How to set up a hardware security key (YubiKey)

Why this matters

Authenticator app codes can be phished in real time — a fake login page captures both your password and the 6-digit code you enter, then immediately replays them on the real site. A hardware key uses a cryptographic challenge-response that’s bound to the specific domain, making real-time phishing impossible.

Hardware keys are overkill for most accounts. But if you have crypto holdings, business email, GitHub with production deployments, or are a journalist or activist, the upgrade is worth the cost.

How to do it

1. Buy a YubiKey 5C NFC (or two — register a backup). Alternatives: Google Titan Key if you’re in the Google ecosystem; any FIDO2-certified key works.
2. Register the key on your most critical account first: Google account, iCloud, or GitHub. Go to security settings → “Security keys” or “Passkeys and security keys.”
3. Tap the key when prompted (USB-C plug in, or NFC tap for mobile).
4. Register your backup key on the same accounts.
5. Store your backup codes in your password manager.

What you don’t need

You don’t need a hardware key for every account — only the ones where a takeover would be catastrophic (email, banking, crypto, primary work tools).