U2F
U2F (Universal 2nd Factor) is an open login standard in which a physical security key confirms each sign-in and refuses to answer phishing sites.
What Is U2F?
U2F (Universal 2nd Factor) is an open standard for logging in to online accounts with a physical security key as the second factor. It was created by Google and Yubico and is maintained by the FIDO Alliance. Its successor, FIDO2 with WebAuthn, is the basis of passkeys and remains backward compatible with U2F keys.
When a key is registered with a website, it creates a key pair for that site. At each login the site sends a challenge, the user confirms on the key, and the key signs the challenge together with the site's address. A phishing page on a different domain gets a signature that the real site will not accept, which is the main advantage over SMS codes and authenticator apps.
Several hardware wallets can act as a U2F key, among them the Trezor Safe 3 and Trezor Safe 5, the BitBox02 with multi-coin firmware, and Ledger devices through a security key app. The login is confirmed on the wallet itself, with keys that are separate from the ones that control coins.
The trade-offs are practical. A hardware wallet used for daily logins leaves the house more often than a savings device should, and losing it removes the second factor until a backup method is used. Registering a second key with each service is the usual precaution.
Passkeys are passwordless login credentials based on key pairs (FIDO2/WebAuthn). The private key stays on your device, which makes logins resistant to phishing.
Read full definition: PasskeysA hardware wallet is a dedicated device that keeps private keys offline and signs transactions internally, so the keys never reach an internet-connected computer or phone.
Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definition: FirmwareLedger is a brand of hardware wallets that securely store cryptocurrency private keys offline, such as the Ledger Nano series.
Read full definition: LedgerA backup in cryptocurrency is a secure copy of a wallet's seed phrase or private keys. It enables recovery of funds if the original wallet is lost or damaged.
Read full definition: BackupReal-World Examples
Example 1: A user registers a Trezor Safe 3 as the security key for an exchange account. A fake login page later captures the password, but it cannot obtain a response from the key that the real exchange would accept.
Example 2: Someone keeps a BitBox02 at home for savings and prefers not to carry it. They register a separate, inexpensive security key for daily logins and keep the BitBox02 as the backup key.
A backup in cryptocurrency is a secure copy of a wallet's seed phrase or private keys. It enables recovery of funds if the original wallet is lost or damaged.
Read full definition: BackupFrequently Asked Questions
How does U2F stop a phishing site from logging in with my key?
The key signs the login challenge together with the site's address. A phishing page on a different domain gets a signature that the real site will not accept, so a captured password is not enough. This is the main advantage of U2F over SMS codes and authenticator apps.
Should I use my hardware wallet as my U2F key?
It works, and the login keys are separate from the ones that control coins. The trade-offs are practical: a wallet used for daily logins leaves the house more often than a savings device should, and losing it removes the second factor until a backup method is used. Registering a second key with each service is the usual precaution.
How is U2F related to FIDO2 and passkeys?
U2F came first and is maintained by the FIDO Alliance. Its successor, FIDO2 with WebAuthn, is the basis of passkeys and remains backward compatible with U2F keys, so a key you already use for U2F can still be used with services built on FIDO2.
Ready to Choose a Secure Wallet?
Use our tools to find the right hardware wallet for your needs.