Recommended Free Tools
If your hardware security key is lost or stops working, sign in with another key, a trusted device, or another second factor already approved by the account provider. After you regain access, remove the missing key and enroll and test a replacement. If no fallback works, use the provider’s official account-recovery process; buying a new key alone will not restore access.
The safest time to prepare is before a key goes missing: enroll and test a spare, keep it separately from your everyday key, and make sure you can reach any recovery codes or alternate methods. The exact options—and the consequences of losing them all—vary by service.
As an Amazon Associate I earn from qualifying purchases.
First, know what kind of credential you have
A hardware security key is a physical device used to prove your identity during sign-in, often as a second factor. It is not the same thing as a passkey, an authenticator-app code, a backup code, or an account recovery key. A provider may offer several of these as alternate ways to verify you, but they are different credentials and are not interchangeable in every sign-in flow.
Use only the account provider’s official website or app to sign in or start recovery. Do not follow recovery links in unsolicited messages or search advertisements.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If another key or approved sign-in method is available
- Choose the alternate method at sign-in. Use another enrolled key, a trusted device, or another method the provider offers for your account. Google lists examples such as prompts, verification or backup codes, another key, and a previously trusted computer. GitHub documents options including recovery codes, passkeys, another configured key, fallback numbers, and certain verified devices or tokens. See Google’s guidance and GitHub’s recovery options.
- Remove the missing key. Once signed in, open the account’s security settings and remove or revoke the lost key. If it may have been stolen, treat it as compromised and remove it promptly.
- Enroll a replacement and test it. Follow the provider’s instructions to add a compatible key. Test it with the account and devices you rely on before putting it into everyday use.
- Add a separate spare. Enroll and test a second key, then store it somewhere physically separate from the primary key. Keep recovery codes somewhere you can reach even if your usual phone or computer is unavailable.
For Google accounts, Google specifically directs users who can use another second step to sign in with it, remove the lost key, and add a new one; it recommends keeping an extra key in a safe place. Google’s instructions also list other possible second steps.
If the key is present but will not work
A failed sign-in does not by itself prove the key is defective. Check the connection and the sign-in instructions first:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Use the connector or connection method the device supports, such as the correct USB port or NFC, and try another supported port or compatible device if available.
- Follow the prompt shown by the account provider. Check its browser, operating-system, and device requirements for the sign-in method you are using.
- For Apple Account web sign-in, Apple recommends updating the browser or trying another browser if the key cannot be used.
If the key still fails, sign in with another enrolled method and consult the key maker’s official troubleshooting information and the account provider’s guidance. Do not assume that a credential on a broken key can be repaired or transferred.
If no other method works
Start account recovery only through the official provider. Give accurate information and keep access to the email address or phone number the provider asks you to use. The process may include identity checks or a wait, and its timing depends on the service.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For Google 2-Step Verification recovery, Google says identity confirmation can take 3–5 business days when another second step is unavailable. That is Google’s guidance, not a general recovery estimate for other services. Google’s recovery guidance
Support may not be able to override a provider’s authentication rules. GitHub says its support team cannot restore access when a user loses 2FA credentials and all recovery methods; without a recovery method, access may be permanently lost. Apple warns that losing all trusted devices and security keys when Apple Account Security Keys are enabled can also result in permanent lockout. These are specific provider policies, not a guarantee that every service handles recovery the same way. GitHub’s recovery policy · Apple’s Security Keys guidance
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How recovery works on major services
Google consumer accounts
If another second step is available, use it to sign in, remove the lost key, and add a replacement. Google lists options such as backup codes, verification codes, prompts, another key, and a registered computer. If none is available, follow Google Account recovery. Google says its 2-Step Verification identity checks can take 3–5 business days when no other second step is available. Google: Sign in if you lost your security key
GitHub
GitHub documents several possible recovery routes, including a 2FA recovery code, passkey, another configured security key, fallback number, verified device, and—where applicable—an SSH token or personal access token. Which options apply depends on what you configured and can access. GitHub states that support cannot restore an account when 2FA credentials and every recovery method are lost. Set up and protect recovery methods while you can still sign in. GitHub: Recovering your account if you lose your 2FA credentials
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Apple Account with Security Keys enabled
Apple requires at least two compatible FIDO-certified keys for its Security Keys feature and permits up to six. If your key is not with you, an iPhone or iPad already signed in to your Apple Account can be brought near the new device to help with sign-in. Apple lists YubiKey 5C NFC, YubiKey 5Ci, and FEITIAN ePass K9 NFC as examples; connector support varies by device, so these examples are not universal compatibility guarantees. Apple also requires a modern browser for web sign-in and recommends updating or changing browsers if a key does not work. Apple: About Security Keys for Apple Account
Apple’s account recovery key is a separate feature from a physical security key. It is an optional 28-character code used with a trusted phone number. Enabling it turns off Apple’s standard account-recovery process, and losing it can permanently lock you out; it is not a substitute for enrolling a spare hardware key. Apple: Set up a recovery key for your Apple Account
Microsoft accounts
For a personal Microsoft account, the recovery code is a separate credential from a hardware key. It is 25 digits; generating a new one invalidates the previous code. Microsoft advises against storing it on a device you use to sign in. Microsoft: How to get a Microsoft account recovery code
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWork and school accounts may instead be governed by Microsoft Entra ID and the organization’s settings. Microsoft documents an administrator-enabled recovery feature that can let users who have lost all authentication methods verify their identity and re-enroll. Contact your organization’s IT administrator for the process used by your account. Microsoft Entra: Enable and configure account recovery
Choose and store a replacement or spare carefully
Before buying a replacement, check the requirements for the account and every device where you may need the key. Compare:
Quick Recap
- Authentication support: Confirm the provider accepts the key’s authentication type and that the model supports the required FIDO function.
- Connection method: Check whether you need USB-C, USB-A, Lightning, or NFC. An adapter may help with a connector mismatch, but it does not guarantee compatibility.
- Device and browser support: Check provider instructions and operating-system and browser requirements for the devices you use.
- Redundancy: Enroll and test a spare key, and store it separately from the key you carry.
- Recovery outside the key: While you still have access, confirm that backup codes, trusted devices, fallback factors, or recovery contact details are available and current.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
