YubiKey is a hardware security key made by Yubico that proves a user's identity at login with a physical touch, providing phishing-resistant 🏷️#two-factor-authentication for accounts and devices.
A YubiKey plugs into a USB-A, USB-C, or Lightning port, or taps against a phone over NFC. When a supported site asks for a second factor, the user touches the key, and it answers with a cryptographic signature tied to that specific website. Because the key checks the site's real address, a convincing fake login page cannot capture anything usable, which is the main advantage over codes sent by text message or typed from an authenticator app.
The current YubiKey 5 Series supports FIDO2/WebAuthn and passkeys, FIDO U2F, one-time passwords, smart card (PIV), and OpenPGP, so one key can secure email, password managers such as 📝1Password, cloud accounts, and computer logins. Keys cost roughly $50 to $95 depending on model and connector, and Yubico recommends registering at least two per account so a spare is available if one is lost.
During the October 2026 wave of breaches, this is what I pointed my dad toward: a key on the keychain is the simplest way I know to make a stolen password worthless.