What this task involves
This task adds a hardware security key to your accounts, so each sign-in asks for the physical key as well as your password. A hardware security key is a small device that proves it is you with a tap or a plug-in step. You will also add a backup key and keep recovery codes, which are spare codes for getting back in. A lost key then does not lock you out.
A key helps most against phishing, where a fake sign-in screen tricks you into typing your password. The key checks the real address of the account, so the fake screen gets nothing useful.
Before you start
A few checks will prevent trouble later. Run through them before you change any account settings.
- Confirm that the account offers hardware security keys as a sign-in option. Look in its security settings, since the wording varies by provider.
- Have a key in hand that you can keep somewhere safe, and a second key ready for the backup.
- Make sure you know your current password and have a second sign-in method, such as an authenticator app.
Steps to register your key
Follow these steps in order. Each step covers a single action, and the exact wording depends on the provider.
- Open the security settings of the account and find the option to add a security key.
- Choose the option to add a hardware security key and read the prompt that appears on screen.
- Insert the key into a port or hold it near the device, as the prompt asks.
- Touch the key's button or sensor when the prompt asks, then wait for the confirmation message.
- Give the key a clear name, such as main key, so you can tell it apart from the backup.
- Repeat the process with a second key, and store it in a separate place away from the first.
- Generate the recovery codes the account offers.
- Store the recovery codes offline, away from the devices you use to sign in.
- Test a sign-in before you leave the settings screen, to confirm that the key works.
Some accounts also offer passkeys, which use the same method but live on a phone, computer or password manager instead of a separate device. Read the account's instructions before you switch a sign-in method.
What to do if a key is lost
Use your backup key or a recovery code to sign in, then remove the lost key from the account settings. Do this as soon as you can, because a finder who also has your password could sign in with the key.
Register a replacement key the same way you registered your first key. Keep the recovery codes in a safe place that is offline, since they are the last route back in when every key is missing.
Review your registered keys every so often, especially after you replace a device. Remove any key you no longer use, so the list stays accurate.
What to do if it fails
Most setup problems come from the key not being detected or the account not accepting it. Work through the fixes below in order before you give up on the key.
- When the prompt never appears, unplug the key, plug it back in, and try again.
- Where the key is not recognised, try a different port on the device or another browser.
- Should the account reject the key, remove that entry and register the key again from the start.
- If you cannot sign in at all, use a recovery code and reach out to the provider through its official channels.
Recovery routes vary by provider. Check the provider's own instructions before you rely on any single route back into an account.
Where this matters when choosing a provider
How a provider handles security keys shapes how smooth setup and recovery feel. Look for clear instructions, room for several keys, and a documented recovery route.
Read the recovery instructions before you buy, because that detail is easy to miss. Ask yourself whether you could regain access with only the backup key and the codes.
Compare the options in the security key buying guide, then browse the security keys comparison to see how providers differ.