Hardware security keys for two-factor authentication can make account sign-ins more resistant to phishing, but the right choice depends on device ports, supported services, and how you plan to handle backups. I’d put the Yubico YubiKey 5C first for its broad protocol support and USB-C fit, while the Yubico Security Key NFC stands out for USB-A and phone tap-in convenience, and the Thetis Pro USB-A, USB-C, and NFC offers flexible connection options. The main tradeoff is between broad account support and a simpler FIDO-focused key, with size, phone compatibility, and backup planning also shaping the decision. Read on for a comparison of all 15 picks and guidance on matching a key to your devices and accounts.
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Complete the kit
Key Takeaways
- Protocol support separates the broadest-use picks: the YubiKey 5C and YubiKey 5 NFC offer more than FIDO sign-in, while several Thetis and TrustKey models focus on FIDO2 and U2F.
- Connection type can matter as much as brand: USB-C keys suit newer laptops and phones, USB-A remains useful on older computers, and NFC can simplify compatible phone sign-ins.
- A two-key plan is more resilient than relying on one key: the Thetis USB-A 2-Pack directly supports keeping a spare, though buyers should register both keys with each service.
- Small keys trade handling convenience for a less obtrusive fit: Thetis Nano-A and Nano-C suit compact setups, while folding or covered designs protect the connector but add bulk.
- Special features need a use case: Bluetooth, PinPlex, and PUF technology distinguish select models, but buyers should check service and device support before choosing them over a straightforward FIDO key.
| Symantec VIP K10S Hardware Authenticator, USB-A Security Key |  | Best for Symantec VIP HOTP Users | Brand: Symantec VIP | Model: K10S | Manufacturer: Feitian Technologies | VIEW LATEST PRICE | See Our Full Breakdown |
| SecuX PUFido Clife USB-C Security Key with PUF Technology |  | Best for Hardware-Rooted USB-C Security | Brand: SecuX | Model: PUFido Clife Key | Interface: USB Type-C | VIEW LATEST PRICE | See Our Full Breakdown |
| Thetis Nano-A FIDO2 USB-A Security Key |  | Best for Passkey and OATH-TOTP Capacity | Brand: Thetis | Model: Nano A (MB000510) | Interface: USB 2.0, USB Type-A | VIEW LATEST PRICE | See Our Full Breakdown |
| Thetis FIDO2 Security Key with Folding USB-A Design |  | Best for Connector Protection | Authentication: FIDO2, U2F, HOTP | Interface: USB Type-A | Design: Folding, rotating aluminum alloy cover | VIEW LATEST PRICE | See Our Full Breakdown |
| TrustKey T120 USB-C FIDO2 and U2F Security Key |  | Best for PIN-and-Touch USB-C Authentication | Brand: TrustKey | Model: T120 (eTA120) | Authentication: FIDO2 and U2F; PIN and touch; non-biometric | VIEW LATEST PRICE | See Our Full Breakdown |
| Yubico YubiKey 5C USB-C Security Key |  | Best for Advanced Authentication | Brand: Yubico | Model: Y-243 | Connection: USB-C | VIEW LATEST PRICE | See Our Full Breakdown |
| Thetis FIDO2 Security Key, USB-A, 2-Pack |  | Best Spare-Key Bundle | Brand: Thetis | Model: MB000516 | Pack size: 2 keys | VIEW LATEST PRICE | See Our Full Breakdown |
| Thetis Pro FIDO2 Security Key with PinPlex |  | Best for Multi-Device Flexibility | Brand: Thetis | Model: Thetis Pro FIDO2 Security Key with PinPlex | Connectors: USB-A and USB-C | VIEW LATEST PRICE | See Our Full Breakdown |
| TrustKey T110 FIDO2 and U2F USB-A Security Key |  | Best Simple USB-A Pick | Brand: TrustKey | Model: T110 | Authentication standards: FIDO2 and U2F | VIEW LATEST PRICE | See Our Full Breakdown |
| Yubico Security Key NFC, USB-A and NFC Authentication Key |  | Best for Phone-and-Computer Sign-In | Brand: Yubico | Connectivity: USB-A and NFC | Authentication protocols: FIDO2/WebAuthn, FIDO U2F | VIEW LATEST PRICE | See Our Full Breakdown |
| Thetis FIDO2 and U2F Bluetooth Security Key, USB-A, Black |  | Best for Bluetooth Mobile Access | Authentication protocols: FIDO2, U2F, HOTP | Connector: USB-A | Wireless connectivity: Bluetooth Low Energy | VIEW LATEST PRICE | See Our Full Breakdown |
| Yubico YubiKey 5 NFC USB-A Security Key | | Best for Broad Protocol Support | Connections: USB-A, NFC | Authentication protocols: FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, PIV, OpenPGP | Operating systems: Linux, macOS | VIEW LATEST PRICE | See Our Full Breakdown |
| Thetis Pro FIDO2 Security Key with USB-A, USB-C, and NFC |  | Best for Mixed-Port Devices | Authentication: FIDO2 | Hardware interfaces: USB-A, USB-C, NFC | NFC support: Mobile authentication only | VIEW LATEST PRICE | See Our Full Breakdown |
| Thetis Nano-C FIDO2 USB-C Security Key |  | Best Compact USB-C Pick | Interface: USB Type-C | Dimensions: 0.73 × 0.60 × 0.30 inches | FIDO2 passkey slots: 200 | VIEW LATEST PRICE | See Our Full Breakdown |
| Thetis FIDO U2F USB-A Security Key with Folding Aluminum Cover |  | Best for Basic U2F Two-Factor Authentication | Authentication protocol: FIDO U2F | Interface: USB Type-A | Compatible operating systems: Windows, macOS, Linux | VIEW LATEST PRICE | See Our Full Breakdown |
| hardware security keys for two-factor authentication | Model | Dimensions | Brand | Interface |
|---|---|---|---|---|
| Symantec VIP K10S Hardware Aut | K10S | 0.59 × 0.51 × 0.1 in | Symantec VIP | USB Type-A |
| SecuX PUFido Clife USB-C Secur | PUFido Clife Key | — | SecuX | USB Type-C |
| Thetis Nano-A FIDO2 USB-A Secu | Nano A (MB000510) | 0.25 × 0.74 × 0.25 in | Thetis | USB 2.0, USB Type-A |
| Thetis FIDO2 Security Key with | — | 0.39 × 0.59 × 1.73 in | — | USB Type-A |
| TrustKey T120 USB-C FIDO2 and | T120 (eTA120) | 1.6 × 0.7 × 0.18 in | TrustKey | USB Type-C |
| Yubico YubiKey 5C USB-C Securi | Y-243 | 0.49 × 1.16 × 0.2 inches | Yubico | — |
| Thetis FIDO2 Security Key | MB000516 | — | Thetis | — |
| Thetis Pro FIDO2 Security Key | Thetis Pro FIDO2 Security Key with PinPlex | 2.8 × 0.7 × 0.5 inches | Thetis | — |
| TrustKey T110 FIDO2 and U2F US | T110 | — | TrustKey | USB-A |
| Yubico Security Key NFC | — | — | Yubico | — |
| Thetis FIDO2 and U2F Bluetooth | MB000385 | — | — | — |
| Yubico YubiKey 5 NFC USB-A Sec | YubiKey 5 NFC | 0.71 x 1.77 x 0.13 inches | — | — |
| Thetis Pro FIDO2 Security Key | — | 2.9 x 0.72 x 0.5 inches | — | — |
| Thetis Nano-C FIDO2 USB-C Secu | — | 0.73 × 0.60 × 0.30 inches | — | USB Type-C |
| Thetis FIDO U2F USB-A Security | — | 1.75 × 0.6 × 0.3 inches | — | USB Type-A |
More Details on Our Top Picks
Symantec VIP K10S Hardware Authenticator, USB-A Security Key
The Symantec VIP K10S suits buyers who need both a physical security key and a one-touch code generator. It supports FIDO U2F for compatible sign-ins and event-based OATH HOTP, which produces a six-digit code through Symantec VIP Access. That second method gives it a different role from the SecuX PUFido Clife and TrustKey T120, which focus on FIDO2/U2F security-key authentication rather than the K10S’s specific VIP code workflow. Its tiny, lightweight body is easy to carry, and the listed setup does not require software installation for its security-key use. The tradeoff is a narrower fit: HOTP depends on Symantec VIP Access, and the USB-A connector excludes devices without that port or an adapter. Buyers seeking current FIDO2 passkey support should choose another option.
Pros:- Combines FIDO U2F with event-based OATH HOTP
- Generates a six-digit code with one touch
- Security-key use does not require software installation
- Very small and lightweight
Cons:- HOTP functionality requires Symantec VIP Access
- USB-A connector may need an adapter for newer devices
- Does not list FIDO2 passkey support
Best for: People whose accounts use Symantec VIP and who want a compact USB-A key that also generates HOTP codes.
Not ideal for: Buyers seeking FIDO2 passkey support, USB-C connectivity, or HOTP codes independent of Symantec VIP Access.
- Brand:Symantec VIP
- Model:K10S
- Manufacturer:Feitian Technologies
- Authentication:FIDO U2F and OATH HOTP
- Interface:USB Type-A
- Dimensions:0.59 × 0.51 × 0.1 in
- Weight:0.6 g
- Warranty:1 year
Our verdict“Choose the K10S if Symantec VIP HOTP is part of your sign-in routine; choose the SecuX PUFido Clife or TrustKey T120 for FIDO2-focused authentication.”
SecuX PUFido Clife USB-C Security Key with PUF Technology
The SecuX PUFido Clife is a strong match for buyers who want a compact USB-C key with FIDO2 and U2F support across computers and mobile operating systems. FIDO2 can support phishing-resistant sign-in and passwordless access on compatible services, while its stated PUF technology provides a hardware-rooted security anchor. Compared with the TrustKey T120, which emphasizes PIN-and-touch authentication and lists specific browser support, the PUFido Clife foregrounds its PUF design and broad operating-system compatibility. That makes it appealing to security-minded users who move between Windows, macOS, Linux, iOS, and Android. Its chief practical drawback is not unique to its security features: losing a single key can complicate account recovery, so a registered spare is sensible. USB-C also limits direct use with older USB-A-only computers.
Pros:- FIDO2 and U2F support for compatible services
- PUF technology provides a hardware-rooted security anchor
- USB-C design is compact and portable
- Works with Windows, macOS, Linux, iOS, and Android
Cons:- A spare key is recommended in case the primary key is lost
- USB-C connection may require an adapter for older computers
- FIDO2 features depend on service support
Best for: Security-conscious users with USB-C devices who want FIDO2/U2F authentication across desktop and mobile operating systems.
Not ideal for: People using USB-A-only computers or anyone unwilling to register and keep a backup key for account recovery.
- Brand:SecuX
- Model:PUFido Clife Key
- Interface:USB Type-C
- Certifications:FIDO2, U2F
- Compatible devices:Windows, macOS, Linux, iOS, Android
- Security technology:PUF
- Color:Black
- Warranty:1 year
Our verdict“Pick the PUFido Clife for a portable, PUF-equipped USB-C FIDO2/U2F key, and favor the TrustKey T120 if its explicit PIN-and-touch approach better fits your needs.”
Thetis Nano-A FIDO2 USB-A Security Key
The Thetis Nano-A stands out for combining a small USB-A form with room for 200 FIDO2 passkeys and 50 OATH-TOTP entries. That gives it a broader account-management role than the Symantec VIP K10S, which centers on U2F and Symantec’s HOTP workflow, and makes it a useful pick for people building a larger passkey collection. It supports FIDO2, WebAuthn, and CTAP2 alongside OATH-TOTP, with compatibility listed for Windows, macOS, iOS, Android, Linux, and Chrome OS. Those protocols can help reduce password reliance, but individual websites must support the relevant sign-in method. The compact body suits a keychain or a port that stays available, yet its USB-A plug is less convenient for USB-C-only devices. Buyers who need flexible physical connections may prefer a multi-interface alternative in the roundup.
Pros:- Stores up to 200 FIDO2 passkeys
- Provides 50 OATH-TOTP slots
- Supports FIDO2, WebAuthn, and CTAP2
- Compatibility spans desktop and mobile operating systems
Cons:- Requires a USB-A port or compatible adapter
- Passkey availability depends on each service
- Its account capacity may be unnecessary for users with only a few protected logins
Best for: USB-A users managing multiple compatible passkey and OATH-TOTP accounts across several operating systems.
Not ideal for: People with USB-C-only devices or buyers expecting every website to accept passkeys or OATH-TOTP.
- Brand:Thetis
- Model:Nano A (MB000510)
- Interface:USB 2.0, USB Type-A
- Authentication:FIDO2, WebAuthn, CTAP2, OATH-TOTP
- Passkey slots:200
- OATH-TOTP slots:50
- Compatible operating systems:Windows, macOS, iOS, Android, Linux, Chrome OS
- Dimensions:0.25 × 0.74 × 0.25 in
- Weight:14.2 g
Our verdict“Choose the Nano-A if you want substantial passkey and OATH-TOTP capacity in a USB-A key; choose the SecuX PUFido Clife for a USB-C connection instead.”
Thetis FIDO2 Security Key with Folding USB-A Design
The Thetis FIDO2 Security Key pairs FIDO2 and HOTP authentication with a rotating aluminum cover that shields its USB-A connector when carried. That protective design gives it a practical advantage over the uncovered Thetis Nano-A for people who keep a key in a bag or attach it to everyday gear. It also retains U2F compatibility, which helps with older sites that have not adopted FIDO2. The main qualification is platform-specific: the supplied details state that FIDO2 does not support Mac login, and Windows Hello login is limited to Azure Active Directory enterprise users. Those restrictions matter if the goal is signing into the computer itself rather than authenticating to compatible online services. The folding form is portable, but USB-A still limits direct connection to newer USB-C-only devices.
Pros:- Rotating aluminum cover protects the USB-A connector
- Supports FIDO2, U2F, and HOTP
- Backward compatibility supports U2F websites
- Folding design is suited to portable use
Cons:- FIDO2 does not support Mac login
- Windows Hello support is limited to Azure Active Directory enterprise users
- USB-A may require an adapter on newer devices
Best for: USB-A users who carry a security key loose or on a keychain and want a cover plus FIDO2, U2F, and HOTP support.
Not ideal for: Mac buyers seeking FIDO2 computer login, non-enterprise Windows Hello users, or people whose devices lack USB-A.
- Authentication:FIDO2, U2F, HOTP
- Interface:USB Type-A
- Design:Folding, rotating aluminum alloy cover
- Compatible systems:Windows, macOS, Linux, Chrome OS
- Color:Black
- Dimensions:0.39 × 0.59 × 1.73 in
- Read speed:480 bytes per second
- Write speed:480 bytes per second
Our verdict“Choose this Thetis model if connector protection matters and its platform limits fit your setup; the Nano-A offers more listed passkey and OATH-TOTP capacity.”
TrustKey T120 USB-C FIDO2 and U2F Security Key
The TrustKey T120 keeps its pitch straightforward: USB-C access to FIDO2 and U2F, with a PIN and touch rather than biometric authentication. That makes it a clear fit for buyers who want a deliberate physical confirmation step on compatible accounts. Compared with the SecuX PUFido Clife, which highlights PUF technology and broader mobile operating-system compatibility, the T120 lists Windows, macOS, and Linux support and names browsers including Chrome, Firefox, and Edge. It also calls out services such as Google, Microsoft, GitHub, Dropbox, and Apple, giving buyers useful compatibility starting points. Its limitations are plain: it requires USB-C, and users seeking fingerprint-based confirmation will not find it here. As with other security keys, the website or service must support the relevant authentication standard.
Pros:- FIDO2 and U2F support
- PIN and touch provide non-biometric confirmation
- Lists compatibility with major browsers and services
- Lightweight body at 2.9 g
Cons:- Requires a USB-C port
- Does not provide biometric authentication
- Listed compatible systems do not include iOS or Android
Best for: USB-C laptop and desktop users who want FIDO2/U2F sign-in with a PIN-and-touch step and use supported major services.
Not ideal for: People who need USB-A, listed iOS or Android compatibility, or biometric authentication.
- Brand:TrustKey
- Model:T120 (eTA120)
- Authentication:FIDO2 and U2F; PIN and touch; non-biometric
- Interface:USB Type-C
- Compatible systems:Windows, macOS, Linux
- Compatible browsers:Chrome, Firefox, Edge, and other major browsers
- Dimensions:1.6 × 0.7 × 0.18 in
- Weight:2.9 g
- Color:Black
Our verdict“Choose the T120 for simple PIN-and-touch FIDO2/U2F use on USB-C computers; choose the PUFido Clife if PUF technology or listed mobile OS compatibility matters more.”
Yubico YubiKey 5C USB-C Security Key
The YubiKey 5C suits buyers who want more than a passkey and two-factor key: alongside FIDO2/WebAuthn and U2F, it supports OTP, smart-card certificates, and OpenPGP. That range makes it a more flexible choice for people who need one compact key across personal accounts and work systems. Compared with the Yubico Security Key NFC, it covers more authentication methods, but gives up that model’s NFC access for phones and tablets. Its USB-C connector also makes port compatibility a real factor; it will not plug directly into USB-A devices. The waterproof, crush-resistant build and lack of batteries or network requirements suit everyday carry, though I’d recommend keeping a spare to reduce lockout risk if the key is lost.
Pros:- Supports FIDO2/WebAuthn, U2F, OTP, PIV smart-card, and OpenPGP protocols
- Works with passkeys and many popular online accounts
- Waterproof and crush-resistant construction
- Requires no battery, internet connection, or ongoing service
Cons:- Requires a compatible USB-C port or an adapter
- A spare key is advisable to reduce the chance of account lockout
Best for: USB-C laptop owners who want passkeys plus OTP, smart-card, or OpenPGP support in one key
Not ideal for: People who need NFC sign-in on phones or have only USB-A ports
- Brand:Yubico
- Model:Y-243
- Connection:USB-C
- Protocols:FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, PIV, OpenPGP
- Operating systems:Windows, macOS, ChromeOS, Linux
- Weight:0.2 ounces
- Dimensions:0.49 × 1.16 × 0.2 inches
- Durability:Waterproof and crush-resistant
Our verdict“Choose the YubiKey 5C if you want broad authentication support on USB-C and do not need NFC.”
Thetis FIDO2 Security Key, USB-A, 2-Pack
The two-key pack addresses a practical weakness of hardware-based two-factor authentication: losing your only key can complicate account recovery. Both keys support FIDO2 passkeys and hardware authentication, and their rotating metal covers add protection when carried on a keychain. Compared with the TrustKey T110, this set gives you a ready backup and lists passkey and OATH slot capacities, but both options are USB-A and lack NFC. That means phone sign-in by tap is off the table. Thetis also lists specific limits: Windows Hello requires supported Enterprise editions with Entra ID, and ID Austria is unsupported. This bundle is best for buyers with USB-A devices who want a primary key and a separate backup, not for those seeking broad mobile convenience.
Pros:- Includes two keys, making it easier to keep a separate backup
- Supports FIDO2 passkeys and hardware-based authentication
- Rotating metal cover is described as water-, crush-, and tamper-resistant
- Works without batteries or a network connection
Cons:- No NFC support for tap-based mobile authentication
- Windows Hello login has specific Enterprise and Entra ID requirements
- Not compatible with ID Austria
Best for: USB-A users who want a second FIDO2 key ready for backup or use on another device
Not ideal for: People who rely on NFC for mobile sign-in or need Windows Hello outside the specified Enterprise and Entra ID setup
- Brand:Thetis
- Model:MB000516
- Pack size:2 keys
- Connector:USB Type-A
- FIDO2 certification:Level 1
- Passkey slots:200
- OATH slots:50
- NFC:Not supported
Our verdict“Pick this set if you want two USB-A FIDO2 keys and can live without NFC.”
Thetis Pro FIDO2 Security Key with PinPlex
For households or professionals moving between older computers, newer USB-C laptops, and phones, the Thetis Pro offers the widest connection mix in this group: USB-A, USB-C, and NFC. Its FIDO2/U2F support covers passkey and hardware-key sign-in, while PIV, TOTP, and HOTP add methods absent from simpler keys such as the Yubico Security Key NFC. That breadth is useful only when the relevant services and platforms support it, so compatibility checks matter before purchase. The listed Windows Hello limits are especially relevant: Enterprise with Entra ID is required, and ID Austria is unsupported. It is also larger than a minimal plug-in key, making it less suited to buyers who want the smallest possible keychain option.
Pros:- Offers USB-A, USB-C, and NFC connections
- Supports FIDO2, U2F, WebAuthn, and CTAP2
- Adds PIV certificates and TOTP/HOTP authentication
- Lists compatibility with Windows, macOS, Linux, Chrome OS, Android, and iPhone
Cons:- Service and platform compatibility should be checked before purchase
- Windows Hello login requires Enterprise edition with Entra ID
- Does not support ID Austria
Best for: People who need one key for USB-A and USB-C computers plus NFC-capable mobile devices
Not ideal for: Buyers seeking a simple FIDO-only key or Windows Hello support outside the stated Enterprise and Entra ID requirements
- Brand:Thetis
- Model:Thetis Pro FIDO2 Security Key with PinPlex
- Connectors:USB-A and USB-C
- Wireless connectivity:NFC
- Authentication standards:FIDO2, FIDO U2F, WebAuthn, CTAP2
- Additional authentication:PIV, TOTP, HOTP
- Compatible operating systems:Windows, macOS, Linux, Chrome OS
- Dimensions:2.8 × 0.7 × 0.5 inches
Our verdict“Choose the Thetis Pro when you need multiple connection types and authentication methods, and are prepared to check platform support.”
TrustKey T110 FIDO2 and U2F USB-A Security Key
The TrustKey T110 keeps its job focused: it provides FIDO2 and U2F sign-in with a PIN and physical touch, without adding authentication methods that many buyers may not need. That straightforward approach makes it a cleaner fit for everyday account protection than the multi-protocol Yubico YubiKey 5C, which is better suited to people who also need OTP, PIV, or OpenPGP. The T110’s USB-A connector works with compatible computers, but it is a limitation for newer USB-C-only laptops and mobile devices without an adapter. It is non-biometric, so authentication depends on PIN and touch rather than a fingerprint. Buyers wanting a simple hardware key for supported services should find its scope clear; anyone needing NFC or broader protocol support should compare other options.
Pros:- Supports FIDO2 and U2F authentication
- Uses PIN and physical touch for sign-in
- Compatible with Windows, macOS, Linux, and major browsers
- Lightweight at 3.1 g
Cons:- Requires a USB-A port or an adapter
- Does not include biometric authentication
Best for: USB-A computer users who want PIN-and-touch FIDO2/U2F sign-in without extra protocols
Not ideal for: People who need NFC, USB-C connectivity, or biometric authentication
- Brand:TrustKey
- Model:T110
- Authentication standards:FIDO2 and U2F
- Interface:USB-A
- Authentication method:PIN and touch; non-biometric
- Compatible devices:Personal computers, smartphones, and tablets
- Compatible operating systems:Windows, macOS, Linux
- Weight:3.1 g
Our verdict“Choose the T110 for a focused USB-A FIDO2/U2F key with PIN-and-touch authentication.”
Yubico Security Key NFC, USB-A and NFC Authentication Key
The Yubico Security Key NFC makes sense for buyers who want phishing-resistant FIDO2/WebAuthn and U2F sign-in across a USB-A computer and an NFC-capable mobile device. A tap can avoid the need to find a port or carry an adapter, setting it apart from the USB-A-only TrustKey T110. The focus is narrower than the YubiKey 5C: this model supports up to 100 passkey slots but does not handle one-time passwords or work with the Yubico Authenticator app. That keeps its role centered on compatible passkey and security-key logins rather than serving as a general-purpose authentication token. Its water- and crush-resistant construction suits daily carry, and it needs no battery or internet connection.
Pros:- Supports USB-A and NFC authentication
- Provides FIDO2/WebAuthn and FIDO U2F sign-in
- Stores up to 100 passkeys
- Water-resistant and crush-resistant, with no battery or internet requirement
Cons:- Does not support one-time passwords
- Not compatible with the Yubico Authenticator app
- USB-A connection may require an adapter for USB-C-only devices
Best for: People who use USB-A computers and NFC-capable phones or tablets for compatible passkey sign-in
Not ideal for: Buyers who need OTP support, Yubico Authenticator compatibility, or a USB-C connector
- Brand:Yubico
- Connectivity:USB-A and NFC
- Authentication protocols:FIDO2/WebAuthn, FIDO U2F
- Passkey slots:100
- Compatible devices:Desktop, laptop, mobile, tablet
- Build:Water-resistant and crush-resistant
- Power and network:No batteries or internet connection required
Our verdict“Choose this Yubico key if NFC phone access matters more than OTP or broader authentication support.”
Thetis FIDO2 and U2F Bluetooth Security Key, USB-A, Black
The Thetis FIDO2 and U2F Bluetooth Security Key stands out for buyers who want more than a USB-A key: Bluetooth and NFC give compatible phones ways to authenticate without plugging in. It also supports FIDO2, U2F, and HOTP, covering newer passwordless sign-in alongside older authentication methods. Compared with the USB-only Thetis FIDO U2F USB-A Security Key, this model offers broader protocol support and mobile connectivity, but that flexibility comes with compatibility limits. FIDO2 cannot be used for Mac login, and Windows Hello access is restricted to enterprise users with Azure Active Directory. The rotating aluminum cover protects the connector when carried, though buyers seeking USB-C should look instead at the Thetis Pro FIDO2 Security Key. This is the better fit for mixed phone-and-computer use, not a universal laptop-login key.
Pros:- Supports FIDO2, U2F, and HOTP authentication
- Bluetooth and NFC provide mobile authentication options
- Rotating aluminum cover helps shield the USB-A connector
- Works with Windows, macOS, and Linux for supported uses
Cons:- FIDO2 does not support Mac login
- Windows Hello access requires an enterprise Azure Active Directory account
- USB-A connector does not fit USB-C-only devices without an adapter
Best for: People who use compatible iPhone or Android devices and want Bluetooth or NFC authentication alongside USB-A access.
Not ideal for: Mac users who need FIDO2 for computer login, or Windows users who want Windows Hello without an enterprise Azure Active Directory account.
- Authentication protocols:FIDO2, U2F, HOTP
- Connector:USB-A
- Wireless connectivity:Bluetooth Low Energy
- NFC:Supported on iOS and Android
- Compatible operating systems:Windows, macOS, Linux
- Construction:Rotating aluminum alloy cover
- Model:MB000385
- Warranty:1 year
Our verdict“Choose this Thetis if Bluetooth and NFC phone access matter more than broad FIDO2 computer-login compatibility.”
Yubico YubiKey 5 NFC USB-A Security Key
The Yubico YubiKey 5 NFC is the most versatile choice here for buyers who need one key to work across several authentication standards. Alongside FIDO2/WebAuthn and U2F, it supports Yubico OTP, OATH-TOTP/HOTP, PIV, and OpenPGP, giving it uses beyond signing in to websites. USB-A and NFC cover computers and compatible mobile devices, while its battery-free, offline operation avoids charging and network dependence. Compared with the FIDO2-focused Thetis Pro FIDO2 Security Key, the YubiKey offers a wider protocol mix but lacks that model’s USB-C connector. Its broad capabilities may be unnecessary for someone who only needs a basic second factor, and losing the key can disrupt account access unless a spare or recovery method is ready. Choose it for breadth, not simplicity.
Pros:- Supports a broad set of authentication standards, including FIDO2/WebAuthn, U2F, OTP, PIV, and OpenPGP
- USB-A and NFC support computer and compatible mobile authentication
- Runs without batteries or an internet connection
- Small, lightweight form factor
Cons:- USB-A may require an adapter for newer USB-C-only devices
- A spare key or account recovery plan is needed to reduce lockout risk if it is lost
- Its extra protocols may be unnecessary for users seeking only basic two-factor authentication
Best for: Security-conscious users managing accounts and workflows that need several standards, including FIDO2, OTP, PIV, or OpenPGP.
Not ideal for: People who want only a simple FIDO2 key, or users whose devices have USB-C ports and no USB-A connection or adapter.
- Connections:USB-A, NFC
- Authentication protocols:FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, PIV, OpenPGP
- Operating systems:Linux, macOS
- Model:YubiKey 5 NFC
- Model number:Y-237
- Weight:0.1 ounces
- Dimensions:0.71 x 1.77 x 0.13 inches
- Color:Black
Our verdict“Pick the YubiKey 5 NFC if you want one USB-A and NFC key for a wider range of authentication standards than the FIDO2-focused alternatives.”
Thetis Pro FIDO2 Security Key with USB-A, USB-C, and NFC
With USB-A, USB-C, and mobile NFC, the Thetis Pro is a strong match for households or workplaces that move between older computers, newer laptops, and compatible phones. Its FIDO2 support handles passwordless sign-in and two-factor authentication without batteries or a network connection, while the rotating cover protects the connector during carry. Compared with the Thetis FIDO2 and U2F Bluetooth Security Key, this model adds USB-C and a water-resistant design, but it lists FIDO2 rather than that key’s FIDO2, U2F, and HOTP combination. NFC has a specific boundary: it is for mobile authentication, not MacOS or Windows. Windows Hello also requires a supported Windows Enterprise edition. Buyers who want a tiny USB-C-only key may prefer the Thetis Nano-C; this larger, dual-connector option is for flexibility across ports.
Pros:- USB-A and USB-C support a wider range of computer ports
- NFC adds authentication on compatible mobile devices
- Rotating metal cover and water-resistant design suit portable use
- FIDO2 operation requires no battery or network connection
Cons:- NFC does not support authentication on MacOS or Windows
- Windows Hello login requires a supported Windows Enterprise edition
- Does not support ID Austria
Best for: People who switch between USB-A and USB-C computers and want NFC authentication on compatible mobile devices.
Not ideal for: Buyers who need NFC authentication on a computer, Windows Hello on a standard Windows edition, or a very small USB-C-only key.
- Authentication:FIDO2
- Hardware interfaces:USB-A, USB-C, NFC
- NFC support:Mobile authentication only
- Supported operating systems:Windows, MacOS, Linux, Chrome OS
- Dimensions:2.9 x 0.72 x 0.5 inches
- Weight:1 ounce
- Power:No battery required
- Connectivity:No network connection required
Our verdict“Choose the Thetis Pro if you need both USB connector types and mobile NFC, and can work within its platform-specific limits.”
Thetis Nano-C FIDO2 USB-C Security Key
The Thetis Nano-C is the most compact choice in this group for someone who wants a key that stays with a USB-C device or keychain. It supports FIDO2 passkeys and OATH-TOTP, so it can cover passwordless sign-in and a separate one-time-password method when a service supports them. Its 200 FIDO2 passkey slots and 50 OATH-TOTP slots offer room for multiple credentials, although actual service support still varies. Compared with the dual-port Thetis Pro FIDO2 Security Key, this model is smaller and USB-C-only; it gives up USB-A and NFC flexibility in return. Windows Hello access is limited to Enterprise edition with Entra ID, and ID Austria is unsupported. Choose it for a compact USB-C setup, not for the broadest connection options.
Pros:- Compact dimensions make it suitable for portable use or a keychain
- Supports FIDO2 passkeys and passwordless sign-in on compatible services
- Includes 200 FIDO2 passkey slots and 50 OATH-TOTP slots
- Supports Windows, macOS, iOS, Android, Linux, and Chrome OS
Cons:- USB-C-only connection excludes devices without USB-C unless an adapter is used
- Passkey availability depends on each website or service
- Windows Hello requires Enterprise edition with Entra ID, and ID Austria is unsupported
Best for: USB-C laptop and phone users who want a compact key for FIDO2 passkeys and OATH-TOTP credentials.
Not ideal for: People who regularly use USB-A computers, need NFC authentication, or rely on Windows Hello outside Enterprise edition with Entra ID.
- Interface:USB Type-C
- Dimensions:0.73 × 0.60 × 0.30 inches
- FIDO2 passkey slots:200
- OATH-TOTP slots:50
- Compatible operating systems:Windows, macOS, iOS, Android, Linux, Chrome OS
- Authentication:FIDO2 and OATH-TOTP
- Color:Black
- Unit count:1
Our verdict“Choose the Nano-C if a small USB-C key with FIDO2 and OATH-TOTP matters more than NFC or USB-A compatibility.”
Thetis FIDO U2F USB-A Security Key with Folding Aluminum Cover
This Thetis key is a straightforward pick for buyers who need U2F second-factor authentication on supported websites and want a protective cover for a USB-A connector. Its compact aluminum body works with Windows, macOS, and Linux, and it avoids the protocol complexity of the Yubico YubiKey 5 NFC. That simplicity is also its main limitation: it supports U2F only, with no OTP or UAF, and it does not add the FIDO2 passwordless sign-in found on the Thetis Nano-C. Browser support is listed for Chrome and Opera 40 or later, so buyers should check that their services and browser setup accept U2F. It is not intended for authentication through email clients such as Apple Mail, Thunderbird, or Outlook. Choose it for a narrow, established U2F use case rather than future-facing flexibility.
Pros:- Adds U2F as a second factor on supported websites
- Compatible with Windows, macOS, and Linux
- 360-degree rotating aluminum cover protects the connector
- Compact size is easy to carry
Cons:- Supports U2F only, with no OTP or UAF
- Does not provide FIDO2 passwordless authentication
- Not compatible with email clients such as Apple Mail, Thunderbird, or Outlook
Best for: Users who want a compact USB-A key for U2F on supported websites and compatible Chrome or Opera browsers.
Not ideal for: People who need FIDO2 passkeys, OTP methods, USB-C, or authentication through email clients.
- Authentication protocol:FIDO U2F
- Interface:USB Type-A
- Compatible operating systems:Windows, macOS, Linux
- Supported browsers:Chrome; Opera version 40 or later
- Cover:360° rotating metal cover
- Material:Aluminum alloy
- Dimensions:1.75 × 0.6 × 0.3 inches
- Color:Black
Our verdict“Choose this key only if U2F on supported websites is all you need; pick the Thetis Nano-C for FIDO2 passkeys or the YubiKey 5 NFC for more protocols.”
How We Picked
I compared the 15 keys on the factors that shape two-factor authentication in daily use: supported authentication standards, connection options, compatibility across computers and phones, physical design, and how practical each choice is as a primary or backup key. I gave more weight to options with useful flexibility across accounts and devices, since a key that works with more of a buyer’s setup can reduce friction and avoid the need for several different keys.
The ranking also reflects the tradeoffs between broad capability and simplicity. Yubico’s YubiKey 5 models lead for buyers who want wider protocol support, while the Security Key NFC and multi-connection Thetis Pro have distinct advantages for particular setups. FIDO-focused USB-A and USB-C models remain sensible picks when their narrower feature set matches the buyer’s accounts. Compact, folding, Bluetooth, and specialty-feature options rank by how well their design serves a clear need, not by feature count alone; buyers should verify each service’s supported methods before ordering.
| hardware security keys for two-factor authentication | Brand | Interface |
|---|---|---|
| Symantec VIP K10S Hardware Aut | Symantec VIP | USB Type-A |
| SecuX PUFido Clife USB-C Secur | SecuX | USB Type-C |
| Thetis Nano-A FIDO2 USB-A Secu | Thetis | USB 2.0, USB Type-A |
| Thetis FIDO2 Security Key with | — | USB Type-A |
| TrustKey T120 USB-C FIDO2 and | TrustKey | USB Type-C |
| Yubico YubiKey 5C USB-C Securi | Yubico | — |
| Thetis FIDO2 Security Key | Thetis | — |
| Thetis Pro FIDO2 Security Key | Thetis | — |
| TrustKey T110 FIDO2 and U2F US | TrustKey | USB-A |
| Yubico Security Key NFC | Yubico | — |
| Thetis FIDO2 and U2F Bluetooth | — | — |
| Yubico YubiKey 5 NFC USB-A Sec | — | — |
| Thetis Pro FIDO2 Security Key | — | — |
| Thetis Nano-C FIDO2 USB-C Secu | — | USB Type-C |
| Thetis FIDO U2F USB-A Security | — | USB Type-A |
Factors to Consider When Choosing Hardware Security Keys For Two-factor Authentication
Picking a security key is less about collecting features and more about avoiding a mismatch between your accounts, devices, and recovery plan. I’d check these factors before choosing a model, especially if you plan to use one key across both computers and phones.
Match the Key to Your Accounts’ Authentication Support
Start with the sign-in settings for the accounts you actually need to protect. Many services support FIDO2 or U2F security keys, while a key with additional protocols may also work with other login systems. That broader support can matter if you want one physical key for several kinds of authentication, but it does not make every service compatible. Check whether each service accepts a security key as a second factor, a passkey, or both, since those are related but distinct sign-in uses. A frequent mistake is buying by product label alone and assuming every key works with every account. If your needs are mostly FIDO sign-ins, a simpler model may be easier to choose and manage.
Choose Ports and Wireless Options Around Your Devices
Inventory the ports on the laptop or desktop where you sign in most often, then check phone support separately. USB-A can be a better fit for older computers, while USB-C suits newer devices; adapters may bridge a gap, but they add something else to carry and can complicate access. NFC may make sign-ins more convenient on compatible phones, though phone operating system, browser, and service support can affect the experience. Bluetooth models address a different connection need and should be chosen only after checking that your device and account flow support them. Avoid treating a connector as a guarantee of universal phone compatibility. If you switch between work and personal devices, a key with more than one practical connection method can reduce friction.
Plan for a Spare Before You Lose Access
A security key is a physical object, so loss, damage, or leaving it at home can interrupt access unless you have a recovery route. When a service allows multiple keys, register a spare while you still have the primary key available and store it somewhere separate. A two-pack can make that plan easier to start, but the second key does not protect any account until you add it to that account’s security settings. Keep recovery codes in a secure place and confirm the account’s recovery process before relying on a key as your only method. Don’t assume that a backup key automatically copies settings or credentials from the first. For important accounts, redundancy is part of the purchase decision, not an afterthought.
Decide Whether Broad Protocol Support Is Worth the Complexity
Keys vary in how many authentication methods they support, and more capability is useful only when your accounts call for it. A broader model can suit someone who wants one key for varied work and personal sign-ins, while a FIDO-focused key may be a clearer fit for a smaller set of compatible services. Extra features can also bring more setup choices, so check the manufacturer’s supported protocols and the service’s own instructions rather than relying on a shorthand like “security key.” Buyers sometimes pay attention to a feature name without checking whether their employer or favorite service permits that method. If you manage accounts under workplace policies, ask the administrator which standards and key types are approved. Choose the simplest key that meets your actual account requirements, unless you have a specific reason to value wider support.
Balance Pocketability, Connector Protection, and Handling
A tiny key is easier to carry and less noticeable when left in a laptop, but it can be harder to grip and easier to misplace. Folding or covered designs protect the connector during travel, though their moving parts or added housing can make them bulkier than a nano model. Think about where the key will live: on a key ring, in a laptop port, or in a bag with other items. If you expect frequent plugging and unplugging, ease of handling may matter more than the smallest possible footprint. Metal or reinforced covers can help protect a connector from everyday knocks, but they cannot prevent loss or guarantee compatibility. Pick a design that makes it easy to keep the key with you and use it correctly.
Check Enrollment, Recovery, and Organization Rules
Before moving an account to key-based sign-in, find the service’s setup steps and confirm whether it supports multiple registered keys or alternate recovery methods. Some workplaces require approved hardware, centrally managed enrollment, or a particular authentication standard; an otherwise capable consumer key may not meet those rules. For family or shared-device use, each person should have their own account and registered key rather than passing around one credential. Keep recovery codes separate from the key and avoid storing them in the same bag or case. If you manage many accounts, make a short record of which keys are enrolled where, stored securely and without exposing recovery secrets. A little setup planning can prevent a lost key from becoming a locked account.
Frequently Asked Questions
Should I choose the YubiKey 5C or a FIDO-focused USB-C key?
Choose the YubiKey 5C if you want broader authentication protocol support and expect to use the key across different types of services. A FIDO-focused USB-C option may be a better match if your accounts only need FIDO2 or U2F sign-ins and you prefer a more limited feature set. Neither choice can be assumed to work with every account, so check the service’s supported methods first. Also confirm that USB-C is the connection you need for your computers and any phones you plan to use. If you are uncertain about future account needs, broader support offers flexibility, but it is not a substitute for checking compatibility.
Can one security key work with both my laptop and phone?
It can, but the answer depends on the key’s connection options and the phone’s support for that sign-in flow. USB-C may connect directly to some newer phones, while NFC can provide a tap-based option on compatible devices and services. USB-A keys may require an adapter on phones without that port, and an adapter does not guarantee that every app or browser supports security-key sign-in. Check the device maker’s guidance and the account’s setup instructions before buying for phone use. If you regularly sign in on both phone and computer, a model with connection options that suit both can be more convenient.
Do I need a second hardware key?
A spare is a sound choice if losing access to an important account would cause serious disruption. Register the backup with each service that permits multiple keys, then store it in a separate, secure location so one incident does not affect both. A multipack does not automatically configure the second key or transfer anything from the first. Also keep any recovery codes or alternate sign-in methods available according to each service’s instructions. If you choose to use only one key, confirm recovery options before removing other sign-in methods.
Is NFC worth choosing if my laptop only has USB ports?
NFC can be useful when you also sign in on a compatible phone, even if your laptop uses USB-A or USB-C. For computer use, the key’s USB connection may remain the main way you authenticate. The benefit depends on phone, browser, and service support, so NFC alone does not guarantee a faster or supported sign-in on every device. If you never use a phone for account access, NFC may add little practical value. Pick it for a real mobile use case rather than as a feature you assume you will need.
Will a hardware security key work as a passkey for every website?
No. A hardware key can support FIDO-based sign-in, but each website or app decides which sign-in methods it accepts and how it handles passkeys. Some services use a security key as an extra authentication factor, while others may offer a passkey flow with different setup and recovery behavior. Check the specific service’s help pages and account settings before assuming the key can replace a password or authenticator app. Also confirm whether you need a resident credential or another capability for the use you have in mind. Keeping a separate recovery method can help if a service’s passkey options differ from what you expect.
Conclusion
For the broadest mix of supported authentication methods, I’d choose the Yubico YubiKey 5C as the best overall pick, provided USB-C fits your devices. The TrustKey T120 is a practical value choice for buyers who need USB-C FIDO2 and U2F support without seeking the wider protocol range of the YubiKey 5 models. For a premium, flexible setup with several connection options, consider the Thetis Pro with USB-A, USB-C, and NFC; for a more straightforward first key, the Yubico Security Key NFC pairs USB-A with NFC for compatible phones. If your priority is a spare ready to enroll, the Thetis USB-A 2-Pack is the specific-use pick, while the Thetis Nano-C suits a compact USB-C setup. Before choosing, verify account support, device compatibility, and recovery options, then register a backup if your accounts allow it.
