Security keys: who actually needs a YubiKey
A security key is a small device that you plug in or tap to sign in, and CISA ranks it as the strongest form of multifactor authentication. It costs about $29 to $58 per key from Yubico, and you need at least two, so it is worth it mainly for account owners, administrators, and anyone who controls money or a domain name.
Do you need a security key?
Most people do not, but the people who run a small business often should. A security key, such as a YubiKey from Yubico or Google’s Titan key, is the method the US Cybersecurity and Infrastructure Security Agency ranks first in its guidance on multifactor authentication, because it cannot be phished in the way a code can. It belongs in our guide to two-step sign-in as the top option, with two conditions: you buy at least two, and you register both.
Think of it as the deadbolt on the doors that matter most: the email account that resets everything, the domain registrar, the bank, and the administrator accounts of your Microsoft 365 or Google Workspace.
What a security key does
A modern security key stores passkeys in hardware and proves your identity when you touch it, either plugged into a USB port or held against a phone that supports NFC. The keys from Yubico and Google described here follow the FIDO2 and WebAuthn standards, and also work as an older-style second factor (U2F) on services that do not yet support passkeys. The key only answers to the website it was registered with, which is what makes it resistant to fake login pages.
Yubico sells two families, according to its product pages:
- the YubiKey 5 series, which handles FIDO2 passkeys plus older protocols, can hold authenticator codes for 64 accounts, and supports smart card (PIV) and OpenPGP uses;
- the Security Key series, which handles only FIDO2 and U2F, with no codes.
On the current firmware (5.8), both families store up to 100 passkeys per key. Google says its Titan keys store about 250.
What they cost
Prices on Yubico’s own store, checked on November 10, 2026:
| Model | Connector | US store | UK store (incl. VAT) |
|---|---|---|---|
| YubiKey 5 NFC | USB-A and NFC | $58 | £60 |
| YubiKey 5C NFC | USB-C and NFC | $58 | £60 |
| YubiKey 5Ci | USB-C and Lightning | $85 | Not checked |
| YubiKey 5C, 5C Nano or 5 Nano | USB-C or USB-A | $65 to $68 | Not checked |
| Security Key NFC or C NFC | USB-A or USB-C, and NFC | $29 | £30 |
Yubico’s Canadian store showed prices in US dollars, and its Australian store showed US dollars including GST: $63.80 for the YubiKey 5C NFC and $31.90 for the Security Key NFC. We could not read the prices of Google’s Titan keys on the Google Store. For most small businesses, two Security Keys at $29 each cover the passkey and second-factor uses; the YubiKey 5 series makes sense if you also want codes or smart card features on the key.
Why you need two keys
A single key is a single point of failure: lose it and you fall back on your other recovery options, or none. Every provider says so in its own way:
- Apple requires at least two keys, and allows up to six, to protect an Apple Account with security keys, on iOS 16.3, iPadOS 16.3, or macOS Ventura 13.2 or later. It warns that losing all your trusted devices and keys could lock you out permanently.
- Google sets no minimum, but recommends a primary key and at least one backup in its Advanced Protection Program, and suggests keeping an extra key in a safe place.
- Yubico suggests one or two spare keys, registered at the same time as the main one.
Keep the spare somewhere other than your desk: a locked drawer at home, or with a trusted partner in the business.
Where you can use one
- Google Account: any FIDO1 or FIDO2 key works for 2-Step Verification, and a FIDO2 key can hold a passkey. Google says a newly added key may take up to seven days to appear at sign-in.
- Apple Account: any FIDO Certified key, with the two-key minimum above. Child accounts and Managed Apple Accounts are not supported.
- Microsoft account: you can save a passkey for a personal Microsoft account on a physical security key, according to Microsoft’s help pages.
- Other services: password managers, cloud services, and domain registrars may accept keys too; check the security settings of each account.
Who benefits most
- The owner or administrator of your Microsoft 365 or Google Workspace.
- Whoever controls the domain registrar and the business bank account.
- People who travel, use shared networks, or are likely targets because of their role or visibility.
- Anyone who has already been phished once.
For everyone else, an authenticator app or a passkey on a phone gives most of the benefit at no cost.
Passkeys without a key
A passkey stored on your phone or in a password manager offers much of the same protection against fake login pages, without buying anything. Read what passkeys are and how they compare with passwords before deciding.
If you lose a key
With a spare registered, losing a key is an inconvenience. Our page on recovering access when a device goes missing covers what to do next, account by account.