Passkeys and hardware security keys explained
A passkey is a sign-in key made for one website and stored on your phone, computer or a small hardware security key. You unlock it with your fingerprint, face or PIN, and there is nothing to type, so a fake website has nothing to steal. Passkeys and security keys are the strongest everyday protection against phishing, and the UK National Cyber Security Centre (NCSC) now recommends passkeys wherever a service offers them. This article explains how they work, when a hardware key is worth having, and how to avoid locking yourself out.
Passwords and codes can be phished
Two-factor authentication with an app or text-message code is a big step up from a password alone. But a convincing fake login page can ask for your password and then your code, and pass both to the real site within seconds. The NCSC calls every traditional method, including app codes, SMS and push approvals, "inherently phishable". The US cybersecurity agency CISA says the only widely available phishing-resistant sign-in is FIDO, the standard behind passkeys and security keys.
What a passkey is
A passkey is a pair of cryptographic keys created for one website when you register:
- The private key stays with you, on your device or security key, protected by your device's own unlock: fingerprint, face, PIN or pattern.
- The website keeps only the public key. If the website is breached, there is no password to steal, and the public key cannot be used to sign in.
When you sign in, the website sends a challenge, your device signs it with the private key after you unlock it, and the website checks the signature. Technically, passkeys are built on two open standards, the W3C's WebAuthn for browsers and the FIDO Alliance's CTAP for the devices that hold the keys. Together they are called FIDO2.
Why a fake site cannot use it
Each passkey is tied to the domain of the website that created it. When a site asks for a passkey, the browser tells your device which site is asking. A passkey made for your bank's real website will not answer a look-alike site, however convincing it looks, and there is no code for you to type into the wrong page.
That is why NIST, the US standards body, classes FIDO2 as phishing-resistant and codes typed by hand as not. It is also why CISA calls phishing-resistant sign-in the "gold standard".
Synced passkeys and hardware security keys
Passkeys come in two kinds:
| Synced passkey | Hardware security key | |
|---|---|---|
| Where it lives | In a passkey provider, copied across your devices with end-to-end encryption | On one small USB or NFC device, and never leaves it |
| If you lose a device | Your other devices still have it | That key's passkeys are gone, unless you registered a spare |
| Can it be copied? | Yes, by design, between your devices | No |
| Best for | Most accounts, most people | The accounts that control everything else |
NIST accepts synced passkeys for most purposes, provided the sync account itself is protected with two-factor authentication. For its highest level of assurance, it requires a key that cannot be exported, which is what a hardware security key provides. The NCSC makes the same point in a different way: with synced passkeys, the protection of the sync account is what matters.
In practice, we suggest synced passkeys for everyday accounts, and a hardware key for the few accounts that can reset everything else: your main email, your domain registrar, your hosting account, your password manager, and your bank where it supports one.
Choosing a security key
Look for:
- FIDO2 support, not only the older U2F standard, so it can hold passkeys.
- The right connector: USB-C or USB-A for your computers, and NFC if you want to tap it on a phone.
- A PIN. Set one. Yubico, for example, ships its keys with no FIDO2 PIN set.
- Enough space. A key holds a limited number of passkeys: Yubico's current YubiKey 5 firmware stores up to 100.
Yubico's YubiKey is the best-known range. If you prefer open source, Nitrokey, made in Germany, publishes the hardware and firmware of its keys as free software. Noiz does not sell security keys; buy from the manufacturer or an authorised reseller.
Keeping passkeys in a password manager
You do not have to rely on your phone maker's system to store synced passkeys. Two open-source password managers store them too:
- KeePassXC (GPL 3.0) stores passkeys in your own encrypted database file through its browser extension, and can export and import them. The passkeys are as safe as that file and its master password, so keep encrypted backups of it.
- Bitwarden stores passkeys on every plan, including the free one, and includes them in its exports. Its mobile apps can move passkeys between providers using the FIDO Alliance's credential exchange format.
Do not lock yourself out
The strength of a hardware key, that it cannot be copied, is also its risk. The NCSC notes that a credential on a single device cannot be recovered if the device is lost, unless you registered another.
- Register two keys, or one key plus a synced passkey, on every important account. Yubico itself recommends registering a spare at the same time as the first.
- Keep the spare somewhere safe, away from the first.
- Keep the account's recovery codes offline, printed or written down.
- Check the list of passkeys on your important accounts now and then, and remove any you do not recognise. The NCSC warns that an attacker who gets in may add their own to keep access.
- Remove weaker sign-in methods where the service lets you. While SMS codes remain an option, an attacker can steer you towards them.
What passkeys do not fix
Passkeys protect the moment you sign in. They do not protect a session that malware steals from your browser after you have signed in, and they cannot protect a device that is already infected. Our article on infostealer malware explains how that works. Account recovery is also a weak point: the NCSC expects attackers to target recovery routes, such as a reset by text message, as passkeys spread.
Where to start
- Your main email account. Add a passkey, or a security key, today.
- The accounts that can reset others: password manager, domain registrar, hosting account.
- Everything else that offers passkeys, over time.
For accounts that do not offer passkeys yet, use an authenticator app, which is far better than a password alone.
Private Email, our managed Mailcow service, includes two-factor sign-in for users. If you would like to talk through two-factor sign-in for your team's Noiz services, open a ticket.
Sources
Checked 19 October 2026.
Standards and guidance
- FIDO Alliance, Passkeys
- W3C, Web Authentication Level 3
- passkeys.dev, Terms
- NIST SP 800-63B-4, Authentication and authenticator management
- CISA, Implementing phishing-resistant MFA (PDF)
- NCSC, Passkeys are more secure than traditional ways to log in (April 2026)
- NCSC, Traditional user and FIDO2 credentials: personal use
- Google, Fighting cookie theft using device-bound sessions
Security keys
- Yubico, FIDO specifics for the YubiKey 5 and firmware 5.7
- Yubico, Spare keys
- Nitrokey products and FIDO2 documentation
Password managers
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
