A hardware security key can stop phishing from turning into account theft, because the device works only with the genuine website. Passwords and one-time codes can be typed into a fake login page, but the key cannot be used there.
In July 2022, attackers sent phishing texts to at least 76 employees of web infrastructure company Cloudflare, and three of them entered credentials on a lookalike login page. The attackers still could not get in because Cloudflare used FIDO2 hardware security keys, and the company says none of its systems were compromised.
This article covers what a hardware security key is, how it works, its benefits and limitations, and how to deploy it in your company.
What Is a Hardware Security Key?
A hardware security key is a small physical device that serves as a second factor in multi-factor authentication (MFA) or replaces the password. It contains a secure chip that stores a private key, a button or touch sensor that confirms the user is present, and a USB, NFC, or Bluetooth connector.
The private key is generated inside the chip and never leaves the device. The device follows the FIDO2 standard, which combines WebAuthn (the browser interface) and CTAP (the protocol that lets the browser talk to the device).
According to the FIDO Alliance, device-bound passkeys (login credentials built on cryptographic keys) stored on a modern security key provide the strongest level of security assurance.
Hardware Security Key vs Hardware Security Module (HSM)
A hardware security key proves one user’s identity at login, while a hardware security module (HSM) stores and manages cryptographic keys for a system or application. Both keep keys in dedicated hardware, but they serve different users.
| Aspect | Hardware security key | Hardware security module (HSM) |
|---|---|---|
| Main function | Proves a user’s identity at login | Stores and manages cryptographic keys for a system or application |
| Who uses it and where | Carried by the user and used directly at login | Installed in a data center or rented as a cloud service, then used by systems and applications |
| Example uses | Logging in to email, a VPN, or an administrator console | Signing digital certificates, protecting data encryption keys, and securing payment transactions |
To protect employee logins, choose a hardware security key. To protect application encryption keys or digital certificates, choose an HSM.
How a Hardware Security Key Works
A security key works by signing a random challenge from the service with its private key, without sending that key anywhere. The process has five steps:
- During registration, the device creates a cryptographic key pair for that service alone and gives the service its public key.
- At login, the service sends a random challenge to the browser.
- The browser passes the challenge to the device together with the address of the site that is open.
- The user touches the device and enters a PIN or scans a fingerprint if the device asks for one.
- The device signs the challenge with its private key, and the service verifies the signature with the public key it stored earlier.
The device answers only for the site it was registered with, so a spoofed login page never gets a signature that works on the real site. Each signature is also valid for just one challenge, so attackers cannot reuse it.
Benefits of a Hardware Security Key for Company Security
The three main benefits of security keys for a company are resistance to phishing, a private key that cannot be copied remotely, and a simpler login process.
1. Resistance to Phishing and Leaked Passwords
In an October 2022 fact sheet, CISA, the US cybersecurity agency, identified FIDO/WebAuthn as the sole phishing-resistant authentication method that was widely available. By that measure, SMS codes, app-generated codes, and push notifications are not phishing-resistant.
Attackers who obtain a password through a fake site or a data breach still cannot log in without the physical device.
2. A Private Key That Cannot Be Copied Remotely
The private key stays inside the chip and is never sent to the computer or to the service’s server, so malware on the computer cannot copy it. The server stores only the public key, which cannot sign a challenge, so a breach of the service’s database does not let attackers impersonate users.
3. Simpler Logins
Users only need to touch the device, with no six-digit code to copy from an app and no SMS to wait for. The FIDO Alliance even notes that a USB key plus a PIN and one touch can be simpler than a login flow built around a smartphone.
Hardware Security Key Limitations to Plan For
The four limitations of a hardware security key are cost, the risk of a lost key, application support, and new user habits. A company should plan for all four before buying in bulk:
- Cost and logistics, because each user should hold two devices that must be bought, distributed, and tracked.
- The risk of a lost or damaged key, which locks the user out of the account when there is no backup device.
- Uneven application support, especially in older systems that do not recognize FIDO2.
- New habits for users, because the device must always be carried and touched at every login.
Starting with high-risk accounts keeps the cost down, and issuing a backup device from day one covers the risk of loss.
How to Deploy a Hardware Security Key in a Company
The safest rollout starts with a small, high-risk group and then expands in stages. You can follow these five steps in order:
- Define the first group: system administrators and help desk staff (CISA’s examples for an initial phase). Then add finance staff and accounts that reach email, a VPN, or the identity server.
- Confirm that your identity provider (the system that verifies user logins) and your applications support FIDO2/WebAuthn, then prepare a fallback method for legacy systems.
- Issue two devices to each user, one for daily use and one kept separately as a backup.
- Register the devices in the company’s central login system (single sign-on, or SSO), then require them through an access policy so that logins without a device are rejected.
- Set a procedure for lost devices and departing employees: revoke the device from the account, verify the user’s identity, register a new device, and update the inventory.
Measure the first group’s results with two numbers, failed logins and device replacement requests, before you expand the requirement to all employees.
Conclusion
A hardware security key proves a user’s identity with a cryptographic signature that is valid only on the genuine site, so it resists phishing. Its limitations are cost, the risk of a lost key, uneven application support, and new user habits.
You can start this week by listing your administrator and finance accounts, then checking whether your company’s login system supports FIDO2. The result shows which accounts can use a hardware security key right away and which still need another method.
Ready to Manage Digital Identities as a Business Security Strategy?
Request a demo today and discover how IAM solutions centralize user logins through Single Sign-On (SSO), automate employee onboarding, and protect company data from unauthorized access without disrupting productivity with repeated logins.
FAQ
It is difficult, because the private key never leaves the device and a key that requires a PIN or fingerprint cannot be used right away by a thief. The remaining risk is a session that is already logged in, since malware on the computer can still steal it, so securing the computer remains necessary.
Yes, but only on services that support passwordless login, where the device and a PIN take the place of the password. On other services, the device acts as a second factor and the password stays in use.
Yes. One device can be registered with work email and a VPN at once, as long as both support FIDO2, and each service gets its own key pair.
Yes, if the phone can connect to the key, either over NFC (tap the key against the phone) or through a USB-C port. Also check whether the apps you use support FIDO2 on mobile before you buy.
