What to Look for in a Hardware Security Key in 2022

If you’ve been on the internet, then you’ve probably heard of two-factor authentication, usually abbreviated as 2FA. Typically, 2FA involves receiving a code you have to insert after you enter your password correctly. You can receive this code either through an SMS message, an email, or an authenticator app.

Then there are additional features that a hardware security key can provide, such as One-Time Passwords (OTP) through a protocol called OATH TOTP or Yubico OTP. There’s also OpenPGP, which encrypts emails and only allows you to unencrypt them if you have the correct OpenPGP key, adding another layer to secure emails.

As for what to choose exactly, that depends on your needs. If you don’t need OTPs or encrypted emails, then a key that uses FIDO2 is most likely going to cover 90%-100% of the stuff you need it for.

Also, it’s important to make sure you get a key that works with the devices you use. If you mostly want the key for mobile use, then getting one with NFC is the way to go. If you prefer to include biometrics for use with something like Windows Hello, you’ll want a security key with a fingerprint scanner.

So, let’s get into what the best hardware security keys are.

The Yubico Security Key NFC manages to balance all the important bits when it comes to a security key. It doesn’t cost too much, it works with both PCs and mobile devices through NFC, and it supports most MFA systems. There is even a USB-C version for those who need it.

In terms of protocol support, it can handle FIDO U2F and FIDO2, both of which are supported by Google, Twitter, and Microsoft, and a variety of password managers. It’s relatively easy to double-check what it works with before jumping in by checking a database or Googling if the website or service you want to use supports them.

The only real downside is that it doesn’t have the broader support of other security keys on this list. Granted, most people are unlikely to need these features, as the FIDO protocols will cover the most popular sites. In exchange for less advanced protocol support, you get the key cheaper, and that’s a fair trade-off for most.

This key is both crush-resistant and water-resistant, too, so it won’t be easily broken.

Best Overall Security Key

Yubico Security Key NFC

Yubico’s affordable security key exchanges wider protocol support for a lower price. Its supported protocols are used by most sites, software, and services, so that’s a good trade-off for this excellent security key.

Where the YubiKey 5 NFC shines is near-universal protocol support, meaning you aren’t likely to find a website or service that doesn’t work with it in some fashion. This security key is well-suited for those who tend to deal with heavy security and therefore need an all-encompassing key.

Beyond that, there are also some more advanced features that you can access by using the app, such as OpenPGP, a secure signature for authenticating communications, and an advanced form of a one-time password. With the YubiKey 5, you could send an encrypted email through ProtonMail using PGP—but, rather than relying on a public key, you can use the hardware key instead.

Besides that, it has an interesting ‘static password’ feature that essentially functions as an auto-complete when touching the button on the YubiKey 5. You can write in only a fraction of a 32-character password when in a text box and have the YubiKey do the rest of the work for you.

The only real downsides to the YubiKey 5 are its price and that it can be somewhat finicky to use on mobile. The higher price makes sense given the larger number of included features.

Problems with using the key on mobile devices come down to how apps and browsers function on mobile. It’s easy to use the key on a desktop browser—and it works pretty well in a mobile browser, too. However, many mobile apps force you to insert your passwords in an app instead of a browser, and that can cause some issues. However, this isn’t just an issue with the YubiKey 5.

Note: If you’re an iPhone user and want a YubiKey 5, there’s a specific security key made for you called the  YubiKey 5Ci. It has both USB-C and Lightning connectors, so you can use it across all your Apple devices.

Best Premium Security Key

YubiKey 5 NFC USB-A

The YubiKey 5 provides the most comprehensive protocols of any security key out there, as well as some excellent additional features for those who are security conscious.

Best Security Key for Bio-authentication: Kensington VeriMark

One thing that’s missing from YubiKeys that some might find important is a fingerprint scanner. While it may seem like the button on the YubiKey is a biometric one, it’s actually just checking if a human being is pressing the button, rather than some malicious software. In short, it’s similar to reCAPTCHAs that you need to do to prove you’re not a bot.

The Kensington VeriMark is different, however. At just under an inch long, the VeriMark essentially functions as a fingerprint key for your laptop, and there’s even a version made specifically for desktop fingerprint reading.

The VeriMark’s design makes it look like the key is meant to stay put rather than carried around. However, it does have a cap and can survive just fine in your pocket or on a keychain.

When it comes to protocols, it supports FIDO2, and you should be able to use it on most services and apps. It can also be used for Windows Hello—in fact, it seems made for the Windows operating system, considering that the VeriMark can be a bit difficult to get working on Linux and Mac. The instructions are also rather rough around the edges, which might put the less tech-savvy off.

In terms of security, your full fingerprints aren’t saved to the device’s memory. Instead, the Kensington VeriMark creates a template of your fingerprint and tries to match that. What’s especially impressive is that it seems to work from any angle, so Kensington certainly did a good job in both the sensor and its internal security.

The biggest downside of the VeriMark is the lack of NFC, which puts a lot of iPhone users out of its reach unless you go for the desktop version with a USB cable. If you do, though, you’ll likely have to use a Lightning-to-USB adaptor, and that adds a bunch of unnecessary steps.

Another issue is that it’s a bit on the expensive side, coming in at just under $60. While there’s a single-PC-use version for under $40, that’s a steep price for something tied to one device. We think it’s better to spend the extra money and be able to move around with it.

Best Security for Bio-Authentication

Kensington VeriMark Guard

The VeriMark offers the best balance of protocol support, cost, and most importantly, fingerprint scanning that works from nearly any angle.

Best Key & Password Manager Combo: OnlyKey

The CryptoTrust OnlyKey is a bit unique among security keys because it includes a password manager as part of the key. That’s great because it circumvents the possibility of a keylogger getting access to your password since you input the characters for the password on the security key itself.

It’s made even simpler because you only need to press one of the six keys on the OnlyKey to input the password into a text field. In addition to that, you can do both long and short presses for each button, so you can store up to 12 different passwords on it.

If that wasn’t enough, you can even further protect each password with an additional PIN, making the OnlyKey one of the few, if not the only, security key that completely houses three-factor authentication.

As for its 2FA support, it can handle TOTP, Yubico OTP, and FIDO 2 U2F, which should cover the majority of sites and apps out there, as well as offer a bit of future-proofing. There’s also a self-destruct code you can set up. Sadly, the code doesn’t make it explode, but it does wipe the OnlyKey completely.

Unfortunately, it does have a significant downside, which is that the interface is very clunky. That means those who aren’t very tech-savvy might have a hard time when using it and setting everything up. While that may put some off, the advantage and unique features of the OnlyKey make up for any additional hassle you’d need to go through.

The OnlyKey is also lacking NFC and Bluetooth, and is a bit bulkier than the other choices on this list. These aren’t necessarily deal-breakers, but it is something to consider.

Best Key & Password Manager Combo

CryptoTrust OnlyKey

The OnlyKey is unique in that it can handle three-factor authentication completely internally through its onboard password manager. While it’s a bit bulky and the UI is clunky, it’s still an excellent security key.

Best Open-Source Security Key: Nitrokey FIDO2

For many people, open-source is where it’s at. If you’re one of those people, then the Nitrokey FIDO2 is the security key for you. Unfortunately, open-source security keys tend not to have the same features as the proprietary keys we covered above.

Don’t get us wrong—protocol support is pretty comprehensive with FIDO U2F, FIDO2, WebAuthn/CTAP. These cover the majority of services you’d need the key for.

Since it’s open-source, anyone can look at the code for the Nitrokey’s firmware and make sure that it’s up to snuff doesn’t have any vulnerabilities.

While that’s all great, this might not matter much for the average user who wants a user-friendly experience. There’s also the downside—you don’t get NFC with this or a USB-C option, so you’re left with using a USB-A to USB-C adaptor, and if you’re on iPhone, you’ll need to get a USB-A to Lightning cable.

Suffice to say, it can be problematic to use the Nitrokey at any place other than a desktop. You’re not getting a feature like a fingerprint scanner or a password manager for that trade-off.

That may lead some to feel that the Nitrokey is poorly designed, but there’s clearly been some thought put into it—such as being quite sturdy even though it may feel a bit hollow when carried. It also hides both indicator lights and the touch-sensitive button under the plastic, giving it a uniform look and feel, which is nice.

The only thing we would have wished for is a way to attach the cap to the body with a cord since it’s pretty easy to lose the cap.

All in all, while not necessarily the best security key for most users, it’s one of the best keys for those who want an open-source solution.