Endpoint protection can make it harder for malware to steal or misuse credentials, but it cannot make secrets safe by itself. Protecting passwords, API keys, tokens, and cryptographic keys also requires secure storage, strong identity controls, careful token validation, lifecycle management, and a plan for responding to suspected theft.
What endpoint protection means for secrets
Endpoint protection is the set of device-level controls used to reduce malware compromise and detect or contain malicious activity on computers and other devices. Here, secrets means any authentication or authorization material that can enable access—not just passwords. That includes API keys, connection strings, cryptographic keys, software authenticator keys, and access or session tokens.
As an Amazon Associate I earn from qualifying purchases.
These controls address different parts of the problem. Endpoint hardening can reduce the chance that malware reaches credentials on a covered device. Monitoring and response can help identify and contain suspicious activity. Identity and token controls determine whether stolen material can still be used. Microsoft describes a similar layered approach to token theft: minimize risk, detect and mitigate successful theft, and protect against replay. Microsoft’s guidance is specific to Microsoft Entra ID and its device-management ecosystem.
How a compromised device puts credentials at risk
Malware on an endpoint may capture keystrokes, read a secret displayed or stored on the device, compromise a software authenticator, or use the device to carry out or proxy an authentication attempt for an attacker. NIST’s digital-identity security guidance discusses these endpoint-authenticator threats and recommends, among other mitigations, securing endpoints against malware such as keyloggers. NIST SP 800-63B also identifies hardware authenticators that require physical action as a possible mitigation.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Tokens create a particular risk because an attacker may use a stolen token without entering the account password again. A password reset alone may therefore be insufficient if tokens or signing keys remain valid; responders need to consider token and key validity, revoke or replace affected credentials where supported, and investigate suspicious use.
Which controls protect secrets, and what should you assess?
No single layer covers every failure mode. Assess controls by the job they perform and how well they fit your devices, identity systems, and operational response.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
| Control layer | Question it addresses | What to assess |
|---|---|---|
| Endpoint hardening and prevention | Does it reduce the chance malware can access credentials on covered devices? | Device coverage, threat prevention, configuration, and administration |
| Detection and response | Can suspicious theft or token use be identified and acted on? | Signal quality, response speed, and integration with identity controls |
| Token and key controls | Are tokens and signing keys issued, protected, verified, rotated, and revoked appropriately? | Token lifetime, key protection, validation, revocation, and operational ownership |
| Authentication hardware | Does authentication require a protected factor and user action? | Supported accounts, protocols, devices, recovery method, and deployment practicality |
These are functional comparison criteria, not a tested ranking of commercial products. A control that works well for one device fleet or identity setup may not cover another.
Keep static secrets out of code and workloads
Secrets embedded in source code can be copied, exposed in repositories, or left in place after a deployment. Microsoft Learn says, “Never hardcode passwords, API keys, connection strings, or other secrets in source code.” For service credentials, its guidance points to managed identities or key vaults rather than static secrets where those options fit. See Microsoft’s guidance on handling passwords and secrets.
Rank #3
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
For workload identities, NIST’s September 2026 final report addresses token verification, key management, and lifecycle controls. Its announcement says the report includes workload identity considerations and reinforces short-lived tokens rather than relying on static credentials and secrets. NIST IR 8587 is primarily implementation guidance for agencies and cloud service providers; NIST says its insights are relevant to others using tokens as part of access management.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use hardware authentication with realistic expectations
A hardware authenticator such as a FIDO2 security key can require a protected factor and a physical action, which may reduce some risks from endpoint malware. Before deploying one, check that the accounts and services, operating systems, and protocols you rely on support it, and plan how users will recover access if a key is lost.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
A security key does not protect secrets already exposed on a compromised endpoint, nor does it replace endpoint monitoring, secure secret storage, or token and signing-key lifecycle controls. It is one authentication layer, not a device-cleanup or incident-response mechanism.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What the 2026 token-theft incident does—and does not—show
In a September 15, 2026 announcement, NIST described an incident in which attackers used forged tokens derived from a stolen commercial signing key and stole more than 60,000 emails from a single agency. This is a reported incident figure, not an estimate of how often endpoint credential theft occurs. The available sources do not establish a general prevalence rate for endpoint credential theft.
NIST Digital Identity Program Lead Ryan Galluzzo said, “Anyone who is using tokens as part of their access management infrastructure can look to this for insights, whether they are in government or commercial industry.” NIST’s announcement provides the incident context and statement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
