Add a hardware security key to your most important accounts
A hardware security key (such as a YubiKey) is the most secure form of two-step verification available. Adding one to your email account and other critical accounts eliminates the risk of phishing-based account takeover entirely.
Why this matters
A hardware security key is the most phishing-resistant form of two-step verification available. Unlike SMS codes or authenticator apps, a hardware key cannot be intercepted — it verifies the exact website domain it is being used on, so it will refuse to authenticate on a fake login page even if you click a convincing phishing link.
How to do it
- Purchase a hardware security key such as a YubiKey 5 NFC (£50–60) — it works with USB-A and NFC for phones. Titan Security Keys from Google are also an option.
- Register the key with your email account first — in Gmail, go to Security → 2-step verification → Add security key and follow the on-screen instructions.
- Register the same key with any other critical accounts that support hardware keys: Microsoft, GitHub, Dropbox, and most banking apps.
- Purchase a second key and register it as a backup on the same accounts — store the backup key somewhere physically separate from the primary.
- Keep your authenticator app or backup codes active until the hardware key is set up and confirmed working — do not remove other 2FA methods until you have successfully authenticated with the key.
Cyber Essentials framework
This task falls under the User Accesscontrol — one of five areas assessed in the UK's Cyber Essentials scheme. Completing it counts toward your Cyber Essentials alignment.
Track your full security score — free
Create a free account to check off tasks, see your Security Score, and build toward Cyber Essentials alignment.
Start your free security check