Updated ShieldCue Editorial Team

How to Choose a Hardware Security Key

A hardware security key is judged on four things: what it costs, what it plugs into, what it protects, and who you call when it stops working.

Price first, then what the money gets you

A hardware security key is a small fob that signs you into a site instead of relying on a password. Prices in this group are the price of the key itself rather than a monthly or yearly plan, so the figure on the page is the whole commitment. Across the group the euro spread runs €6.95 to €49.95, which is a wide field to shop in.

Google Titan Security Key sits at $30 to $35 per key, a narrow band that carries a name many buyers already know. SoloKeys Solo 2 is a single figure at $35, and the same number is also its entry price under $35, so nothing cheaper waits underneath it.

Thetis spreads its catalogue across $24.99 to $49.99, and Token2 reaches further with €7 to €37, the widest shelf here. Token2 is the only provider in this group with a free element: an in-browser TOTP toolset, a TOTP QR decoder and a FIDO2 demo, all usable with no account. SoloKeys Solo 2 has no free plan, so the hardware is the whole cost from day one.

Read the price next to the shelf, not on its own. A lower key that carries more connectors can beat a pricier one with fewer. Browse the hardware security keys rankings first so you know which lines exist before you set a budget.

Connectors: the decision you make once

Every key in this group offers USB-A, and most add USB-C. Google Titan Security Key lists usb a, usb c and nfc, Thetis lists usb a, usb c and nfc and Token2 lists usb a, usb c and nfc, so those three cover a laptop and a phone from one purchase. SoloKeys Solo 2 offers usb a and usb c, which means no contactless tap.

Match the connector to the ports you actually own before you look at anything else. A USB-C laptop plus a phone with no adapter rules out a USB-A only key, while a key with NFC saves you carrying a second dongle to a shared machine.

For most people the connector list settles the shortlist faster than price does. Buy two keys from the same range and keep one at home, and a single connector type is a smaller problem than it looks.

Protocols decide what the key can protect

Google Titan Security Key supports fido2 alone, which makes it a web-first key for site logins. Thetis and Token2 are broader, with fido2, u2f and otp and fido2, u2f and otp. Those wider lists reach past web sign-in into older web standards and card-style uses. The SoloKeys Solo 2 listing sets out connectors and platforms rather than a protocol set, so check its page before you plan card or certificate work on it.

Ask what you want the key to do. Pure sign-in protection is covered by the narrowest list. Certificate, smart card and one-time code work asks for the wider protocol sets, and a key that cannot speak those languages will simply be ignored by the system you plug it into.

Platform coverage follows the same logic. SoloKeys Solo 2 lists Windows, macOS and Linux and Token2 lists web browser, Windows and macOS. A key is only as good as the devices you log in from, so check the list against the machines already in your bag rather than the ones you might buy.

Biometrics, open source and the paper trail

Biometric unlock is the comfort question. Token2 and Thetis both support biometric unlock, and SoloKeys Solo 2 does not. If you want a fingerprint check on the key itself, SoloKeys Solo 2 comes off the list before the prices matter.

Open source splits the group too. SoloKeys Solo 2 is open source, and Token2 is not. That choice decides whether you can read what the firmware does or take the vendor's word for it, which matters to some buyers and not at all to others.

Company details give you a paper trail to fall back on. Token2 is run by a Swiss limited liability company, headquartered in CH with terms governed by CH. SoloKeys trades under its own name with headquarters in US and terms under US. Thetis is a US company that trades under the Thetis name and is based in US.

Track record is the next thing to weigh. Google Titan Security Key traces back to 1998, Token2 to 2013 and Thetis to 2014, so the newest name on this list is also the least established.

SoloKeys Solo 2 also states its data handling plainly: credentials and passkeys stay on the device, no credential, FIDO2 private key, PIN or biometric data is ever collected, and no authentication data is used for analytics. A written policy like that is easier to judge than silence.

Support is the reliability signal

When a key stops being recognised by a laptop, support decides how long you are stuck. Google Titan Security Key offers help centre, a help centre alone. Thetis pairs email and help centre, and Token2 goes furthest with email, phone and help centre, which includes phone alongside email and a help centre.

Support matters more the more devices you own. One key on one laptop forgives thin help desks, while keys spread across a work laptop, a personal phone and a shared machine make a direct contact route worth real money.

Check the support route before the second key rather than the first, and note which provider the route belongs to, since support follows the seller of the key.

A worked comparison

Put the four together in this order. Price band first: Token2 covers €7 to €37 and Thetis $24.99 to $49.99, with Google Titan Security Key at $30 to $35 and SoloKeys Solo 2 at $35. Then connectors, which removes a candidate if you sign in from a phone. Then protocols, which removes another if you need card or certificate work. Then the details behind the listing: jurisdiction, open source and support.

The outcome depends on which of those four screens you care about most. A buyer who wants the cheapest entry point and a free browser toolset lands on Token2. A buyer who wants a fingerprint on the key and broad protocol support lands on Thetis. A buyer who wants readable firmware lands on SoloKeys Solo 2 and accepts the narrower connectors. A buyer who wants the longest track record and a tight price band lands on Google Titan Security Key.

Read the full write-ups for Token2, Thetis, Google Titan Security Key and SoloKeys Solo 2 before you order, and compare the hardware security keys rankings once more for anything that has moved. Pages for Nitrokey, Yubico and OnlyKey sit alongside if you want a wider shortlist.

Sources