A password can be guessed, stolen from a compromised website or handed over by mistake to a phishing page. A private key held in a dedicated chip, on the other hand, can neither be copied nor typed into a fake form. This is the idea behind hardware security keys, smart cards and passkeys: putting public-key cryptography in the user's hands, in a form that resists the main attacks on credentials.
The principle: the key never leaves
A hardware key contains a secure element, a small processor designed to hold secrets and resist extraction attempts. The private key is generated inside it and never leaves the device.
When it needs to be used, the computer does not ask for the key: it sends a request to the device, which performs the cryptographic operation, such as a signature, and returns only the result. Even a computer infected with malware cannot walk away with the key; at most it can try to use it while the device is plugged in, and often not even that, because many operations require a physical touch or a PIN.
Authentication with FIDO2: how it works
The FIDO2 standard, with its web component called WebAuthn, is now the most widespread way of using hardware keys to sign in to websites.
Registration
- The site asks you to register a security key.
- The device generates a new key pair dedicated to that site.
- The public key is sent to the site and saved in your profile; the private key stays in the device.
Sign-in
- The site sends a challenge, a random value that differs with every sign-in.
- The browser passes it to the device together with the address of the site requesting it.
- You touch the key or enter the PIN; the device signs the challenge with that site's private key.
- The site verifies the signature with the registered public key.
The site stores no secret: if its database is stolen, it contains only public keys, which are useless for signing in.
Why it resists phishing
This is the most important advantage. In a traditional phishing attack you land on a page that perfectly imitates your bank's, but at a different address. A password or SMS code gets typed in and handed to the attacker.
With FIDO2 the browser tells the device the page's real address. The key registered for the genuine site is not used on a different domain, however similar. The fake page does not get a valid signature, and there is nothing you can type by mistake. Protection does not depend on your attention, but on cryptography.
Passkeys
Passkeys apply the same mechanism without the need for a separate object. The private key is held in the security chip of your phone or computer and unlocked with a fingerprint, face recognition or the device PIN. The biometric data is not sent to the site: it is used only to unlock the key locally.
Many passkeys are synchronised across the same user's devices through the vendor's cloud service, in encrypted form. It is a convenience choice: it reduces the risk of being locked out, but makes security also depend on the protection of that account. Physical security keys, by contrast, are tied to a single object.
Smart cards and signing
Smart cards have used the same principle for much longer. A digital signature smart card contains the holder's private key and the related certificate: when you sign a document, the file's fingerprint is sent to the card, which returns the signature. The electronic identity cards of many European countries include a chip with cryptographic functions for authenticating to online services.
Some hardware keys combine several functions in one device: FIDO2 for signing in to websites, an OpenPGP-compatible smart card for encrypting and signing email, and generation of one-time codes.
How to use them without getting locked out
The flip side of a key that cannot be copied is that if you lose the device, you lose the key. Some practical rules:
- register at least two keys for every important account, and keep the spare one somewhere safe;
- keep the recovery codes that many services provide when you activate the feature, printed or in a password manager;
- set a PIN on the key: without one, whoever finds it could use it;
- do not leave weak methods enabled as a fallback: if the account still accepts SMS codes, the attacker will take that route.
A comparison of authentication methods
| Method | Resists phishing | Resists theft of the site's database | Requires an object |
|---|---|---|---|
| Password | No | Depends on how it is stored | No |
| SMS code | No | Yes | Phone |
| Authenticator app with one-time codes | No | No, the site stores the secret | Phone |
| Passkey | Yes | Yes | Phone or computer |
| Physical FIDO2 key | Yes | Yes | Yes |
In short
- Hardware keys, smart cards and passkeys hold a private key that never leaves the chip.
- FIDO2 creates a different key pair for every site and signs a challenge at every sign-in.
- Binding to the site's address makes these methods resistant to phishing.
- Passkeys are convenient and often synchronised; physical keys are tied to a single object.
- Registering a spare key and keeping recovery codes prevents you from being locked out.
