Hardware Security Keys arenaHardware Security Keys
Hardware authenticators — the physical FIDO2/WebAuthn keys that make phishing-resistant login real: resident-key passkeys, PIV smart-card and OpenPGP modes, OTP fallbacks, NFC and USB-C form factors, attestation, and fleet provisioning at enterprise scale. Judged honestly on hardware plus ecosystem: protocol coverage, what exists beyond FIDO, enrollment and lockout recovery, fleet management APIs, developer tooling (CLIs, SDKs, attestation), firmware openness — Yubico's locked-down closed firmware versus Nitrokey's and SoloKeys' open-source stacks is a real axis, not a footnote — and the agent angle: whether provisioning and auditing keys is a human-only console job or something an agent can drive through documented CLIs and APIs.
54 user stories · 324 judged cells · updated 2026-09-15 · Evidence as of 2026-09-15
Leaderboard — every product ranked by evidenceLeaderboard
Rank by
| 1 |  YubiKeyhardware-purchase vs Nitrokey ↗ | 34/100 | untested | 0/100 | 7/100 | 24/100 | ★ 1.2k▲ 116/yrpypi 10.3k/wk | 23/26 verified · 2 disputed | untested | ||
| 2 |  Nitrokeyhardware-purchase vs YubiKey ↗ | 34/100 | untested | 0/100 | 24/100 | 0/100 | ★ 394▲ 74/yr | 20/26 verified · 2 disputed | untested | ||
| 3 |  Token2hardware-purchase vs YubiKey ↗ | 10/100 | untested | 0/100 | 21/100 | 36/100 | ★ 112▲ 48/yr | 15/23 verified | untested | ||
| 4 |  SoloKeys Solo 2hardware-purchase vs YubiKey ↗ | 2/100 | untested | 0/100 | 25/100 | untested | ★ 713▲ 107/yr | 10/20 verified · 5 disputed | untested | ||
| 5 |  Feitian FIDO Keyshardware-purchase vs YubiKey ↗ | 0/100 | untested | 0/100 | 14/100 | untested | 0/17 verified | untested | |||
| 6 |  Google Titan Security Keyhardware-purchase vs YubiKey ↗ | untested | untested | untested | untested | untested | 5/9 verified · 2 disputed | untested |
Best by user type — persona-weighted winnersBest by user type
Per persona, the product with the highest persona-weighted coverage over just that persona's stories — not the same ranking as the overall PA Score leaderboard above.
Story matrix — every product × every judged storyStory matrix
54/54 stories shown · legend
Agenticness — how well agents can access and operate the productAgenticness
Agent access
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Agenticness — how well agents can access and operate the productPoint an agent at llms.txt or agent-oriented docs | ai-native | none 0/10 | n/a | none 0/10 | none 0/10 | none 0/10 | none 0/10 |
| Agenticness — how well agents can access and operate the productRun the product headlessly / in CI for automation | ai-native | partialT 4/10 | none 0/10 | partialT 4/10 | none 0/10 | none 0/10 | partialT 4/10 |
| Agenticness — how well agents can access and operate the productPlug MCP servers into this product so it can use their tools | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
| Agenticness — how well agents can access and operate the productConnect an agent via an official MCP server | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
| Agenticness — how well agents can access and operate the productUse an official CLI | ai-native | partialT 6/10 | none 0/10 | fullT 8/10 | disputedD 3/10 | none 0/10 | partialT 5/10 |
| Agenticness — how well agents can access and operate the productDrive the product through a documented public API | ai-native | partialT 5/10 | none 0/10 | partialT 5/10 | none 0/10 | none 0/10 | none 0/10 |
| Agenticness — how well agents can access and operate the productIssue scoped/least-privilege API credentials for an agent | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
| Agenticness — how well agents can access and operate the productBuild against official SDKs | ai-native | fullT 8/10 | none 0/10 | partialT 6/10 | none 0/10 | none 0/10 | none 0/10 |
| Agenticness — how well agents can access and operate the productSubscribe to events via webhooks | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
Agentic features
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Agenticness — how well agents can access and operate the productGet AI-generated insights and suggestions from my data inside the product | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
| Agenticness — how well agents can access and operate the productSet up automations that run autonomously in the background | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
| Agenticness — how well agents can access and operate the productDelegate tasks to a built-in AI assistant inside the product | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
| Agenticness — how well agents can access and operate the productOperate the product with natural-language commands | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
Api quality
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Agenticness — how well agents can access and operate the productExplore an interactive API reference with runnable examples | ai-native | none 0/10 | n/a | none 0/10 | n/a | n/a | none 0/10 |
| Agenticness — how well agents can access and operate the productDownload a machine-readable API spec (OpenAPI or equivalent) | ai-native | none 0/10 | n/a | none 0/10 | none 0/10 | none 0/10 | none 0/10 |
| Agenticness — how well agents can access and operate the productTest against a sandbox environment without touching production data | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
| Agenticness — how well agents can access and operate the productRely on versioned APIs with a documented deprecation policy | ai-native | none 0/10 | n/a | none 0/10 | n/a | n/a | none 0/10 |
Automation depth — how much of the product can run unattendedAutomation depth
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Automation depth — how much of the product can run unattendedPerform bulk operations across many items at once | ai-native | partialT 4/10 | none 0/10 | none 0/10 | none 0/10 | none 0/10 | partialT 6/10 |
| Automation depth — how much of the product can run unattendedDefine rules that trigger actions automatically on events | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
| Automation depth — how much of the product can run unattendedSchedule recurring jobs or workflows | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
| Automation depth — how much of the product can run unattendedVersion, review, and roll back my automations | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
Beyond fido — what the key does beyond FIDO — PIV smart card, OpenPGP, OTP slots, hardware-backed SSHBeyond fido
Openpgp
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Beyond fido — what the key does beyond FIDO — PIV smart card, OpenPGP, OTP slots, hardware-backed SSHKeep OpenPGP keys on the device and use them for git commit signing and encrypted email | developer | fullX 7/10 | none 0/10 | fullC 8/10 | disputedD 3/10 | none 0/10 | none 0/10 |
Otp
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Beyond fido — what the key does beyond FIDO — PIV smart card, OpenPGP, OTP slots, hardware-backed SSHThe key covers legacy one-time-password schemes — TOTP/HOTP slots or challenge-response — for services that still lack WebAuthn | power-user | fullX 8/10 | none 0/10 | partialC 6/10 | fullT 6/10 | partialC 6/10 | none 0/10 |
Piv
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Beyond fido — what the key does beyond FIDO — PIV smart card, OpenPGP, OTP slots, hardware-backed SSHThe key acts as a PIV smart card for certificate-based login — workstation sign-in, VPN, and code signing with keys that never leave the device | it-admin | fullX 7/10 | none 0/10 | partialX 6/10 | partialT 4/10 | partialC 6/10 | partialC 5/10 |
Ssh
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Beyond fido — what the key does beyond FIDO — PIV smart card, OpenPGP, OTP slots, hardware-backed SSHMy SSH keys can be hardware-backed on the device — via FIDO2 sk-ssh keys, PIV, or OpenPGP — so server access requires a physical touch | developer | fullX 9/10 | none 0/10 | partialX 6/10 | disputedD 4/10 | partialC 6/10 | partialT 6/10 |
Developer tooling — building with and managing the key — CLIs, SDKs, attestationDeveloper tooling
Agent audit
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Developer tooling — building with and managing the key — CLIs, SDKs, attestationAn agent can read a key's state programmatically — serial, firmware version, enabled applications, stored credentials — to audit security posture across a fleet | ai-native | fullT 8/10 | none 0/10 | partialT 5/10 | partialT 3/10 | none 0/10 | partialT 5/10 |
Attestation
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Developer tooling — building with and managing the key — CLIs, SDKs, attestationVerify device attestation at registration to enforce that only genuine, approved key models are enrolled | security-engineer | fullT 8/10 | disputedD 3/10 | partialX 4/10 | partialC 3/10 | none 0/10 | partialC 3/10 |
Cli
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Developer tooling — building with and managing the key — CLIs, SDKs, attestationConfigure and manage the key from an official CLI — enable applications, set PINs, manage slots, read device state — scriptably | developer | fullT 9/10 | none 0/10 | fullT 8/10 | disputedD 3/10 | partialC 4/10 | partialT 6/10 |
Sdks
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Developer tooling — building with and managing the key — CLIs, SDKs, attestationOfficial SDKs let me integrate the key into my own desktop and mobile apps | developer | fullT 8/10 | none 0/10 | partialT 5/10 | none 0/10 | none 0/10 | none 0/10 |
Ecosystem compat — where the key works — platforms, browsers, service compatibility catalogsEcosystem compat
Agent approval
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Ecosystem compat — where the key works — platforms, browsers, service compatibility catalogsRequire a physical key touch as the human-approval step for sensitive automated or agent-initiated actions | ai-native | partialT 4/10 | none 0/10 | none 0/10 | partialT 3/10 | partialC 5/10 | none 0/10 |
Compatibility
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Ecosystem compat — where the key works — platforms, browsers, service compatibility catalogsThe key works across my operating systems and browsers, with a published compatibility catalog of supported services | power-user | partialX 5/10 | disputedD 4/10 | disputedD 4/10 | partialT 3/10 | partialC 5/10 | partialC 5/10 |
Enrollment recovery — getting keys enrolled and surviving loss — setup flows, backup keys, lockout recoveryEnrollment recovery
Recovery
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Enrollment recovery — getting keys enrolled and surviving loss — setup flows, backup keys, lockout recoveryThe vendor documents a credible lockout-recovery strategy — registering a backup key, and what is and is not recoverable if a key is lost | security-engineer | none 0/10 | partialX 4/10 | none 0/10 | none 0/10 | partialC 5/10 | partialC 3/10 |
Setup
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Enrollment recovery — getting keys enrolled and surviving loss — setup flows, backup keys, lockout recoveryFirst-time setup is guided — clear instructions or a setup app walk me through registering the key with my accounts | power-user | disputedD 4/10 | partialX 5/10 | partialT 5/10 | partialT 3/10 | partialC 7/10 | partialC 6/10 |
Firmware openness — what runs on the device — open-source firmware, update policy, vulnerability responseFirmware openness
Source
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Firmware openness — what runs on the device — open-source firmware, update policy, vulnerability responseThe firmware is open source or independently audited, so I don't have to take the vendor's word for what runs on the device | security-engineer | none 0/10 | none 0/10 | partialT 7/10 | fullT 8/10 | partialC 5/10 | none 0/10 |
Updates
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Firmware openness — what runs on the device — open-source firmware, update policy, vulnerability responseThe vendor has a clear firmware update and vulnerability-response story — advisories, affected-model lookup, and how fixes reach devices | security-engineer | disputedD 4/10 | partialX 4/10 | partialT 4/10 | disputedD 3/10 | none 0/10 | none 0/10 |
Fleet management — keys at organization scale — bulk provisioning, delivery services, IdP policiesFleet management
Agent provisioning
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Fleet management — keys at organization scale — bulk provisioning, delivery services, IdP policiesAn agent can drive key provisioning end to end — ordering, assignment, pre-registration — through documented enterprise APIs instead of a human-only console | ai-native | partialT 5/10 | none 0/10 | none 0/10 | none 0/10 | none 0/10 | partialT 3/10 |
Delivery
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Fleet management — keys at organization scale — bulk provisioning, delivery services, IdP policiesAn enterprise delivery service ships keys directly to distributed employees, driven by an API or console rather than manual logistics | it-admin | partialT 6/10 | none 0/10 | none 0/10 | none 0/10 | none 0/10 | none 0/10 |
Idp
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Fleet management — keys at organization scale — bulk provisioning, delivery services, IdP policiesThe key integrates with my identity provider — Okta, Entra ID, Google Workspace — and I can enforce policies requiring hardware-key authentication | it-admin | none 0/10 | none 0/10 | partialC 4/10 | none 0/10 | partialC 6/10 | partialT 4/10 |
Provisioning
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Fleet management — keys at organization scale — bulk provisioning, delivery services, IdP policiesProvision keys across an organization at scale — pre-registration, bulk configuration, and lifecycle tracking of issued keys | it-admin | partialT 6/10 | none 0/10 | partialT 3/10 | none 0/10 | none 0/10 | partialT 5/10 |
Form factors — the physical lineup — NFC, USB-C/A, biometrics, certified and hardened modelsForm factors
Certifications
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Form factors — the physical lineup — NFC, USB-C/A, biometrics, certified and hardened modelsCertified models exist for regulated environments — FIPS 140 validated or Common Criteria certified — with documented durability (water/crush resistance) | it-admin | none 0/10 | none 0/10 | partialX 3/10 | none 0/10 | none 0/10 | none 0/10 |
Connectors
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Form factors — the physical lineup — NFC, USB-C/A, biometrics, certified and hardened modelsThe lineup covers my ports and carry style — USB-C and USB-A models, keychain and low-profile nano form factors | power-user | none 0/10 | partialX 4/10 | partialX 4/10 | none 0/10 | none 0/10 | none 0/10 |
Nfc
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Form factors — the physical lineup — NFC, USB-C/A, biometrics, certified and hardened modelsTap the key on my phone over NFC to authenticate in mobile browsers and apps | power-user | partialC 6/10 | fullC 7/10 | partialC 4/10 | fullC 7/10 | partialC 6/10 | partialC 4/10 |
Openness — open source, data portability, and self-hosting storiesOpenness
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Openness — open source, data portability, and self-hosting storiesDo everything through the API that I can do in the UI | ai-native | partialT 6/10 | none 0/10 | partialT 4/10 | none 0/10 | none 0/10 | partialT 4/10 |
| Openness — open source, data portability, and self-hosting storiesExport all of my data in open formats and leave | ai-native | none 0/10 | none 0/10 | disputedD 3/10 | none 0/10 | none 0/10 | partialT 5/10 |
| Openness — open source, data portability, and self-hosting storiesRead the product's source under an open license | ai-native | none 0/10 | none 0/10 | fullT 8/10 | fullX 8/10 | partialC 4/10 | partialT 6/10 |
| Openness — open source, data portability, and self-hosting storiesSelf-host the core product | ai-native | none 0/10 | none 0/10 | none 0/10 | partialT 5/10 | partialC 5/10 | none 0/10 |
Privacy posture — data-handling and privacy storiesPrivacy posture
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Privacy posture — data-handling and privacy storiesChoose where my data is stored (region/residency) | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
| Privacy posture — data-handling and privacy storiesPrevent my data from being used to train AI models | ai-native | n/a | n/a | n/a | n/a | n/a | n/a |
| Privacy posture — data-handling and privacy storiesControl data retention and deletion | ai-native | none 0/10 | none 0/10 | none 0/10 | partialC 4/10 | none 0/10 | partialC 5/10 |
| Privacy posture — data-handling and privacy storiesOpt out of telemetry and usage tracking | ai-native | none 0/10 | none 0/10 | none 0/10 | partialC 3/10 | none 0/10 | none 0/10 |
Protocol coverage — FIDO2/WebAuthn depth — resident-key passkeys, user verification, credential managementProtocol coverage
Credential management
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Protocol coverage — FIDO2/WebAuthn depth — resident-key passkeys, user verification, credential managementList and delete the passkeys stored on my key and know its credential capacity before it fills up | power-user | partialT 4/10 | none 0/10 | none 0/10 | none 0/10 | partialC 4/10 | partialT 7/10 |
Fido2
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Protocol coverage — FIDO2/WebAuthn depth — resident-key passkeys, user verification, credential managementThe key stores discoverable FIDO2 credentials (resident keys / device-bound passkeys) so users can sign in to WebAuthn services without typing a username | security-engineer | fullX 8/10 | partialC 5/10 | partialX 6/10 | fullC 7/10 | partialC 5/10 | fullT 8/10 |
| Protocol coverage — FIDO2/WebAuthn depth — resident-key passkeys, user verification, credential managementThe key works as a WebAuthn/U2F second factor across the major services I already use — Google, GitHub, Microsoft, password managers | power-user | fullX 8/10 | partialX 5/10 | partialX 6/10 | partialT 6/10 | partialC 7/10 | partialC 6/10 |
User verification
| Story | Persona | YubiKey | Google Titan Security Key | Nitrokey | SoloKeys Solo 2 | Feitian FIDO Keys | Token2 |
|---|---|---|---|---|---|---|---|
| Protocol coverage — FIDO2/WebAuthn depth — resident-key passkeys, user verification, credential managementThe key supports on-device user verification — a FIDO2 PIN or built-in biometric — so a stolen key alone cannot authenticate | security-engineer | fullX 8/10 | none 0/10 | none 0/10 | none 0/10 | fullC 7/10 | fullT 8/10 |
Verdict✓ fullclear evidence~ partialwith caveats! disputedevidence conflicts— noneno evidence foundn/aquestion doesn't apply to this kind of product
ProofT probedtested by usX communityusers back itC claimedvendor claim onlyD contradictedevidence disagrees⚿ auth-gatedprobe hit a live sign-in wall — verified reachable, untestable keylessly
quality 0–10 · PA Score /100 · A–D = evidence confidence · full guideAdjacent arenas — categories often shopped togetherAdjacent arenas
Shopping this category often means shopping these too.