# What is a security key?

> A physical device that proves your identity cryptographically and refuses to work on a fake site.

Last reviewed: 2026-09-01

## Security key

Category: Authentication

Also called: hardware key, FIDO2 key, YubiKey

Canonical page: https://moolkey.com/glossary/security-key

A security key is a small physical device that authenticates you using public-key cryptography. Its decisive advantage over every code-based method is origin binding: the key checks the site's actual domain before signing, so a phishing page gets nothing even if you were fully convinced by it.

### Why phishing simply fails against it

Codes can be relayed. If a convincing fake page asks for your six-digit code, you might type it, and the attacker forwards it to the real site within the window. A security key cannot be tricked this way because the signature is tied to the requesting domain. A signature for the fake domain is worthless at the real one.

### The practical trade-offs

You have to carry it, and you should own two: one in use and one stored safely. Losing your only key without a backup method creates a genuine lockout risk. Coverage is also uneven, with strong support on major platforms and patchier support elsewhere.

### Sources

- [W3C: Web Authentication: Level 3](https://www.w3.org/TR/webauthn-3/): The web standard behind passkeys and FIDO2 security keys.
- [FIDO Alliance: Passkeys](https://fidoalliance.org/passkeys/): How device-held key pairs replace shared passwords and resist phishing.
- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [OWASP: Multifactor Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html): A comparison of authentication factors, recovery paths, and common attack routes.