Using a YubiKey or Passkey to Sign In

Passwords can be guessed, reused, or typed into a fake login page without you realising. A YubiKey or passkey removes that risk almost entirely, because there’s no password for anyone to steal in the first place.

What’s the difference?

• A YubiKey is a small physical device, usually on your keychain, that plugs into a USB port (or taps against your phone if it supports NFC). You touch it when asked, and that’s your proof of identity.
• A passkey does the same job without a separate gadget — it’s built into your phone, laptop, or Windows itself, and uses your fingerprint, face, or device PIN instead of a password.

Both work the same way at a high level: instead of typing something that could be copied or phished, you prove it’s really you using something you physically have (your key, your phone, your face).

Why they’re safer than a password (even with MFA)

A text-message or app-based MFA code can still be tricked out of you by a convincing fake login page — you might type the code into the wrong site without noticing. A YubiKey or passkey can’t be phished this way: it only works on the genuine site it was set up for, so even if you land on a lookalike page, sign-in simply won’t go through.

Tip

If your account offers a choice of MFA methods, a YubiKey or passkey is the strongest option available — stronger than a text message or an authenticator app code.

Setting up a YubiKey

1. Sign in to your account’s security settings (ask support for the exact link if you’re not sure where this is).
2. Choose Add a security key.
3. When prompted, insert the YubiKey into a USB port (or tap it on your phone) and touch the metal contact when it flashes.
4. Give it a name you’ll recognise, like “My YubiKey,” so you can tell it apart from other sign-in methods later.

Setting up a passkey

1. In the same security settings, choose Add a passkey.
2. Your device will ask you to confirm with your fingerprint, face, or PIN — whatever you already use to unlock it.
3. That’s it — no separate hardware to carry or keep charged.

Using it day to day

When you sign in, you’ll be prompted to touch your YubiKey or confirm with your fingerprint/face, instead of typing a password. It’s usually faster than typing a password and a code.

Caution

Keep a second YubiKey or passkey registered as a backup if you can. If your only key is lost and you have no backup method set up, getting back into your account takes longer and needs support to step in and verify your identity manually.

If you lose your YubiKey or change devices

Contact support straight away so we can remove the lost key from your account — this stops anyone who finds it from using it to sign in. If you’re switching to a new phone or laptop, your passkeys usually carry over automatically if you’re signed into the same account (e.g. iCloud Keychain or a Google account); if they don’t, just add a new passkey from the new device the same way you set up the first one.