Phishing-resistant login with a YubiKey
A hardware key replaces your username and password with a quick tap, and it simply cannot be used on a fake site. Here I explain why that is and how it works under the hood. On the linked test pages you are welcome to try it yourself with a YubiKey.
Built against phishing
The key remembers which web address it was created for and answers only that one. A pixel-perfect fake gets no answer at all. There is no secret you could type into the wrong site by mistake.
Simpler than passwords
Nothing to invent, memorise or reset. Signing in means: plug in (or tap) the key and touch it. No second code from an app, no typing.
Nothing secret leaves the key
The private key stays inside the chip and cannot be read out. The site only ever receives a fresh, one-time signature. There is no password to steal or to leak in a breach.
And the password vault?
A good password vault is a big step up from reused passwords, especially as a browser extension that only autofills on the genuine address. The hardware key goes one step further: no readable secret, no master password as a single point of attack, and it refuses the wrong site by itself. The two complement each other well, more on that below.
Side by side
| Password | Password vault | Hardware key | |
|---|---|---|---|
| Phishing-resistant | ✕ No | ~ partly | ✓ Yes |
| Nothing to memorise | ✕ No | ✓ Yes | ✓ Yes |
| No readable secret | ✕ No | ✕ No | ✓ Yes |
| Survives a server breach | ✕ No | ✕ No | ✓ Yes |
| No single point of attack | ✕ No | ✕ No | ✓ Yes |
“Partly”: an automatic vault (browser extension) only fills on the genuine address and thereby fends off look-alike sites well. A manually operated vault does not protect here, see below.
Putting password vaults in perspective
A manually operated vault (you open it, find the entry, copy the password and username yourself) does not protect you from landing on a deceptively real address. If you arrive via a link in an email or message, the address can be subtly faked, and you paste your credentials onto the attacker’s site.
A well-configured automatic vault (browser extension) defuses exactly that: it only autofills credentials on the address they were saved for. A look-alike or homograph address is a different address to it, so it fills nothing there, a strong warning sign. This attack path can therefore be largely caught this way.
Which password vault?
We only name vaults that demonstrably implement the origin-bound autofill described above (no filling on foreign or merely similar addresses). These are examples, not a complete market overview.
Strictest origin binding, fills only on exactly saved addresses, plus a paste warning on URL mismatch.
Clean, with granular match rules (domain/host/wildcard), fits the privacy focus.
Fills only on the saved domain, an “exact URL only” option, phishing alert on mismatch (desktop).
KeeperFill matches the saved address and does not fill on mismatch (vendor-stated).
Open-source, homograph protection correct by default. Harden it: set match to “Host/Exact” and turn off autofill-on-page-load (iframe/subdomain caveat).
Transparent origin binding, a per-site prompt before filling, open-source.
Items tagged “vendor claim” are stated by the vendor (no independent audit); 1Password, Bitwarden and KeePassXC have external/transparent evidence. Deliberately not recommended: RoboForm (match strictness unverifiable) and Enpass (only with extra setup).
Transparency: providers marked “Affiliate” have a partner program. Once we join, their links become affiliate links: if you use them we may earn a commission, your price stays the same. We list a provider only if it genuinely supports the mentioned feature, never misleading anyone for commission.
How the protection works
When you set it up, the key records the web address (the “origin”) of the site. When you sign in, the browser asks the key only if the current address matches exactly. A phishing page necessarily runs on a different address, so the browser refuses the request before the key even responds. That is exactly what the “evil twin” shows.