Best hardware security keys 2026: YubiKey, Nitrokey, Token2

Most people should buy a YubiKey 5 NFC or USB-C NFC if they want one key that does everything. Choose Nitrokey 3 for open source firmware and updates, and choose a Token2 key or the Yubico Security Key Series for the lowest price when passkeys and two-factor login are all you need. Prices and specifications come from vendor pages and reports as of October 2026. This is an editorial comparison, not a laboratory test, and we have not run hands-on endurance or security tests.

Comparison table

Model	FIDO2 and passkeys	Extra functions	Connectors	Passkey slots (per vendor)	Open source	Origin	Price (approx.)
YubiKey 5 series	Yes	OTP, OATH, PIV, OpenPGP	USB-A, USB-C, NFC, Lightning (5Ci)	100	No	Sweden / USA	59 to 90 EUR
Security Key Series	Yes	None (FIDO only)	USB-A or USB-C, NFC	100	No	Sweden / USA	about 35 EUR
Nitrokey 3	Yes	OTP, OpenPGP, PIV, password safe	USB-A or USB-C, NFC	Up to 100 (varies with use)	Yes (Rust firmware)	Germany	60 to 65 EUR
Token2 (PIN+ Release2)	Yes	TOTP, HOTP	USB-A and USB-C, NFC	Up to 300	Check model	Switzerland	about 25 EUR
Google Titan	Yes	None	USB-C, NFC	Reported 250	No	USA (made by Feitian)	about 35 to 45 EUR

Prices are approximate, taken from vendor shops and reports, and include or exclude VAT depending on the source. Check the current price in your country.

What to look for

Choose by use case rather than by brand. Check for FIDO2 and passkey support if you want passwordless login, NFC if you use phones, and USB-C if your laptop has no USB-A. Add OpenPGP, PIV or OTP only if you will use them for email signing, SSH, smart-card login or legacy services. Check how many passkeys the key can hold, whether the firmware can be updated, and whether you trust the vendor. Our guide to hardware security keys explains these terms, and phishing-resistant MFA shows why keys are the strongest everyday option. The underlying standards are described under FIDO2 and WebAuthn.

YubiKey 5 series

The YubiKey 5 series is the reference point. It supports FIDO2 and U2F, smart-card PIV, OpenPGP, Yubico OTP and OATH TOTP and HOTP, runs firmware 5.8 on current stock, and stores 100 passkeys according to Yubico. Models include the 5 NFC (USB-A), 5C NFC, 5C, Nano variants and the 5Ci with USB-C and Lightning. Keys are made in Sweden, rated IP68 and need no battery. Euro prices on Yubico’s store run from about 59 EUR for the 5 NFC to about 90 EUR for the 5Ci, with the 5C NFC at roughly 65 to 69 EUR depending on country.

Caveats: the firmware is closed and cannot be updated, and models with firmware older than 5.7 were affected by EUCLEAK (see below). Read our full YubiKey 5 review.

Yubico Security Key Series

The Security Key Series is Yubico’s lower-cost line. It supports FIDO2, WebAuthn and U2F only, with no PIV, OpenPGP or OTP, and the Yubico Authenticator app does not work with it. Current models run firmware 5.8, store 100 passkeys, come in USB-A NFC and USB-C NFC versions and cost about 35 EUR on Yubico’s store. It is the sensible pick if you only need passkeys and second-factor login, and it shares the closed firmware and the EUCLEAK history of older units.

Nitrokey 3

Nitrokey 3 is a German product with open source firmware written in Rust on the Trussed framework, developed with a partner. It supports FIDO2, one-time passwords, an OpenPGP smart-card function, PIV on Windows and an encrypted password safe, and it uses a Common Criteria EAL6+ secure element. The firmware can be updated. Prices in the Nitrokey shop were about 60 EUR for the 3A NFC (USB-A) and 65 EUR for the 3C NFC (USB-C). Passkey capacity grew with firmware: it was limited to around 10 on older versions, and release notes for 1.8.2 raised the maximum to 100, though the real number depends on what else the key stores. Check the current figure before you buy. Nitrokey 3 uses NXP components rather than the Infineon library behind EUCLEAK. For a head-to-head, see YubiKey vs Nitrokey.

Token2

Token2 is a Swiss maker with a broad range of FIDO2 keys, including models with a PIN complexity feature at firmware level. The PIN+ Release2 dual model has USB-A and USB-C, NFC, FIDO2.1, up to 300 passkeys, plus 50 TOTP and one HOTP entry, at about 25 EUR. Swiss authorities list Token2 keys among supported options for AGOV sign-in. It is a very good value choice, but the product range is wide, so compare models carefully, and confirm whether firmware updates and open source claims apply to the model you pick.

Google Titan Security Key

The Titan Security Key is built by Feitian with Google firmware. It supports FIDO2 and passkeys, has been reported to store up to 250 passkeys and offers USB-C and NFC. Its limits are that it cannot list or delete individual passkeys and its firmware cannot be updated. It was introduced in Europe at 45 EUR for the USB-C model, so check the Google Store for today’s price. It is a fine budget option for Google account protection, but it lacks the extra applications of YubiKey and Nitrokey.

The EUCLEAK vulnerability

In September 2024, researchers published EUCLEAK, a side-channel attack on the ECDSA implementation in an Infineon cryptographic library used in some security chips. Yubico said that YubiKey 5 series and Security Key devices with firmware before 5.7.0 were affected, rated it moderate with a CVSS score of 4.9, and noted that an attacker would need physical possession of the key, specialised equipment, custom software and knowledge of the accounts to target. Firmware 5.7 (May 2024) removed the issue by using Yubico’s own cryptographic library, but older keys cannot be updated. Read Yubico’s advisory for the details. In practice, buy keys with firmware 5.7 or newer, and retire older ones if your threat model includes targeted physical attacks.

Passkey slots: how many do you need?

The slot counts in the table sound large, but most people store only a handful of passkeys on a key. Many services still use the key as a second factor rather than as a passkey store, and a password manager or phone can hold your everyday passkeys. A key is most valuable for your most sensitive accounts: email, password manager, cloud storage, domain registrar and banking where supported. Hardware-bound passkeys on the key cannot be copied off it, which is the point, and also the reason you need a spare.

Backup and loss

Register at least two keys with every important account, keep one at home and one in a safe place elsewhere, and keep printed backup codes for the case that both go missing. Our guides to account recovery and backup codes explain how to build a recovery plan that does not depend on a single device. Treat a lost key as an incident: remove it from your accounts as soon as you can.

What we could not verify

We did not buy or test the keys, we relied on vendor pages, forum reports and news coverage, and prices differ by country and over time. Passkey capacity for Nitrokey 3 and Google Titan, and the firmware update status of Token2 models, should be confirmed on the vendor pages for the exact model. We also did not verify which models are certified at which FIDO level.

Our recommendation

If you want…	Choose
One key for everything, widest support	YubiKey 5 NFC or 5C NFC
Cheapest passkeys and 2FA	Security Key Series or Token2
Open source and updatable firmware	Nitrokey 3
Highest passkey capacity	Token2 PIN+
Simple Google-centred setup	Google Titan

Whichever you choose, buy two, register both, and learn how to set up passkeys before you need them.