YubiKey or Nitrokey? How to Choose a Security Key
A security key stops phishing from stealing your logins. USB-C or USB-A, NFC for phones, closed or open firmware, and why you should always buy two.
In short: Buy two keys with the plug your devices use (USB-C for most current laptops and phones) and NFC if you sign in on a phone. A YubiKey 5 supports the most services and protocols; a Nitrokey 3 has open-source firmware you can update. Register both keys on every account and store one somewhere safe.
A password can be phished. A code from an authenticator app can be phished too: a fake login page simply asks for it and passes it on. A hardware security key cannot, because it checks the address of the site asking and refuses to answer a lookalike. For your email, your exchange accounts and anything that can reset other passwords, it is the strongest second factor you can buy.
What a security key does
- Two-factor sign-in (FIDO2 and U2F). After your password, you touch the key. The key signs a challenge that only works for the real site.
- Passkeys. Many services now let the key replace the password entirely. A key can hold a limited number of passkeys, so check the maker's figure if you plan to store many.
- More, on some models. One-time passwords, smart card functions and OpenPGP for signing and decrypting email.
Choosing the plug
| Your devices | Choose |
|---|---|
| Current laptops and Android phones, recent iPhones | USB-C, such as the YubiKey 5C NFC |
| Older computers with only USB-A ports | USB-A, such as the YubiKey 5 NFC |
| Phones without a matching port | Any key with NFC, held to the back of the phone |
All three keys we carry have NFC, so a phone can use them without a cable.
YubiKey or Nitrokey?
- YubiKey 5 series. The most widely supported keys, with FIDO2, one-time passwords, smart card and OpenPGP in one device. Their firmware cannot be updated: a key keeps the firmware it was made with, which removes a whole class of attacks but also means new features need a new key.
- Nitrokey 3. Open-source firmware and hardware, designed in Germany, with firmware you can update. A good choice if being able to read the code your key runs matters to you.
Either one protects you against phishing. The difference is in extra features and philosophy, not in how safe your logins are.
Always buy two
A key you lose is an account you may not get back. Register two keys on every account that supports them, keep one on your key ring and the other somewhere safe at home. Most services let you add both in the same security settings page. Write down the recovery codes each service gives you and store them with the spare key.
Setting up
- Sign in to the account and open its security or two-factor settings.
- Choose "security key" or "passkey", insert or tap the key, and touch it when it blinks.
- Repeat with the second key.
- Only then remove weaker methods like text-message codes, where the service allows it.
Buying one privately
We buy security keys sealed from the maker and ship them ourselves, in a plain box, so the maker never gets your address. Pay in any coin we accept, within 1 hour. If you also keep coins, a hardware wallet is the other half of the setup, and every key and wallet we sell is under wallets and security keys.