What is a security key?
A security key is a small physical device that authenticates you using public-key cryptography. Its decisive advantage over every code-based method is origin binding: the key checks the site's actual domain before signing, so a phishing page gets nothing even if you were fully convinced by it.
- Topic
- Authentication
- Also called
- hardware key, FIDO2 key, YubiKey
- Reading time
- 1 min
- Reviewed
On this page
Why phishing simply fails against it
Codes can be relayed. If a convincing fake page asks for your six-digit code, you might type it, and the attacker forwards it to the real site within the window. A security key cannot be tricked this way because the signature is tied to the requesting domain. A signature for the fake domain is worthless at the real one.
The practical trade-offs
You have to carry it, and you should own two: one in use and one stored safely. Losing your only key without a backup method creates a genuine lockout risk. Coverage is also uneven, with strong support on major platforms and patchier support elsewhere.
Sources
These primary references support the terminology and current security guidance used in this definition.
