| Peter Wind
--:--
If you’re looking to enhance the security of your online accounts, you’ve probably encountered both the terms “passkey” and “YubiKey”. Although the two have a lot in common, it’s important to understand the difference between passkey vs. YubiKey so that you know exactly how the method you chose to secure your account works.
Key highlights:
- Passkeys are an alternative to passwords which is resistant to phishing attacks and more convenient to use.
- Passkeys generated through platforms such as Google and Apple are copyable, allowing them to be synced across multiple devices.
- A YubiKey is a hardware security key that provides a very secure method of 2-factor authentication. YubiKey devices can store passkeys, although these passkeys are not copyable.
What is a passkey?
A passkey is a type of credential that allows online platforms to give their users a secure and passwordless way to access their account. Passkeys are designed to protect users against cyber attacks such as phishing, which traditional username / password combinations are vulnerable to.
They’re also more convenient than passwords as you don’t need to remember your passkey or input it at any time when you’re logging into your account.
As explained by passkey.org, the name “passkey” has been adopted to refer to credentials which adhere to WebAuthn/FIDO2 standards for passwordless logins.
Passkeys take advantage of public key cryptography to enhance security. A passkey consists of a public key and a private key. The public key is stored on a server used by the platform you’re logging into.
The private key is securely stored on a device you own (for example a smartphone). The same private key can be stored on multiple devices, so that you can still access your accounts even if one of them gets lost or stolen.
When you’re signing into your account, the public key is checked against a signature derived from your private key – if they match, you’ll be allowed to sign in. During this process, you’ll be asked to unlock your device with your fingerprint, a face scan or a screen lock. This is done to ensure that nobody else would be able to access your accounts if your device was stolen.
What is a YubiKey?
YubiKey is a series of physical security keys for 2-factor authentication (2FA) sold by the company Yubico. These devices are designed to provide an extra layer of protection when signing in to online accounts, accessing computers or even entering physical spaces.
Since a specific physical device is required to sign in to accounts secured by a YubiKey, using a YubiKey is more secure than using other 2FA methods such as SMS codes or authenticator apps.
During the sign-in process, you simply need to insert your YubiKey into your computer’s USB port or use it with an NFC-enabled smartphone if you’re signing in on mobile.
YubiKey 5 series security keys come in 5 variants, including USB-A, USB-C, Lightning and small form factor options. The YubiKey 5 series supports a broad range of authentication protocols, including Webauthn/FIDO2, FIDO2 U2F, OTP and OpenPGP3.
If you’re trying to find which YubiKey device is best for your needs, check out our article exploring the differences between the YubiKey 5 and the YubiKey 5 FIPS.
Passkey vs YubiKey – Understanding the difference
The crucial difference between passkey and YubiKey devices is that passkeys stored by YubiKeys cannot be copied.
Meanwhile, passkeys created through platforms such as Google or Apple are copyable, which allows them to be synced across multiple devices.
Although these passkeys are an improvement over traditional passwords since they are not vulnerable to phishing attacks, passkeys bound to hardware YubiKey devices offer a higher degree of security overall.
What is the difference between a passkey and a password?
Passwords function by using a word, phrase, or sequence of characters, often in conjunction with a username, to grant access to accounts. In contrast, passkeys employ the principles of public and private key cryptography for authentication. After a passkey is set up, the authentication process at login happens seamlessly, requiring little to no further action from the user.
The bottom line
Passkeys are an increasingly popular solution that allows users to access their online accounts instead of using a password. In comparison to passwords, passkeys are resistant to phishing attacks, and also offer a more streamlined user experience.
On the other hand, YubiKeys are a specific series of hardware devices that provide a very secure way of 2-factor authentication. YubiKey devices store passkeys, but these passkeys are not copyable. In contrast, passkeys you receive from platforms like Google and Apple are copyable so that they can be synced across various devices owned by the user.
If you’re looking to purchase a security key and aren’t sure which device to pick, we provide a comparison between Google Titan and YubiKey security keys.
