Best Hardware Security Keys (YubiKey and Alternatives)

If you're learning offensive security, you already understand better than most why SMS-based 2FA is weak — SIM swapping and phishing both defeat it routinely. A hardware key (FIDO2/U2F) is phishing-resistant by design: the key checks the actual domain before authenticating, so even a convincing phishing page can't complete the login.

When to use it

• Your email account — the account that can reset almost every other account
• Your password manager's master account
• Your cloud provider accounts (AWS, GCP, Azure) if you're running lab infrastructure
• GitHub/GitLab, if you're publishing any tooling or code

What to look for

• FIDO2/WebAuthn support at minimum — this is the modern standard most platforms support now
• Buy two — one as a daily driver, one stored safely as backup. Losing your only key to a locked-out account is a real, common problem
• USB-A/USB-C/NFC options depending on what your devices actually support

The YubiKey 5 series is the one we point people to — FIDO2/WebAuthn support, USB-A/USB-C/NFC options across the lineup, and the de facto standard most platforms actually test their 2FA support against.

Common mistakes

• Buying one key and having no backup — if it's lost, recovery can be genuinely painful depending on the platform
• Registering a hardware key but leaving SMS or email-based 2FA enabled as a fallback, which reintroduces the exact weakness you were trying to eliminate
• Not enabling it on the accounts that matter most (email, password manager) while enabling it on lower-value accounts

Next step

Combine this with a password manager that supports hardware key unlock for your vault itself.