NFC and YubiKey 5C NFC each hold up to 100 passkeys, and the Google Titan key holds up to 250.
Will a key work with my iPhone or Android phone?
Wirecutter says NFC keys work with most modern iOS and Android devices, and USB-C keys can plug into phones with a matching port. It tested its top pick on an iPhone 16 Plus and a Pixel 8 Pro.
Shop These on Amazon
These are general categories; verify FIDO2 support and current prices on the retailer page. Tap a button to see options and current prices on Amazon.
As an Amazon Associate I earn from qualifying purchases.
Resources
Comments
Post a Comment