Expert Guide

The Best Hardware Security Keys in 2026

Issue the YubiKey 5C NFC unless a written control says otherwise, then add a FIDO-only spare or a higher-capacity key.

Louis CorneloupFounder, Dupple · 920,000+ readers · Updated Sep 2026

Product links may be affiliate links. How we rate 10 tools compared

TL;DR

The best hardware security key in 2026 is the YubiKey 5C NFC at $58. It stores 100 passkeys, supports FIDO2, smart card, and one-time passwords, and works over USB-C or NFC. Choose the Security Key C NFC at $29 when every account is already FIDO. Choose the Token2 PIN+ Dual at $29.67 when one key has to hold 300 passkeys.

The Google Titan USB-A/NFC key suits Advanced Protection when you do not need codes. The C Bio is for shared PCs, the FIPS 140-3 key is for a written validation, and the K9 Plus is the cheaper 140-2 option. Prices were verified on vendor US pages in September 2026.

Key facts10 tools compared: YubiKey 5C NFC, Security Key C NFC, Google Titan Security Key, Token2 PIN+…

Updated: September 23, 2026
Top pick: YubiKey 5C NFC (best for: The default company key when the fleet needs FIDO plus codes or smart card)
Top pick price as of September 23, 2026: YubiKey 5C NFC: From $58 (5C NFC, USB-C and NFC), on firmware 5.8, with 100 passkey slots.

10 tools compared: YubiKey 5C NFC, Security Key C NFC, Google Titan Security Key, Token2 PIN+ Dual, Thetis PRO, FEITIAN ePass K9 Plus, YubiKey C Bio, YubiKey 5C NFC FIPS, OnlyKey, Solo 2C
Security Key C NFC (best for: Accounts that are already FIDO, especially when you will enroll a spare key): From $29 (Security Key C NFC), FIDO2 and U2F only, and it does not generate codes.
Google Titan Security Key (best for: Google accounts that will enroll in the Advanced Protection Program): From $30 on the US Google Store, for the USB-A and NFC configuration.
Token2 PIN+ Dual (best for: One key that must hold a large passkey vault and plug in either way): From $29.67 (PIN+ Dual, 0% US VAT), with USB-A, USB-C, NFC, and 300 passkeys.

Issue the YubiKey 5C NFC unless a written requirement says otherwise, because it covers FIDO, smart card, and codes on one device. A FIDO-only key is the right spare when logins already speak passkeys, and the wrong spare when a VPN still wants a code.

A fingerprint key is for shared PCs, not a phone-heavy staff.

A hardware security key is a USB or NFC device that signs the login with a private key the site never sees.

A phishing page can collect a six-digit code, but it cannot replay that signature, so put email and the identity provider on a key.

Toolradar data: the September 2026 security ranking evaluated 816 tools.

The profiles that sit next to a key rollout are 1Password, Bitwarden, Okta, and Duo.

The vault decision is the password manager guide.

How we ranked: ten keys, US prices read on 23 September 2026, by passkey capacity, protocols, and whether FIPS or a fingerprint is in the requirement.

Authenticator apps are covered in the 2FA authenticator guide.

Top Picks

Based on features, real-world fit, and value for money.

Best Hardware Security Keys in 2026: 10 tools compared, updated Sep 2026
Tool	Pricing	Best for
YubiKey 5C NFC	From $58 (5C NFC, USB-C and NFC), on firmware 5.8, with 100 passkey slots.	The default company key when the fleet needs FIDO plus codes or smart card
Security Key C NFC	From $29 (Security Key C NFC), FIDO2 and U2F only, and it does not generate codes.	Accounts that are already FIDO, especially when you will enroll a spare key
Google Titan Security Key	From $30 on the US Google Store, for the USB-A and NFC configuration.	Google accounts that will enroll in the Advanced Protection Program
Token2 PIN+ Dual	From $29.67 (PIN+ Dual, 0% US VAT), with USB-A, USB-C, NFC, and 300 passkeys.	One key that must hold a large passkey vault and plug in either way
Thetis PRO	From $32.99 (Thetis PRO, USD), with USB-A, USB-C, NFC, and 200 passkey slots.	A dual-connector key with more passkeys when FIDO Level 1 is acceptable
FEITIAN ePass K9 Plus	From $39.50 (K9 Plus, USD), USB-A and NFC, with FIPS 140-2 Level 2.	A FIPS 140-2 key with PIV when the YubiKey FIPS sticker is too high
YubiKey C Bio	From $98 (YubiKey C Bio, USB-C), fingerprint, FIDO only, and no NFC tap.	Shared PCs where the check should be a fingerprint, not a PIN
YubiKey 5C NFC FIPS	From $88 (5C NFC FIPS 140-3), same protocols as the non-FIPS key, without extra passkey slots.	Controls that name FIPS 140-3 and will not accept a standard 5 Series key
OnlyKey	Sale $55.99, regular $69.99 (USD), PIN pad on the key, inventory on the way.	A personal device that holds passwords and FIDO, if you can wait for stock
Solo 2C	From $34 (Solo 2C, USD), USB-C, no NFC, and open-source firmware.	Buyers who want open-source firmware and can live without a phone tap

Pricing read from each vendor's own published pricing page, checked Sep 2026. Every vendor here publishes a price.

YubiKey 5C NFC

Top Pick

Best for: The default company key when the fleet needs FIDO plus codes or smart card

PricingFrom $58 (5C NFC, USB-C and NFC), on firmware 5.8, with 100 passkey slots.

+USB-C and NFC are on the current US page with FIDO2 Level 2, so a phone tap needs no dongle.

+The spec lists 64 OATH slots, 24 PIV certificates, and OpenPGP for a VPN or a badge outside passkeys.

+Orders of 50 to 199 single keys are 4% off, and 200 or more are 6% off, but mixed trays do not qualify.

−You paid for PIV and OpenPGP you may never enroll, so a staff that only needs FIDO is overbuying.

−Free US and Canada shipping starts at $100, so one key misses it, and the USB-A 5 NFC is the same sticker.

Visit YubiKey 5C NFC →

Security Key C NFC

Best for: Accounts that are already FIDO, especially when you will enroll a spare key

PricingFrom $29 (Security Key C NFC), FIDO2 and U2F only, and it does not generate codes.

+The USB-A model is the same sticker as USB-C, so an older laptop does not force a second purchase.

+It lists FIDO2 Level 2, CTAP 2.1, and NFC, with the same passkey capacity as the 5 Series.

+The same bulk breaks as the 5 Series apply at those breakpoints, which matters once a spare doubles the order.

−PIV, OpenPGP, and OATH are marked no, and it does not generate codes, so a six-digit VPN needs the 5 Series.

−One portal that still wants HOTP makes this the wrong company standard, because those people need another key.

Visit Security Key C NFC →

Google Titan Security Key

Best for: Google accounts that will enroll in the Advanced Protection Program

PricingFrom $30 on the US Google Store, for the USB-A and NFC configuration.

+The US store sells the USB-A and NFC configuration, so you are not choosing among unpublished connector prices.

+Google says the key uses a secure element and firmware it built to check integrity, which suits Google accounts.

+It works with the Advanced Protection Program, and the box includes a USB-C adapter, so there is no separate dongle.

−Google publishes no passkey capacity, PIV applet, or OTP count, so you cannot size a vault or a code-based VPN.

−There is no separate USB-C price, because the listed key is USB-A with NFC, and a USB-C shop should use Yubico.

Visit Google Titan Security Key →

Token2 PIN+ Dual

Best for: One key that must hold a large passkey vault and plug in either way

PricingFrom $29.67 (PIN+ Dual, 0% US VAT), with USB-A, USB-C, NFC, and 300 passkeys.

+The 2+ price on that page is $29.52 and the key is in stock, so a spare costs less than two singles.

+Release 3 puts USB-A, USB-C, and NFC on one key, covering an old laptop, a new laptop, and a phone.

+FIDO Level 2, OpenPGP, and PIV from firmware 3.3 are listed, and the PIN must be 6 digits with complexity.

−TOTP secrets sit on the key, but codes need Token2's companion app, so the key alone is not an authenticator.

−Runbooks name Yubico more often than Token2, so test Okta or Entra before you buy a tray you cannot enroll.

Visit Token2 PIN+ Dual →

Thetis PRO

Best for: A dual-connector key with more passkeys when FIDO Level 1 is acceptable

PricingFrom $32.99 (Thetis PRO, USD), with USB-A, USB-C, NFC, and 200 passkey slots.

+USB-A, USB-C, and NFC sit on one device, which removes the dongle without buying Yubico for the connectors.

+The spec lists 50 OATH slots plus SHA-256, AES, HMAC, ECDH, and ECDSA, so code-based logins can live here.

+Thetis, Razzo Tech Corporation in Newark, California, tells buyers to buy two keys so a loss is not a lockout.

−The certificate is FIDO2 Level 1, and the 5C NFC and PIN+ Dual are Level 2, so that control drops it.

−TOTP and HOTP go through Thetis apps, and the USB-A-only key is $26.99, so that cheaper plug fails on USB-C.

Visit Thetis PRO →

FEITIAN ePass K9 Plus

Best for: A FIPS 140-2 key with PIV when the YubiKey FIPS sticker is too high

PricingFrom $39.50 (K9 Plus, USD), USB-A and NFC, with FIPS 140-2 Level 2.

+The US store has the K9 Plus in stock with USB-A and NFC, while a USB-C laptop still needs a dongle.

+It is FIDO2 and U2F certified at FIPS 140-2 Level 2 and Physical Security Level 3, with PIV and OpenPGP.

+It lists OATH-HOTP, OATH-TOTP, a static password, challenge-response, and IP67, so a wet keyring still works.

−Slots: 2 sits beside the OATH lines, and passkey capacity is unpublished, so that figure is not the vault size.

−Volume pricing is a sales email, and the A4B is $19.60 without NFC, so the cheaper key cannot tap a phone.

Visit FEITIAN ePass K9 Plus →

YubiKey C Bio

Best for: Shared PCs where the check should be a fingerprint, not a PIN

PricingFrom $98 (YubiKey C Bio, USB-C), fingerprint, FIDO only, and no NFC tap.

+The fingerprint has a PIN fallback, so a failed read does not lock someone out of the shared PC.

+FIDO2 Level 2 and CTAP 2.1 are listed, and Yubico Authenticator manages the biometrics on desktop.

+Bulk pricing follows the 5 Series breakpoints, so a large shared-PC order is not stuck on single-unit pricing.

−There is no NFC, so a phone needs a USB-C port, and PIV, OpenPGP, and OATH are missing as well.

−The fingerprint is the only check the 5C NFC lacks, so buy the Bio only when that check is required.

Visit YubiKey C Bio →

YubiKey 5C NFC FIPS

Best for: Controls that name FIPS 140-3 and will not accept a standard 5 Series key

PricingFrom $88 (5C NFC FIPS 140-3), same protocols as the non-FIPS key, without extra passkey slots.

+USB-C and NFC are on this FIPS 140-3 key, so staff handle it the same way as the standard key.

+PIV, OpenPGP, OATH, Yubico OTP, and FIDO2 Level 2 remain, so this is not a FIDO-only key with a new label.

+The 5C FIPS 140-3 is $95 and the 5Ci FIPS 140-3 is $115, and the 140-2 line uses those same stickers.

−AAL3 is available without FIPS, so Gmail and an ordinary company login do not need this more expensive SKU.

−If the auditor did not write FIPS 140-3 down, buy the standard key and put the difference into spares.

Visit YubiKey 5C NFC FIPS →

OnlyKey

Best for: A personal device that holds passwords and FIDO, if you can wait for stock

PricingSale $55.99, regular $69.99 (USD), PIN pad on the key, inventory on the way.

+The sale is listed against the regular price, but inventory is on the way, so the discount is not a ship date.

+The PIN is entered on the key, and 10 failed attempts erase the data, which stops a guess on a found key.

+FIDO2, U2F, Yubico OTP, and TOTP are supported, so accounts that still want a code are covered.

−Inventory is on the way, so do not promise a ship date, and do not place this key on a fleet purchase order.

−Passwords and the second factor share one device, and 10 bad PINs wipe both, so this is not a fleet key.

Visit OnlyKey →

Solo 2C

Best for: Buyers who want open-source firmware and can live without a phone tap

PricingFrom $34 (Solo 2C, USD), USB-C, no NFC, and open-source firmware.

+Hardware and software are open source, which is why the missing tap is acceptable if you audit firmware.

+FIDO2 and U2F on USB-C, two cases, and US fulfillment mean a pilot is not waiting on an overseas tray.

+The USB-A Solo 2 is $35, and the Solo 2A+ NFC is $46 if you need the tap and can pay for it.

−The 2C has no NFC, so phone sign-in needs a cable, which a phone-heavy staff will feel on every login.

−US shipping on that page is $3 on top of the key, and SoloKeys publishes no passkey slot count.

Visit Solo 2C →

What it is

FIDO2 and U2F sign the login in the browser, so a copied password is not enough. A passkey on the key is a discoverable credential, and a full key forces a second device.

NFC is what lets you tap a phone instead of plugging in, so no NFC means the phone needs a USB port. A USB-A-only key needs a dongle on a USB-C laptop.

Why it matters

The spare is the real bill, because one key on a ring is a lockout the day it goes through the wash.

Two YubiKey 5C NFC keys are $116, and that pair clears Yubico's free shipping on US and Canada orders of $100 or more.

One key at the single-unit sticker does not clear that bar, and a 10-person issue changes the winner again in the pricing section.

Cyberpresso data: the newsletter reaches 27,000 security readers at a 28% open rate, from the audience file updated 20 September 2026.

Those readers approve a phishing-resistant key the same week finance wants a number, so the spare belongs in the figure you send.

Pair the key with a password manager, and keep break-glass admin credentials in a secrets manager, not on the same ring.

Key features to look for

Passkey slots

Discoverable credentials are finite, so a full key forces a second device. The YubiKey family, the Security Key, the Bio, and the FIPS model share one count. Thetis and Token2 publish higher caps when that count will not hold the vault.

Protocols beyond FIDO

Smart card, OpenPGP, and one-time passwords rule a key in or out of a real fleet. A FIDO-only key cannot feed a VPN that still wants a TOTP code, so those users need the 5 Series.

Connector and NFC

USB-C, USB-A, both, or a tap decides who can sign in on the hardware they already carry. No NFC means no phone tap, and USB-A only means a dongle on a new laptop.

Certification that is actually required

FIDO2 Level 2 is on the YubiKey 5 series, the Security Key, the Bio, and the Token2 PIN+ Dual, while Thetis PRO is Level 1. FIPS 140-3 is a separate, more expensive line, bought only when the auditor wrote that validation down.

Pricing

USD figures below were verified on 23 September 2026 on Yubico's US store, Google's US store, FEITIAN's US store in USD, Token2's US VAT line, Thetis, OnlyKey, and SoloKeys.

A 10-person issue of YubiKey 5C NFC keys is $580, against $290 for Security Key C NFC keys and $296.70 for Token2 PIN+ Dual keys.

The FIDO-only and high-capacity bills sit together, while the default key is what moves the budget.

Thetis PRO for those ten is $329.90, the K9 Plus is $395, and FIPS 140-3 5C NFC for ten is $880, a premium only when the control names the validation.

Ten Solo 2C keys are $340 before shipping is added.

Two 5C NFC keys clear Yubico's free US and Canada shipping while one key does not, so put the spare in the same order. The FEITIAN A4B is $19.60 and USB-A only, so ten of them are $196 with no phone tap. SoloKeys adds US postage on the 2C page, on top of the key price.

Plan	Price	Best for
YubiKey 5C NFC	$58	USB-C, NFC, 100 passkeys, PIV, OATH, and firmware 5.8
YubiKey 5C	$65	USB-C, no NFC, same protocols, so a phone loses the tap
YubiKey 5 Nano and 5C Nano	$68	Leave-in keys on the US store that stay plugged into a desktop
YubiKey 5Ci	$85	USB-C plus Lightning, for a desk that still has that port
Security Key C NFC	$29	FIDO2 and U2F only, and the USB-A model is the same sticker
YubiKey 5C NFC FIPS 140-3	$88	The 140-2 version of this SKU carries the same US sticker
YubiKey 5C FIPS 140-3	$95	USB-C, FIPS, and no NFC, so there is no phone tap
YubiKey 5Ci FIPS 140-3	$115	Lightning plus FIPS for a shop that still has those phones
YubiKey C Bio	$98	Fingerprint, USB-C, FIDO only, no NFC, so phones need a cable
Google Titan USB-A/NFC	$30	USB-A and NFC on the US Google Store, the one to budget
FEITIAN ePass K9 Plus	$39.50	USD, USB-A, NFC, and FIPS 140-2 Level 2 for that control
FEITIAN ePass A4B	$19.60	USD, USB-A only, FIDO2 and U2F plus HOTP, and no tap
Token2 PIN+ Dual, 1+	$29.67	0% US VAT, 300 passkeys, both USB ports, and NFC together
Token2 PIN+ Dual, 2+	$29.52	Volume step on the same page, so the spare costs less per key
Thetis PRO	$32.99	USD, both USB ports, NFC, 200 passkeys, and FIDO2 Level 1
Thetis FIDO2 USB-A	$26.99	One connector, TOTP via the app, so USB-C needs a dongle
OnlyKey, sale	$55.99	Sale price against a regular $69.99, inventory still on the way
Solo 2C	$34	USB-C, no NFC, open source, so a phone needs a cable
Solo 2 USB-A	$35	No NFC on this USB-A model, so a phone still cannot tap
Solo 2A+ NFC	$46	USB-A and NFC, for buyers who need the tap the 2C lacks
SoloKeys US shipping	$3	Postage on the Solo 2C page, added on top of the key price
Yubico free shipping, US and Canada	$100	Free shipping minimum for US and Canada, plus 45-day returns
Two YubiKey 5C NFC keys	$116	Clears free shipping, so order the spare with the first key
YubiKey 5 bulk, 50 to 199	4% off	6% off above the first breakpoint, with no mixing of trays

Mistakes to avoid

×Buying one key means a lockout the day it is lost, and that single-key order also misses the free-shipping bar.

×Issuing the Security Key to a VPN that still wants a six-digit code fails, because that key does not generate codes and the 5 Series does.

×Buying the FIPS 140-3 key because it sounds stricter wastes the premium, since the non-FIPS page says AAL3 applies when FIPS is not required.

×Reading FEITIAN's Slots: 2 as two passkeys is wrong, because those slots sit beside OATH and the passkey count is not published.

×Putting OnlyKey's $55.99 sale price on a purchase order is a mistake while inventory is on the way, and the regular price is $69.99.

×Issuing the YubiKey C Bio to a phone-heavy staff removes the tap path, because that model has no NFC and every phone login needs a cable.

Expert tips

→Enroll two keys on email, the identity provider, and the password manager, and keep the spare in a drawer rather than on the same ring.

→Price ten people on the 5C NFC and again on the Security Key before you write the standard, because those bills are different decisions.

→Check the connector on the oldest laptop and the newest phone, because USB-A-only and NFC-less keys fail in opposite rooms.

→Leave admin break-glass in a secrets vault, not on the day-to-day keyring.

→If you want the next sticker change in the inbox, the Cyberpresso daily brief is the short version of this control call.

The bottom line

YubiKey 5C NFC is the key to issue when the company needs one standard: FIDO2, smart card, one-time passwords, and NFC. Buy a second one in the same order so the spare exists and the shipment clears free US and Canada shipping.

The Cyberpresso brief is where the next sticker change shows up.

Choose the Security Key C NFC when every login is already FIDO.

Choose Token2's PIN+ Dual when a large store and both USB plugs matter more than the runbook logo.

Choose the Titan for Advanced Protection, the K9 Plus for FIPS 140-2, the C Bio for a fingerprint, and FIPS 140-3 only when the auditor wrote it down.

The wider control set is the zero trust guide.

OnlyKey is a personal PIN pad, because a wipe takes the passwords and the second factor together.

Solo 2C is the open-source USB-C key without a tap.

The vault sits in the 1Password review and the Bitwarden review, with email security and MDM beside it.

Cite this: Cyberpresso, "Best Hardware Security Keys in 2026", September 2026.

Frequently asked questions

What is the best hardware security key in 2026?

The YubiKey 5C NFC, at $58 on Yubico's US store as of 23 September 2026, supports FIDO2, U2F, smart card, OpenPGP, and one-time passwords over USB-C or NFC on firmware 5.8. Pick the Security Key C NFC at $29 when every login is already FIDO and you will not miss codes. Pick the Token2 PIN+ Dual at $29.67 when you need the largest passkey store on this list and both USB plugs.

How much does a hardware security key cost?

On vendor US pages checked 23 September 2026, ten default keys are $580 before any bulk discount, ten FIDO-only Yubico keys are $290, and ten Token2 PIN+ Dual keys are $296.70. Those lower ten-packs sit near each other, and the default standard costs more. Ten Thetis PRO keys are $329.90, ten K9 Plus keys are $395, and ten FIPS 140-3 5C NFC keys are $880. A Titan USB-A/NFC key is $30, a C Bio is $98, and ten Solo 2C keys are $340 before shipping.

Is there a free hardware security key?

No ranked key is free, so a pilot still needs a budget line. The lowest USD price on a vendor store here is the FEITIAN ePass A4B at $19.60, and it is USB-A only, so there is no phone tap. Solo 2C is $34 before $3 of US shipping. A free authenticator app still yields a code a phishing site can collect, which is why email and the identity provider belong on a key.

YubiKey 5C NFC vs Security Key C NFC: which should a company buy?

Buy the 5C NFC if any system still needs a one-time password, a smart card, or OpenPGP. The Security Key cannot do those jobs, and it marks PIV and OATH as no. Buy the Security Key C NFC if every login is FIDO2 or U2F, and treat missing codes as a hard stop. Both offer the same passkey capacity, FIDO2 Level 2, and NFC. Two Security Key C NFC keys cost the same as one 5C NFC, the spare math for an all-FIDO fleet.

How many passkeys fit on a hardware key?

Yubico lists 100 passkey slots on the 5C NFC, and the Security Key, the C Bio, and the FIPS model match that count. Switching among those four does not buy more room. Thetis lists 200 on the PRO when someone enrolls more sites than a YubiKey holds. Token2 lists up to 300 on the PIN+ Dual Release 3. Titan and the K9 Plus publish no passkey capacity, and the two OATH slots on the K9 Plus are not that count.

Do I need a FIPS hardware security key?

Buy FIPS when the control names it, not because the label sounds stricter than the standard key. The YubiKey 5C NFC FIPS 140-3 is $88, with the same passkey capacity and the same PIV and OTP support as the non-FIPS key, so you pay for the validation. The non-FIPS page says AAL3 is available if FIPS is not required. FEITIAN's K9 Plus states FIPS 140-2 Level 2 plus Physical Security Level 3, with no published passkey count, and it is the cheaper 140-2 option.

Is a hardware key better than an authenticator app?

A hardware key is the stronger factor because the login is a signature bound to the site, not a code you can type into a fake page. Use the key on email, the identity provider, and the password manager, where a takeover does the most damage. Where a vendor still only offers TOTP, use an app, and the 2FA authenticator guide is the roundup of those apps.

What happens if I lose my only security key?

You are locked out of every account that had no second key and no recovery method. A 45-day Yubico return does not restore an enrolled key you already lost, so that window is not a backup. Enroll two keys when you turn the feature on, and keep the spare off the commuting ring. Two YubiKey 5C NFC keys are $116, and that order clears the $100 free-shipping minimum for US and Canada.

Some offers on this page may be paid placements or contain affiliate links.

Get the Cyberpresso brief

Free daily newsletter, read in 5 minutes.

Subscribe free