The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What is the difference between FIDO2, WebAuthn, and U2F? They describe different parts of FIDO authentication, not interchangeable names. WebAuthn is the web-facing API; CTAP is the protocol a computer can use to communicate with an external authenticator; FIDO2 combines WebAuthn and CTAP. U2F is the earlier FIDO second-factor protocol, carried forward as CTAP1. A physical security key is one kind of authenticator, but FIDO2 can also use an authenticator built into a phone or computer.
How the names fit together
Think of WebAuthn as the website-facing request interface, CTAP as one route for the computer to communicate with an external key, and the key as the device that holds or uses a credential. FIDO2 is the broader standards pairing of WebAuthn and CTAP. The FIDO Alliance describes its standards as using public-key cryptography to provide phishing-resistant authentication with key pairs it calls passkeys.
As an Amazon Associate I earn from qualifying purchases.
| Term | What it means | What it is not |
|---|---|---|
| WebAuthn | The W3C web API for creating and using public-key credentials. | It is not a physical key; it is the website/browser-facing layer. W3C Web Authentication specification. |
| CTAP | The FIDO Alliance protocol family for communication between a platform and an authenticator, including external keys. | It is not the website-facing API. It is relevant when a platform communicates with a separate authenticator. FIDO CTAP specification. |
| FIDO2 | The standards pairing of WebAuthn and CTAP. | It is not one device model or another name for a security key. FIDO Alliance specifications overview. |
| U2F / CTAP1 | The earlier FIDO protocol for second-factor authentication, identified as CTAP1 in the newer framework. | It is not automatically unsupported or universally accepted by every modern service. FIDO Alliance specifications overview. |
| CTAP2 | A newer CTAP protocol that supports authentication experiences beyond the original U2F second-factor pattern. | It does not by itself guarantee a particular service accepts a particular key. FIDO Alliance specifications overview. |
| Security key | A physical external authenticator that can communicate with a device over a supported connection. | It is one kind of authenticator, not a requirement for all FIDO2 use. FIDO Alliance specifications overview. |
What happens when you register and sign in
A website, called the relying party, asks the browser or platform to register or use a public-key credential through WebAuthn. When the authenticator is external, the platform can communicate with it through CTAP. The same general model applies whether the authenticator is a separate key or built into a device, though the exact interaction varies by platform and authenticator.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRegistration
During registration, an authenticator creates a credential key pair for that service. The service stores the public-key credential data; the private-key side remains with, or is used by, the authenticator. The credential is associated with the service rather than being a reusable password that the user types into different sites.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Authentication
At sign-in, the service sends a fresh challenge through the browser/platform request. The authenticator uses the private-key side to produce a response, which the service checks against its stored public key. Depending on the device and request, the user may need to touch the authenticator, enter a PIN, or use a local biometric. When biometrics are used, the biometric information stays on the device rather than being sent to the website. FIDO Alliance specifications overview
Why this helps resist phishing—and what it does not solve
FIDO credentials are unique and bound to the online service domain. That scoping means a credential registered to a legitimate domain cannot simply be replayed by a look-alike phishing domain. It does not make every account attack impossible: compromised devices, malware, social engineering, weak account recovery, or implementation flaws can still put accounts at risk. FIDO Alliance specifications overview
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Can an old U2F key work with WebAuthn?
It can, if the sign-in service supports U2F/CTAP1 devices for the relevant authentication flow. The FIDO Alliance says existing U2F devices can continue to work with U2F services and with WebAuthn applications that support them. That is a compatibility possibility, not a guarantee for every account or website. Check the service’s current sign-in options before relying on an older key. FIDO Alliance passkeys overview
Do you need a physical security key for FIDO2?
No. FIDO2 includes both roaming/external authenticators, such as a USB or NFC key, and platform authenticators built into a phone or computer. A physical key is useful when you want a separate device or a backup option, but it is not required by the standards. FIDO Alliance specifications overview
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to choose a security key
Start with the accounts and devices you actually use. A key’s manufacturer-listed protocol support does not mean every service accepts it, and a connector is useful only if your device can use it.
- Check service support: Confirm that the account allows security-key or WebAuthn sign-in, and verify any U2F/CTAP1 requirement if you plan to reuse an older key.
- Match the connection: Choose a connector and transport your devices support, such as USB-A, USB-C, or NFC. Check the key’s exact compatibility rather than assuming all phones and computers support every connection.
- Consider functions: Some keys focus on FIDO authentication; others also offer capabilities such as one-time passwords, smart-card functions, or OpenPGP. Extra functions matter only if you have a use for them.
- Plan recovery: If the service permits it, register an appropriate backup authenticator so loss of one device does not leave you without an access path. Recovery rules vary by service.
For example, Yubico lists the Security Key C NFC as a FIDO-focused model with USB-C and NFC, and the YubiKey 5 NFC as a USB-A/NFC model with additional protocol families, including OTP, PIV-compatible smart card, and OpenPGP. These are illustrations of different connection and function choices, not independent rankings or a claim that either works with every service. Check the current product specifications and the service’s accepted sign-in methods before buying. Yubico Security Key C NFC · Yubico YubiKey 5 NFC
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
