How to Use a Hardware Security Key

Set up and use a hardware security key for two-factor authentication on your accounts. Complete guide for FIDO2/WebAuthn keys.

1. Insert and test your security key. Connect your security key to your device via USB-A, USB-C, Lightning, or enable NFC on your phone. Most keys have a button or touch sensor that will light up when properly connected. Press the button once to verify the key responds with a brief flash or vibration.
2. Enable two-factor authentication on your account. Navigate to your account's security settings and locate the two-factor authentication or 2FA section. Select 'Add security key' or 'Hardware key' from the available authenticator options. The exact location varies: Google uses 'Security' > '2-Step Verification', while GitHub uses 'Settings' > 'Password and authentication' > 'Two-factor authentication'.
3. Register your key with the service. Click 'Add security key' and your browser will prompt you to insert and activate your key. Press the button on your security key when the browser requests it. The key will flash or vibrate to confirm successful registration. Assign a recognizable name to your key, such as 'YubiKey Office' or 'Titan Work'.
4. Download backup codes. Generate and save backup recovery codes immediately after registering your security key. Store these codes in a secure password manager or encrypted file. Each code typically works only once and serves as your account recovery method if you lose access to your security key.
5. Test the authentication process. Log out of your account and attempt to sign back in to verify your security key works correctly. Enter your username and password, then insert your security key when prompted for the second factor. Press the key's button when your browser requests authentication confirmation.
6. Configure additional accounts. Repeat the registration process for other critical accounts including email providers, cloud storage, financial services, and work accounts. Most modern services support FIDO2/WebAuthn security keys through their standard security settings menus.
7. Establish key management practices. Carry your primary security key with your essential items and store backup keys in separate secure locations. Update account recovery information if you change keys and regularly verify that backup codes remain accessible. Remove old keys from accounts when replacing them with newer models.