How to use a physical security key to lock down your most important accounts

Reading is great. Tracking makes it stick. Sign up for a free Dashboard to tick off tasks and see your Security Score.

Get my free Dashboard →

Cyber Nova AI helps you prepare for Cyber Essentials. It doesn't award or certify it. Follow the steps here to get ready, then apply for certification through an accredited Cyber Essentials body when you're set.

User AccessMedium priority

About 30 minutes to complete

A hardware security key (such as a YubiKey) is the most secure form of two-step verification available. Adding one to your email account and other critical accounts eliminates the risk of phishing-based account takeover entirely.

Step-by-step guide

Purchase a hardware security key such as a YubiKey 5 NFC (£50–60). It works with USB-A and NFC for phones. Titan Security Keys from Google are also an option.
Register the key with your email account first. In Gmail, go to Security → 2-step verification → Add security key and follow the on-screen instructions.
Register the same key with any other critical accounts that support hardware keys: Microsoft, GitHub, Dropbox, and most banking apps.
Purchase a second key and register it as a backup on the same accounts. Store the backup key somewhere physically separate from the primary.
Keep your authenticator app or backup codes active until the hardware key is set up and confirmed working. Do not remove other 2FA methods until you have successfully authenticated with the key.

5 steps

Why this matters

A hardware security key is the most phishing-resistant form of two-step verification available. Unlike SMS codes or authenticator apps, a hardware key cannot be intercepted. It verifies the exact website domain it is being used on, so it will refuse to authenticate on a fake login page even if you click a convincing phishing link.

How to confirm it worked

The setting is saved and active on your device
You have tested it works before closing the page

Tick this task off in your Dashboard to update your Security Score.

Related security tasks

Track your security score for free

Create a free Cyber Nova AI account to tick off tasks like this one, see your Security Score, and stay on top of what you've done and what's still to do.

Start your free security check