Most people should buy a FIDO2 security key whose connector fits the devices they actually use, confirm it is FIDO certified, and set up a second key as a backup. Everything else is secondary.
This guide is deliberately short. It covers how to make the choice, not which model to buy, because we could not confirm product specs, prices or capacities against primary sources for this piece. Treat it as a checklist, then verify each item on the maker's own product page before you pay.
Start with the ports on your phone and laptop
The connector is the decision that most often goes wrong, and it is the easiest to get right. Keys come with USB-A, USB-C or NFC, and some combine more than one.
List every device you will sign in from:
- Laptop or desktop: look at the ports. A newer laptop may only have USB-C. An older desktop may only have USB-A.
- Phone: check whether it has a USB-C port and whether it supports NFC. If you want to tap the key against your phone instead of plugging it in, the key needs NFC.
- Work machines: if you sign in on a shared or office computer, check its ports too.
Pick the connector that covers the most devices without an adapter. Adapters work, but they are one more thing to lose. If you are also shopping for a dock, our guide on choosing a USB-C dock covers what to check on the port side.
Check passkey storage only if you will save passkeys on the key
A FIDO2 key can be used two ways: as a second factor after your password, or as a place to store passkeys that sign you in on their own. Storage capacity only matters for the second use.
If you plan to keep many passkeys on the key itself, look up how many the model can hold on the manufacturer's spec page. If you only use the key as a second step, capacity is not something to pay extra for.
Passkeys can also live on your phone or in a password manager rather than on a hardware key. If you are weighing that route, read what happens to your Google passkey if you lose your phone.
Confirm FIDO certification before you buy
Search it for the exact model name before buying, especially for cheaper or unfamiliar brands.
What to ignore
- Marketing claims about being "unhackable". Look for certification instead.
- Bundles of accessories you will not use. Match the connector to your devices and skip the rest.
- Capacity numbers, if you only use the key as a second factor.
How the choice changes by need
| If you mainly... | Look for |
|---|---|
| Sign in on a USB-C laptop and phone | USB-C |
| Use an older desktop | USB-A |
| Want to tap the key on your phone | NFC |
| Use a mix of old and new devices | A key with more than one connector, or two different keys |
| Want to store passkeys on the key | Check stated passkey capacity |
Set up a backup key the same day
A single key is a single point of failure. If you lose it and have no other sign-in method, recovering your account can be slow. Register a second key on every account where you register the first, and keep it somewhere separate.
For Google accounts, start from Google's security key help page to add your keys. While you are in your account settings, it is also a good time to review which apps can access your Google account.
The recommendation
Buy two FIDO-certified keys with the connector that fits most of your devices, add NFC if you want to use the key with your phone by tapping, and only pay for extra passkey storage if you will actually keep passkeys on the key. Check each spec on the maker's own page, since we could not verify individual models for this guide.
