Using a Hardware Security Key for two-factor authentication (2FA)

Last updated: 2. November 2026

A Hardware Security Key is a small physical device you plug into, or hold against, your device. You touch or tap it to confirm it’s you.

Passkeys are the first recommendation for Sign-in 2FA and the Master Key, and a Hardware Security Key can store them. Funding 2FA uses a YubiKey (Yubico OTP) instead.

Function

What a Hardware Security Key supports

Sign-in 2FA

Passkey (FIDO2)

Master Key

Passkey (FIDO2)

Funding 2FA

YubiKey (Yubico OTP)

Trading 2FA

Not supported

Passkeys are only available for Sign-in 2FA and the Master Key. Each function is set up separately. To learn more about the 2FA functions, see this support article.

Add more than one 2FA method so you can still sign in if you lose one. See How to enable Multiple 2FA.

Hardware Security Keys frequently asked questions:

  • •

    Phishing protection: a FIDO2 key only responds to the website you registered it on, so a fake site can’t get a response from it. See Beware of phishing scams.

  • •

    Simplicity: plug it in, or hold it against your device, and touch or tap. No codes to copy and no phone battery to worry about.

  • •

    Harder to lose: Kraken Support sees many tickets from clients who lost their phone. A device used only for 2FA is less likely to go missing.

  • •

    Privacy: a lost Hardware Security Key has no information about what it’s used for or who owns it.

Keep your Master Key on a different device from your Sign-in 2FA, so losing or compromising one device doesn’t expose both. For example, if your Sign-in 2FA Passkey is on your phone, create your Master Key Passkey on a Hardware Security Key. Never keep both in the same authenticator app. See Risks of using an authenticator app.

Choose a key that supports FIDO2. Popular providers include:

Some keys also work as a cryptocurrency wallet; others focus on security alone. Do your own research to find the Hardware Security Key that works best for you.

Sign-in 2FA. Go to your Security settings. In the Sign-in Two-Factor Authentication (2FA) section, select Add passkey. When asked, insert your Hardware Security Key and follow the prompts. You can add up to five Passkeys.

Master Key. Go to your Security settings. Under Advanced Settings, select Enable next to Master Key, then choose Passkey (Recommended) and follow the prompts.

Funding 2FA. Go to your Security settings. Under Advanced Settings, select Enable next to Funding 2FA, then choose your YubiKey.

Add more than one 2FA method so you can still sign in if you lose one. See How to enable Multiple 2FA.

If you no longer have access to your Hardware Security Key, fill out this form.

FIDO2 is the standard behind Passkeys. When you register a Hardware Security Key, it creates a key pair for Kraken: the private key stays on the Hardware Security Key and Kraken stores the public key. When you sign in, Kraken sends a challenge that only your registered key can answer, and only for the real Kraken website. A fake site imitating Kraken gets no response, which prevents phishing.

Depending on your Hardware Security Key, you may be asked to set or use a PIN. Your manufacturer’s website explains how. For a YubiKey, see how to manage your PIN on Yubico’s website.

Yubico OTP generates a unique 44-character passcode when you touch a YubiKey. Each passcode works once. Kraken supports it for Funding 2FA only.