enable-a-hardware-security-key

updated 2026-11-01, about 20 minutes[cite: 1]

← [ALT_PATH]

goal:


┌─────────────────────────────────────────────────────────────────────────────┐
│                                                                             │
│                            . - ~ ~ ~ - .   _..._                            │
│                        . 'S           ' ./.--._\.                        │
│                      ,       _.-''''-._    \    /                           │
│                     ,    _.-'    N     `-_  `--'  ,                         │
│                    ,   .'    _..----.._    `.   ,                         │
│                   ,   /    /'   __   `\    \   ,                          │
│                   ,  |    |    /  \    |    |  ,                         │
│                   ,  |    |   | 👁️ |   |    |  ,                         │
│                   ,   \    \   \__/   /    /   ,                          │
│                    ,   `.   `-.____K.-'    .'   ,                         │
│                     ,    `-.__________.-'    ,                          │
│                      ,         [Ω]         ,                            │
│                        ,                 , '                                │
│                          ` - , _ _ _ , - '                                  │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

what you need

two hardware keys that support FIDO2 or WebAuthn: one primary, one backup[cite: 1]
your password manager, open and unlocked[cite: 1]
a list of accounts to protect, starting with:
- your primary email[cite: 1]
- your password manager[cite: 1]
- your phone carrier or Apple, Google, or Microsoft account[cite: 1]

steps

Start with email. Whoever controls your email can usually reset every other password, so protect it first.[cite: 1]
Open the account’s security settings and look for security key, passkey, or two-step verification. The wording differs between services.[cite: 1]
Choose to add a key. When asked, insert it or tap it, then give it a name such as primary-keyring.[cite: 1]
Repeat with the second key and name it backup-safe. Store it somewhere other than your daily key.[cite: 1]
Save any recovery codes the service offers into your password manager.[cite: 1]
Test it: sign out, then sign back in using the key. Press Esc if a prompt gets stuck and try again.[cite: 1]

using a key for ssh

If you log in to servers over SSH, you can make a key that only works while the hardware key is plugged in. This needs OpenSSH 8.2 or newer.[cite: 1]

ssh-keygen -t ed25519-sk -C "primary-keyring"
cat ~/.ssh/id_ed25519_sk.pub

Add the printed public key to your server’s authorized_keys file, then test a login before closing your current session.[cite: 1]

why two keys

If losing one key would lock you out, that key is a single point of failure.[cite: 1]

key[cite: 1]	lives[cite: 1]	used for[cite: 1]
primary[cite: 1]	on your keyring[cite: 1]	daily sign-ins[cite: 1]
backup[cite: 1]	stored separately[cite: 1]	recovery only[cite: 1]

how to undo it

Open each account’s security settings and remove the key. Before you do, confirm that another sign-in method still works, or you may lock yourself out.[cite: 1]

related: all guides[cite: 1]