SSOGEN / Learn / What Is a Security Key? How FIDO2 Hardware Keys Work, and What Happens If You Lose One
Learn
What Is a Security Key? How FIDO2 Hardware Keys Work, and What Happens If You Lose One
A security key is a small hardware device that proves who you are to a website by signing a challenge with a private key that never leaves the device.
Updated
What is a security key? A security key is a physical device, usually a USB or NFC token the size of a house key, that holds a cryptographic key pair for each account registered with it. To sign in, you plug it in or tap it, touch it, and often enter a PIN.
FIDO security keys resist phishing for two reasons:
- No secret to replay. The site never receives a secret it could replay.
- Exact-site answer. The key answers only the exact site it was registered with.
A security key is one type of FIDO2 authenticator. It holds what the FIDO Alliance calls device-bound passkeys.
Test a security key in your browser
The tester below is free and runs in your browser. It asks the browser to create a test credential, then reads back what the key reported.
Nothing is uploaded and no account is needed. The test credential belongs to this page’s own origin and means nothing anywhere else.
Checking what this browser supports...
Some browsers show an extra prompt for this. Leave it off for the simplest test.
Private by design. The test credential is made for this page's own address only, the checks run in your browser, and nothing is sent or saved. A discoverable credential can use one of the limited slots on a security key, which is why the default is discouraged.
How to read the results
- Backup eligible (BE) and backup state (BS). Two bits in the authenticator data. The WebAuthn specification (Level 3, W3C Recommendation 25 August 2026, section 6.1, read 2026-10-08) says the authenticator sets backup eligibility when it creates the credential, and the value is permanent for that credential.
- Single-device and multi-device. A credential that is not backup eligible is a single-device credential; an eligible one is a multi-device credential, commonly called a synced passkey.
- What you will see. A hardware key normally shows BE off, while a phone or laptop passkey manager often shows BE on.
- AAGUID. A 128-bit identifier for the make and model of the authenticator. The specification says all substantially identical authenticators from one maker share it, and sites can use it to decide which models they accept.
- All zeros. Usually means the browser or key withheld the AAGUID, which the specification allows for privacy.
- Transports. How the key reports it can be reached. The Level 3 list is
usb,nfc,ble,smart-card,hybridandinternal. A key that reportsusbandnfccan be plugged in or tapped. - User verified (UV) and user present (UP). UP means someone touched the key. UV means the key also checked a PIN or a fingerprint.
- Sign counter. A number that increases with each sign-in on authenticators that implement it. The specification says it helps a site detect a cloned authenticator; authenticators without one leave it at zero, which is not an error.
- Attestation format. The type of proof of make and model the key supplied, or
none.
How does a security key work?
The steps below follow the WebAuthn sign-in flow as Microsoft describes it in its passkey documentation for Microsoft Entra ID (page dated 2026-02-02, read 2026-10-08).
How a security key signs a challenge for one site
- You and your keysecurity key
- Your browser
- The websiterelying party
- The website to Your browser1Sends a one-time challenge when you start to sign in
- Your browser to You and your key2Passes the challenge with the site identityThe key finds the key pair it made for that site.
- You and your key3You touch the key, plus a PIN or fingerprint if asked
- You and your key to Your browser4Signs the challenge with the private keyThe private key is expected never to leave the key.
- Your browser to The website5Returns the signature to the site
- The website6Checks it with the public key stored at registration
- You start to sign in. The site sends a one-time challenge.
- Your browser passes the key the challenge and the site’s identity. The key finds the key pair it created for that site, using the hash of the site’s relying-party ID and the credential ID.
- You touch the key. If the site asks, you also enter a PIN or use a fingerprint.
- The key signs the challenge with the private key and returns the signature.
- The site verifies the signature with the public key it stored at registration.
Two properties do the security work:
- The private key stays on the key. It is created there and, in the specification’s words, is expected never to leave the authenticator that made it (section 13.4.6).
- Credentials are scoped to a relying party. The spec says only origins belonging to that party can access them, and browsers and authenticators enforce this together.
A fake site on another domain cannot request the real site’s credential, and there is no code or password to hand over. Microsoft calls this verifier impersonation resistance.
FIDO2, WebAuthn, CTAP, U2F and passkey: what each word means
| Term | What it is | Where it lives |
|---|---|---|
| FIDO2 | The FIDO Alliance name for WebAuthn plus CTAP together (FIDO Alliance, read 2026-10-08) | Umbrella term |
| WebAuthn | The browser API sites call to create and use credentials; published by the W3C (Level 2, 8 April 2021; Level 3, 25 August 2026) | Browser and site |
| CTAP | Client to Authenticator Protocol: how the browser or operating system talks to a key over USB, NFC or Bluetooth LE. The FIDO Alliance specifications page lists CTAP 2.3 as a Proposed Standard dated 26 February 2026 (read 2026-10-08) | Between device and key |
| U2F | The earlier second-factor-only standard. Version 1.2 was approved on 11 July 2017 per the same page. Microsoft’s documentation says WebAuthn was designed to work with U2F-era (CTAP1) keys, but sites that need FIDO2-only features do not accept them | Older keys |
| Passkey | A FIDO credential. FIDO Alliance splits them into device-bound (never leave one device, including those on security keys) and synced (copied between a person’s devices by a cloud service) | The credential itself |
| Security key | The hardware that holds device-bound passkeys. Per the FIDO Alliance, security keys have held them since FIDO2 added passwordless sign-in in 2019 | The device |
For the credential side, read what a passkey is and passkeys compared with passwords.
Security key vs passkey vs authenticator app
“Security key vs passkey” is a slightly crooked comparison, because a key stores passkeys. The real choice is where the credential lives.
| Security key (device-bound passkey) | Synced passkey | Authenticator app (TOTP) | |
|---|---|---|---|
| Where the secret is | In the hardware key | In a passkey manager, copied across your devices through the provider’s cloud | On your phone, as a shared secret the site also knows |
| Backup eligible flag | Normally off | On | Not applicable |
| Can a fake site get it? | No: the credential answers only its own origin | No, same origin binding | A six-digit code can be typed into a fake site and relayed |
| If you lose the device | Credentials on that key are gone | They return on a new device signed in to the same provider | Re-enroll, or restore from the app’s own backup |
| What the site can learn about it | With attestation, the make and model | Microsoft documents that synced passkeys do not support attestation | Nothing |
Sources: FIDO Alliance and Microsoft Learn pages linked in this article, read 2026-10-08. For the TOTP row, see what an authenticator app is and MFA types.
What is the point of a security key?
Purpose. A security key provides a second (or only) sign-in step that cannot be phished or replayed.
Assurance. The FIDO Alliance says device-bound passkeys in hardware security keys offer “the highest security assurance.”
Recovery. The FIDO Alliance also says they can act as a recovery credential when synced passkeys are unavailable.
Related reading. For the wider category, see phishing-resistant MFA. For attacks that defeat weaker steps, see MFA fatigue attacks and credential stuffing.
Types of security key: USB, NFC and Bluetooth
- Three connections. The FIDO Alliance names USB, NFC and Bluetooth Low Energy as the ways a security key connects.
- Roaming authenticators. Microsoft’s WebAuthn documentation lists the same three as the transports a roaming authenticator uses.
- More than one device. A roaming authenticator can connect to more than one client device.
- Built-in authenticators. Such as a laptop fingerprint reader; they cannot be reached over those transports.
- Attachment value. The WebAuthn spec has one for each group, and the tester’s “authenticator attachment” row shows which one your authenticator reported.
What is a hardware security key, and what is a YubiKey?
Hardware security key. The same thing: the key pair sits in dedicated hardware, not in software on your computer.
YubiKey. One example. Yubico describes the YubiKey 5 as a physical security key that supports FIDO2, U2F, smart card, OTP and OpenPGP, with USB-A, USB-C, NFC and Lightning connectors, depending on model (Yubico YubiKey 5 overview, read 2026-10-08).
Other makers. Many makers build FIDO2 keys, and Microsoft points to the FIDO Certified Products list for them.
YubiKey vs passkey. Also a category mix-up, because a YubiKey is a way to hold passkeys.
What are the downsides of a security key?
- Losing it loses its credentials. The WebAuthn specification says that losing an authenticator “in general” means losing all credentials bound to it, which can lock out a person who registered only one.
- PIN lockout. Yubico’s YubiKey 5 FIDO manual (read 2026-10-09) says that after three wrong PINs in a row you must power-cycle the FIDO2 application.
- PIN lock. After eight wrong PINs in a row it locks until a FIDO2 reset. A reset also resets the U2F application, so the key must be registered again everywhere. Other models and makers may differ.
- Limited slots. The same manual says YubiKeys in the 5 Series can hold up to 25 resident (discoverable) credentials, and that as of firmware 5.7.4 the FIDO2 limit rose to 100.
- Full key. A full key cannot take a new account until some are deleted.
- Operating cost. Microsoft’s documentation says security keys can add costs for equipment, training and helpdesk support, especially when users lose keys and need account recovery.
- Not every site accepts them. Microsoft notes that a site needing FIDO2-only features does not accept an older U2F credential.
What happens if a security key is lost or stolen?
A lost key is a recovery problem.
A stolen key is a smaller one: the thief also needs the PIN if the site required user verification, and the key blocks guessing after the retry limit above. Handle both the same way:
- Sign in with your second registered key or another method the site allows.
- Remove the lost key from the account. In Microsoft Entra ID an administrator deletes it from the user’s authentication methods (Microsoft Learn, how to enable passkeys, page dated 2026-03-08, read 2026-10-08).
- Register a replacement and check the list of registered methods.
The WebAuthn specification (section 13.4.6) says relying parties should allow and encourage registering more than one credential. A message you can send before anyone loses a key:
Subject: Register a second security key
If you lose your security key and it is the only one on your account, we cannot sign you in until we have verified who you are another way. Please register a second key today and keep it somewhere other than your keyring. If a key is lost or stolen, tell us at help@acme.example the same day and we will remove it.
What should an organization decide before it hands out keys?
| Decision | Options and what a source says |
|---|---|
| Backup | Two keys per person, or a key plus a synced passkey. WebAuthn section 13.4.6 recommends sites allow multiple credentials |
| Lost-key process | Who verifies identity, and how. Microsoft lists helpdesk support and account recovery, especially after a lost key, among the added costs |
| Attestation | If enforced in Microsoft Entra ID, only device-bound passkeys register, and the make and model can be checked. If not enforced, Entra says it cannot guarantee any attribute of a passkey, including whether it is synced or device-bound |
| Model allow list | Microsoft Entra ID can allow or block models by AAGUID. Its own warning: remove an AAGUID later and people who registered that model can no longer sign in. Treat AAGUID lists as policy, not hard security, when attestation is off |
| Who gets keys | Microsoft recommends FIDO2 security keys for highly regulated industries and users with elevated privileges, and synced passkeys for most others |
For example, Acme Corp (acme.example) gives its 12 administrators two keys each and enforces attestation for them, while the 400 other staff use the passkeys they already have.
Attestation is why an administrator’s synced passkey would be refused: synced passkeys do not support it.
What is “my security key for Windows”?
It is the Windows setting for a FIDO2 key used with a work or school account. Microsoft Support gives the path (Microsoft Support, read 2026-10-08):
- Open Settings.
- Select Accounts.
- Select Sign-in options.
- Select Security Key.
- Select Manage.
There you can add or change the key’s PIN or Reset it. Microsoft warns that resetting deletes everything from the key and returns it to factory defaults.
You register the key itself through your account’s security info page, not in Windows Settings. On Windows 11 version 23H2 and later, Microsoft says to choose Security key under More choices at the sign-in screen.
Windows has offered WebAuthn APIs since Windows 10 version 1903, so any browser that supports WebAuthn can use the key, per Microsoft’s WebAuthn documentation (read 2026-10-08).
Where SSOGEN fits
- Security key as passkey. SSOGEN accepts a security key as a passkey.
- Registration. People register one from My Account.
- Policy. A policy set to Passkey or security key accepts only a passkey or a security key for the applications it governs.
- Code-based second step. The SSOGEN Authenticator is a free time-based code app that works with any service that accepts such codes, with no SSOGEN single sign-on needed.
- Second step and SSO. To see how a second step relates to SSO, read SSO vs MFA and the benefits and risks of SSO.
Questions people ask
Is a security key the same as a passkey?
No. A passkey is the credential. A security key is hardware that can store device-bound ones.
Do I need a PIN?
Only if the site requests user verification. The key then checks a PIN or fingerprint before it signs.
Can I use one key on many sites?
Yes. The key keeps a separate pair for each site, and the specification ensures sites cannot see each other’s credentials.
Does a security key replace SSO?
No. SSO decides how many sign-ins you have; a key is one way to prove who you are at a sign-in.
Where to go next
- Defense. Read phishing-resistant MFA.
- Credentials. Read what a passkey is.
- Factors. Read MFA types.
- All topics. Return to the Learn hub.
Sources, all read 2026-10-08: W3C WebAuthn Level 2 and Level 3, the FIDO Alliance FIDO2, passkeys and specifications pages, Microsoft Learn and Microsoft Support pages linked above, and Yubico’s documentation. YubiKey is a trademark of its owner; SSOGEN is not affiliated with it.