What a passkey USB drive does for your Microsoft account

A passkey USB drive is a physical security key that replaces your password when you sign into Microsoft. Instead of typing a password, you plug in the USB drive and tap it (or press a button on it) to prove you are who you say you are. Microsoft calls this a security key, and it works with any USB port on your computer or phone.

The main reason to use one: a password can be guessed, stolen, or phished. A security key cannot. Even if someone has your password, they cannot sign in without the physical device. Microsoft lets you register up to 10 security keys on a single account, so you can keep one at home, one at work, and one in a safe place.

The setup takes about 10 minutes. You will need a USB security key (a small device you buy separately), your Microsoft account password, and access to a computer or phone with a USB port or USB-C port.

Key Takeaways

  • You must buy a USB security key separately — Microsoft does not provide one, but common models cost $20 to $60 and work with any account.
  • Setup happens in your Microsoft account security settings under "Advanced security options," and you will need your current password to start.
  • After you register a key, you can use it to sign in instead of typing your password, but you should register at least two keys in case one is lost or broken.
  • A security key works across Windows, Mac, iPhone, and Android, so one key can protect your account on all your devices.

Which USB security keys work with Microsoft accounts

Microsoft supports security keys that follow the FIDO2 standard. This is an open security standard, so many manufacturers make compatible keys. You do not have to buy a Microsoft-branded key — in fact, Microsoft does not make one.

Common brands that work include Yubico (YubiKey series), Google Titan, Kensington VeriMark, and Feitian. Most cost between $20 and $60. The cheapest options are usually Yubico's basic YubiKey 5 Series or Google's Titan Security Key. Before you buy, check the product page to confirm it says "FIDO2" or "FIDO U2F" — those are the protocols Microsoft accepts.

The key itself is small — about the size of a thumb drive or a car key fob. Some have a button you press; others set up when you touch them. Either type works with Microsoft. If you use your phone to sign in, make sure the key has a USB-C connector or comes with a USB-C adapter, since many phones no longer have USB-A ports.

How to register your first security key

Start by signing into your Microsoft account at account.microsoft.com. Look for "Security" in the left menu and click it. Then find "Advanced security options" — this is usually near the bottom of the security page.

Under "Advanced security options," you will see a section called "Security keys." Click "Add a security key." Microsoft will ask you to confirm your password, then show you a screen that says "Plug in your security key and press the button" (or touch it, depending on the key type).

Plug the USB key into your computer or phone. If you are using a phone, you may need a USB-C adapter or a cable. The key will either light up or ask you to touch it. Do that. Microsoft will then ask you to give the key a nickname — something like "Home key" or "Work key" — so you can tell them apart if you register more than one.

Once you name it, the key is registered. Microsoft will show you a confirmation screen. You are done with the first key.

Why you should register a second security key

If you lose your only security key, you will be locked out of your account. Microsoft has a recovery process, but it takes time and requires you to prove your identity through other means. Registering a second key takes five minutes and solves this problem entirely.

The second key does not have to be the same model or brand as the first one. You can register a Yubico key and a Google Titan key on the same account. Many people keep one key in their wallet and one in a drawer at home, or one at the office and one at home.

To add a second key, go back to "Advanced security options" and click "Add a security key" again. The process is identical to the first one. You will give it a different nickname so you know which is which.

How to sign in with your security key instead of your password

Once you have registered at least one key, you can use it to sign in to Microsoft services. Go to the Microsoft sign-in page and enter your email address. Instead of typing your password, look for a link that says "Use a security key" or "Sign in with a security key."

Click that link. Microsoft will ask you to plug in your security key and press the button (or touch it). Do that, and you will be signed in. No password typed, no code sent to your phone — just the key.

If you do not see the "Use a security key" option, it means you have not registered a key yet, or you are signing in on a device or browser that does not support FIDO2 keys. Most modern browsers on Windows, Mac, iPhone, and Android support them, but very old browsers may not.

What happens if you lose a security key

If you lose a key, sign into your Microsoft account from another device and go to "Advanced security options." Find the lost key in the "Security keys" section and click the three dots next to it, then select "Remove." The lost key will no longer work to sign in.

If you lose all your keys and cannot sign in, go to the Microsoft account recovery page at account.live.com/password/reset. You will need to prove your identity using a backup email address, a phone number, or answers to security questions you set up earlier. This process can take a few hours or longer depending on how much information Microsoft needs to verify.

This is why registering two keys is important — you will always have a backup way to sign in.

Security keys and two-factor authentication

A security key is not the same as two-factor authentication (2FA). Two-factor authentication usually means you sign in with your password, then Microsoft sends you a code on your phone or email, and you type that code to finish signing in. A security key replaces the password step entirely — you do not type a password at all.

You can use both at the same time. Some people register a security key for everyday signing in, but also keep two-factor authentication turned on as a backup. Microsoft recommends this setup for accounts that hold important data or payment information.

If you sign in on a device that does not support security keys — for example, a very old computer or a device you do not own — you can still sign in with your password and two-factor authentication code. The security key is optional, not required.

Frequently Asked Questions

Can I use the same security key on multiple Microsoft accounts?

Yes. One physical key can be registered on as many accounts as you want. Each account stores a record of the key, but the key itself is not tied to any single account. This is useful if you have a work account and a personal account.

What if my security key stops working or breaks?

If a key breaks, remove it from your account using the steps above, then register a different key. If you have a second key registered, you can sign in with that one and remove the broken key. If the broken key is your only key, use the account recovery process to regain access, then register a new key.

Do I need a security key for every Microsoft service I use?

No. Once you register a key on your Microsoft account, it works for Outlook, OneDrive, Xbox, Microsoft 365, and any other service that uses your Microsoft account to sign in. You register the key once, and it protects all of them.

Can I use a security key on my phone?

Yes, but you need a USB-C adapter or a key with a USB-C connector. Most newer security keys come with a USB-C adapter in the box. Plug the key into your phone's USB-C port, and the sign-in process works the same way as on a computer.

What if I forget which key is which?

The nickname you give each key when you register it shows up in your account settings. If you registered "Home key" and "Work key," you will see those names listed under "Security keys" in "Advanced security options." You can click the three dots next to any key to rename it or remove it.