What Do I Need to Have a Physical Security Passkey

A physical passkey is usually a small hardware security key that stores your sign-in credential. But before you buy one, check how your account uses it. A service may accept the key as a passkey, allow it only as a two-factor security key, or reject it completely.

That difference matters. The best hardware security key for one account may not work for another.

What a physical passkey is

A physical passkey is a passkey kept on a hardware device instead of on your phone or computer. The device is often a small USB security key. You connect it to your device, or touch it when asked, during sign-in.

Passkeys are designed to replace passwords. They use the security key to prove that you have the approved device. The account service then checks the key without asking you to type the passkey itself.

Some hardware keys can store passkeys separately from the passkeys saved on your phone or computer. That can be useful if you want a sign-in method that isn't tied to one particular device.

But “physical passkey” and “physical security key” don't always mean the same thing in practice:

• As a passkey: The hardware key stores a passkey and can replace your password during sign-in.
• As two-factor authentication: You still sign in with a password, then use the hardware key as a second step.
• Not supported: The account doesn't accept that type of hardware key at all.

A key that works for two-factor authentication may not work as a password replacement. So the first question isn't “Which key should I buy?” It's “What does my account provider support?”

What you need before setting one up

Use this checklist before ordering a device or starting the setup:

• An account with a security key or passkey option
• A hardware key that meets the service's required standards
• A compatible connection, such as a USB port, if the service requires one
• Administrator approval for some work or school accounts
• A second key if you want a backup and the service allows more than one

The account requirement comes first. A physical key won't add much if the provider supports only phone or computer passkeys.

Look in the account's security settings for labels such as:

• Passkeys
• Security keys
• Hardware security keys
• Two-step verification
• Multifactor authentication
• FIDO security key

The wording can vary. A “security key” setting may mean two-factor authentication rather than a password-free passkey. If the provider's help page doesn't make that clear, check whether it says the key can replace your password or only serve as an extra verification step.

You may also need access to your current sign-in method. Many services ask you to prove who you are before adding a new key. That could mean entering your password, using an existing verification method, or completing another account recovery step.

For a work or school account, ask the administrator before buying anything. Some organizational Microsoft setups require the key to be approved by the organization. The key may also need to meet both FIDO2 and Microsoft compliance requirements.

The hardware that can work as a physical security key

A physical security key is a small device made for account sign-in. A physical security key USB model plugs into a USB port when you register or use it. Some keys also offer another way to communicate with a device, but the service and key need to support the same method.

Examples include the Google Titan Security Key and the Yubico Security Key family. These are examples of hardware security keys, not a guarantee that every version will work with every account.

Before you buy, check:

1. The connector or connection method your phone or computer can use.
2. The standards supported by the key.
3. Whether your service accepts it as a passkey, two-factor key, or both.
4. Whether an organization must approve it.
5. Whether you need one key or a spare.

Don't assume that every USB key works everywhere. The USB shape only tells you how the device connects. It doesn't tell you which sign-in methods or services will accept it.

A key may be physically compatible with your computer but still fail at the account level. For example, it might connect correctly yet be accepted only for two-factor authentication, while you wanted a password-free passkey.

If you're comparing the Google Titan Security Key with a Yubico Security Key, start with your account provider's requirements rather than brand reputation. The right choice is the one that supports the standards and sign-in method your account actually uses.

FIDO, FIDO2, and Microsoft compatibility requirements

FIDO is a group of standards for secure sign-in without relying only on passwords. Services can use these standards to work with hardware security keys.

FIDO2 is a newer part of that system. It supports modern passwordless sign-in and passkey-style credentials, along with other security-key uses.

You don't need to understand every technical detail to choose a key. You do need to match the service's requirement. A provider may say that it accepts:

• FIDO security keys
• FIDO2 security keys
• Hardware passkeys
• Security keys for two-step verification

Those terms aren't always interchangeable. A service that requires FIDO2 may not accept an older key that supports a different FIDO method. A service that accepts FIDO for two-factor authentication may not offer hardware keys as password-replacing passkeys.

Login.gov, for example, requires security keys that meet FIDO standards. That requirement tells you to look for a compatible FIDO key before you try to register one.

Microsoft account setups can add another layer. If the account belongs to an organization, the administrator may need to approve the security key. The key may also have to be both FIDO2-compliant and Microsoft-compliant. A personal account and an organization-managed account may therefore have different rules.

The practical check is simple: write down the exact standard named by the provider, then compare it with the key's specifications. If the provider says “FIDO2,” don't buy a device described only as a general USB security token.

How to check whether your service accepts the key

This is the step people often skip. It can save you from buying a key that cannot do what you want.

Open the account's security or sign-in settings and look for the supported authentication methods. Then answer these questions:

Does the service accept a hardware key?

Some services support hardware keys. Others support only passkeys stored on phones, computers, or password managers. Some support both.

If you see only “add a passkey” and no mention of security keys, the service may still support a hardware key—but don't assume it does. Look for instructions that specifically mention a USB or FIDO security key.

Is the key a passkey or a second factor?

Read the setup description closely.

If the flow asks you to create a passkey and then use the key, the hardware device may store a passkey that can replace your password.

If the flow first asks for your password and then tells you to insert or touch a key, the device is being used as two-factor authentication.

Both options improve account security. They simply work differently at login.

Does the service require a particular standard?

Check whether it requires FIDO, FIDO2, or another named feature. Login.gov requires a key that meets FIDO standards. An organization-managed Microsoft account may require both FIDO2 and Microsoft compliance, along with administrator approval.

Can you add more than one key?

Look for an option to add another security key after the first one is registered. Login.gov allows users to add multiple security keys, for example. This can help you keep a spare ready.

If the provider's instructions are unclear, don't guess based on the key's brand. Follow the provider's current requirements.

How to set up and use a physical security key

The exact buttons and labels change from one service to another, but the basic process is usually similar.

1. Sign in to your account. Use your existing password or another approved sign-in method.
2. Open security settings. Find passkeys, security keys, two-step verification, or multifactor authentication.
3. Choose the hardware-key option. Select the option that matches what you want: a passkey or a two-factor security key.
4. Start registration. The service will ask you to name the key or confirm that you want to add it.
5. Insert or connect the key. Use the required USB connection, if applicable.
6. Touch or activate the key when prompted. Many security-key registrations require a touch to confirm that a person is holding the device.
7. Finish the on-screen steps. The provider will save the key to your account.
8. Test it. Sign out or open a separate sign-in window and check that the key works as expected.

The most important part is step three. Choose the correct account option. A setup for two-factor security may not create a physical passkey, even if it uses the same kind of device.

If the service asks you to create a PIN for the key, follow its instructions and store that PIN safely. If it reports that the key is unsupported, check the service's required standards before trying again. Repeating the same setup with the same device usually won't fix a compatibility problem.

For a work account, the setup may stop until an administrator approves the key. That isn't necessarily a fault with the device. It may be an organization rule.

Why you may want more than one security key

A hardware key can be easy to carry, but it can also be lost, damaged, or left somewhere else. If it is your only way into an account, that can create a recovery problem.

When the service supports multiple keys, add a second one during setup. Keep it in a safe place separate from your everyday key. You can then use the spare if the first key disappears.

A useful setup might include:

• One key you carry or use regularly
• One backup key stored somewhere secure
• Another approved sign-in or recovery method, if the provider offers one

Don't wait until your main key is missing to think about backups. You may need the original key, an existing passkey, or another verification method to add a replacement.

Physical passkeys versus phone or computer passkeys

A phone or computer passkey is stored on, or managed through, that device. It can be convenient because the device is already with you. A physical passkey keeps the credential on a separate hardware key instead.

Here are the main differences:

A hardware key can be useful if you want a separate sign-in device or need to meet an organization's security-key policy. A phone or computer passkey may be simpler for everyday use.

The choice also depends on what the service supports. Some providers accept hardware keys as passkeys. Some accept them only for two-factor authentication. Some don't accept them at all.

So, how do you get a physical passkey? Choose a hardware security key that the provider accepts for passkey sign-in, then register it through the account's security settings. If the provider supports only security keys for two-factor authentication, it can still be useful—but it won't replace your password in the same way.

Before buying a key, check your account provider's supported standards and authentication options, then add a backup key if the service allows it.