Why a Hardware Security Key Is the Best Upgrade for Your Proton Account

In short: A hardware security key is a small USB or NFC device that you touch to confirm a sign-in. Proton accepts FIDO2 and U2F keys as a second factor on every Proton Account, free or paid, and you can register up to four of them. Unlike a six-digit code from an authenticator app, a key can’t be tricked into working on a fake login page, which makes it the strongest protection you can add to Proton Mail, Drive, Pass and VPN.

You’ve done the right things. You use Proton because you care about privacy. You have a long, unique password. You even turned on two-factor authentication (2FA) with an authenticator app on your phone. So is your account as safe as it can be?

Almost. App-based 2FA is a big step up from a password alone, but it has one weakness that attackers know how to exploit: you can be talked into typing the code somewhere you shouldn’t. A hardware security key closes that gap. It isn’t just another layer on top of what you already have; it works in a different way.

What this article covers:

• How a hardware key differs from an authenticator app
• The main threat it stops: phishing
• How to add a key to your Proton Account, step by step
• How to avoid locking yourself out
• The downsides, because there are some

What is a hardware security key?

A hardware security key is a small device, usually the size of a house key, that plugs into a USB port or connects to your phone over NFC. It is built on the FIDO2 and WebAuthn standards from the FIDO Alliance and the W3C (older keys use the earlier U2F standard). Well-known examples include the YubiKey and Yubico’s cheaper Security Key series, but many other brands make FIDO-certified keys.

Your password is something you know. A code from an authenticator app is meant to prove something you have, but in practice it is just six digits you read off your phone and type in. Anyone who gets you to type those digits into the wrong place has them too.

A hardware key never shows you a code. When Proton asks for your second factor, you insert the key or hold it to your phone and touch it. The key and your browser then complete a cryptographic check that proves two things at once:

1. You physically have the key.
2. You are signing in on the real Proton site, not a copy of it.

The second point is what makes keys special.

Why keys beat authenticator apps: phishing

Here is how a typical phishing attack on an app-protected account works. You get an email that looks like it comes from Proton, warning about a suspicious sign-in and urging you to “secure your account” via a link. The link leads to a convincing copy of the Proton login page. You enter your username and password, then the fake page asks for your 2FA code. You open your authenticator app and type in the six digits.

The attackers now have your password and a valid one-time code. They pass both to the real Proton site within seconds and they’re in. This kind of real-time phishing is exactly the scenario the US cybersecurity agency CISA describes when it explains why app codes are not enough.

A hardware key stops this attack. The key’s response is tied to the address of the website asking for it. On a lookalike domain, the key either refuses to respond or produces something that is useless on the real Proton site. There is no code for you to give away, so even a moment of panic can’t undo your security.

That is why CISA calls FIDO/WebAuthn authentication the “gold standard” for multi-factor authentication and “the only widely available phishing-resistant authentication”. Authenticator apps are still far better than no 2FA, but they protect you only as long as you never type a code into the wrong page.

What Proton supports

According to Proton’s support pages, as of October 2026:

• Key types: physical U2F and FIDO2 security keys. You can also register a platform authenticator, such as Windows Hello, Touch ID or Face ID, by ticking “Allow platform keys” during setup.
• Plans: 2FA, including security keys, is available on all Proton services with both free and paid plans.
• Number of keys: up to four security keys per Proton Account.
• Where it works: once a key is registered, you can use it to sign in to any Proton app. Proton VPN users should set the key up on proton.me, because the protonvpn.com account pages don’t support security key 2FA.
• Known limitations: the Tor Browser doesn’t support security keys, and Safari has a known bug that can show an error; Proton suggests force-quitting Safari or using another browser.

You can use a security key on its own or alongside an authenticator app. Having both is useful: if the key isn’t with you, the app gives you another way to sign in.

A note on passkeys: they are built on the same FIDO standards. Proton’s own sign-in uses a key as a second factor after your password, while Proton Pass can create and store passkeys for other websites, on all plans including the free one.

How to add a security key to your Proton Account

The setup takes a couple of minutes. Proton’s steps are:

1. Sign in at account.proton.me and open Settings → All settings.
2. Go to Account and password, scroll down to Two-factor authentication and turn on the Security key toggle.
3. Re-enter your password if asked, and confirm with your authenticator app if you already use one.
4. Plug the key into a USB port (or get ready to tap it) and click Continue. Leave “Allow platform keys” unticked for a physical key.
5. When your browser asks, touch the button or metal contact on the key. Some browsers also ask you to set or enter a PIN; that PIN belongs to the key itself, not to Proton.
6. Give the key a name, such as “Keychain key” or “Backup key – home”, and click Continue.

Your registered keys then appear in the same section under Security keys, where you can rename or remove them. The next time you sign in, Proton asks for your key after your password. Insert or tap it, touch it if prompted, and click Authenticate.

The most important rule: register at least two keys

If you take one thing from this article, make it this: set up a backup key on day one.

Buy two keys, register both, and keep the second one somewhere safe away from your keychain: a drawer at home, a safe, or with a family member you trust. Proton itself recommends adding more than one key to reduce the risk of being locked out. With room for four keys, you can also keep one on your keychain, one in your laptop bag and one at home.

Then check your recovery options. If you lose every 2FA device, Proton offers several ways back in:

• Recovery codes – one-time codes Proton gives you when you set up 2FA. Store them offline, ideally with your backup key.
• Recovery phrase – a 12-word phrase that can reset your password and restore access to your encrypted data.
• Recovery email or phone – these can reset your password, but on their own they don’t restore access to data that was encrypted with the old password.

Proton’s recovery guide is clear that you should combine methods, because a password reset without a data recovery method can leave your old emails and files unreadable. Check which recovery methods are set up on your account before you rely on a key.

The downsides of hardware keys

Hardware keys are the strongest option, but not a free lunch.

Cost

Authenticator apps are free; keys are not, and you need at least two. In Yubico’s own EU store in October 2026, the FIDO-only Security Key NFC was listed at €35.09 and the YubiKey 5 NFC at €70.18, both including VAT (prices vary by country and retailer). For Proton 2FA, a basic FIDO2 key does the job; the more expensive models add features such as smart card and OTP support that Proton doesn’t need.

Losing a key

A key is a physical object. It can be lost, stolen, put through the washing machine or left in a hotel room. That’s why the two-key rule and up-to-date recovery methods aren’t optional. If you know you won’t manage a backup key, an authenticator app combined with careful habits around login links may suit you better.

Convenience

You need the key with you to sign in on a new device. If you want to check your email on a borrowed computer and the key is at home, you’re out of luck. Make sure your keys match your devices: USB-C for newer laptops and phones, USB-A for older computers, and NFC if you want to tap the key against your phone.

Is a hardware key right for you?

Think about what’s in your Proton Account. If your inbox, calendar or Proton Drive holds financial records, ID scans, client work or anything else that would hurt if it leaked, a pair of keys is a small price for shutting out phishing. The same goes if your Proton login also unlocks your passwords in Proton Pass: one account protects everything, so it deserves the best protection available.

If you’re a journalist, activist, lawyer, executive or anyone else likely to be targeted directly, treat a hardware key as the baseline rather than an upgrade.

And if you’re simply someone who values privacy, the phishing protection alone is a good reason to switch. Phishing works because it catches people when they’re tired or in a hurry; a key takes that moment of weakness out of the equation. If you’re still building up your security basics, start with our guides on secure passwords and spotting phishing.

Frequently asked questions

Do I need a paid Proton plan to use a security key?

No. Proton says 2FA, including security keys, is available on all Proton services with both free and paid plans.

How many security keys can I add to my Proton Account?

Up to four. Register at least two so you have a backup if one is lost or damaged.

Which keys work with Proton?

Any security key that supports FIDO2 or U2F, such as a YubiKey or Yubico Security Key. You can also register a platform authenticator such as Windows Hello, Touch ID or Face ID.

Does a security key work with Proton VPN?

Yes, a key registered on your Proton Account works when you sign in to Proton apps. To set it up, use account.proton.me, because protonvpn.com doesn’t support security key 2FA.

What happens if I lose my security key?

Sign in with your backup key or authenticator app, or use one of your 2FA recovery codes. Without those, you can use a recovery method such as your recovery phrase, email or phone. Afterwards, remove the lost key in your settings and register a new one.