Best Hardware Security Keys of 2026

It costs about half what our top pick does, and for a lot of people it does the same job. The Security Key C NFC has the same USB-C plug, the same NFC radio, the same waterproof and crush-resistant shell, and the same account capacity on the box. What it leaves off is the protocol list: FIDO2/WebAuthn and U2F, and nothing else.

That is a trade we take for a first key. Google, Microsoft, Apple, GitHub, and the big password managers all speak FIDO2, and on those accounts this key registers without drama. Where it runs out is an account that wants the key to generate a six-digit code itself, or an IT department that has standardized on smart-card certificates — those need the 5-series, and patience will not add the feature. Our rule of thumb: if the words passkey or security key show up in your account settings, this one works; if you also need codes generated by the key, it doesn't.

The disappointment that follows this model is nearly always a service that doesn't accept FIDO2, not a key that fails. A bank portal or a government login that offers only SMS and an app will not be moved by any hardware key, and it is worth checking that list before you spend an evening on setup. Ours went straight onto a keyring, which is where a key this small belongs.

A USB-C laptop, a USB-A desktop, and a phone is an ordinary setup, and it is the one this key was engineered for. Thetis puts a USB-A plug on one end and USB-C on the other under a 360-degree metal cover you flip to whichever side you need. Of everything here, it is the only key that handles every port you own without an adapter, and that is worth real money the first time you are standing at a tower with no USB-C in sight.

The cover is the smart part and the question mark. It shields the plug you are not using and swings around with a firm detent, but it is also a moving part on something that rides in a bag. At an ounce and nearly three inches long, this is a chunky key next to the 10-gram YubiKey — it will not vanish on a keyring, and you will feel it in a pocket. We treat it as a bag key, not a pocket key.

Two limits to check before you order. Thetis is explicit that NFC here is for mobile only, so you can't tap it on a Mac or a Windows PC the way you tap it on a phone. And Windows Hello sign-in needs an Enterprise edition of Windows, which rules out using it to unlock a home PC. Beyond those, the compatibility list is broad — Windows, macOS, Linux, Chrome OS, iPhone, and Android — and the rotating cover means you are never the person asking around for a dongle.

There is no USB-C plug and no NFC radio here. The Nano-A is a USB-A stub a quarter inch thick and three-quarters of an inch wide, built to go into a port and stay there. On a desk with a tower or a dock and a free USB-A slot, that is the appeal: nothing to find, nothing to forget, nothing to unplug when you sit down.

The internals are more generous than the size suggests. It handles FIDO2/WebAuthn passkeys and passwordless login, and it also generates TOTP and HOTP codes — 200 passkey slots and 50 TOTP slots, more headroom than the YubiKey offers. At 14 grams it is denser than it looks, and the stubby body sits close to the chassis instead of levering against the port every time you bump the desk.

We like it as the fixed half of a pair. One Nano-A in the back of the desktop and a portable key for everything else covers a home office better than a single do-everything key does, because the one you never unplug is the one you never lose. Just plan around what it can't do: it can't touch a phone, it can't plug into a USB-C-only laptop, and if the tower goes to a repair shop, your key goes with it.

Six-tenths of an inch long and under four-tenths wide, this is the smallest key in the group, and the size is the whole argument. It slips into a crowded USB hub without covering the ports on either side of it. If you have ever unplugged something to make room for a security key, that detail matters more than any line on the spec sheet.

It is also the lowest-priced way into hardware security here, and it gives up less than you might expect to get there. FIDO2 and U2F cover passkey logins and standard two-factor; OATH HOTP is there for the event-based codes some workplace setups use. What is missing is NFC, USB-C, and TOTP. We see it as the spare that lives in a laptop bag, or the inexpensive way to find out whether hardware keys fit how you work before buying two of something better.

The single button is the only thing on it that moves, and it is what you press every time you log in, so it is the part to keep an eye on. The bigger practical limit is the connector: a USB-A plug is fine on a desktop or an older laptop, and it means an adapter on anything newer. Pair it with a USB-C key and you have covered both without paying flagship prices for the privilege.

The pitch is a PUF — a physically unclonable function — which means the key's secret is derived from microscopic physical variation in the chip instead of sitting in readable memory. In plain terms, there is no stored private key for anyone to extract. We can't verify unclonability from the outside, and for ordinary logins it changes little: what defeats a phishing page is the FIDO2 handshake, not the silicon underneath.

What we can judge is the shape of the thing. It is a compact USB-C plug with a hole for a keyring, it covers FIDO2 and U2F, and the compatibility list is the usual one — Windows, macOS, Linux, iOS, and Android — for any service that takes a hardware key. There is no NFC and no code generator, so it is a passkey key rather than a universal one.

Where it earns a place is the USB-C-only laptop and the buyer who wants an alternative to the biggest name in the category. We stop short of calling it a primary key for someone with a desktop tower and a phone to cover, because one USB-C connector leaves both of those out. As a dedicated key for a laptop that travels, it is simple, small, and does the one job without extra software.