For around $20 to $40, you get a durable key that’s compatible with most services but doesn’t offer as many connectivity options.

Cost: Security keys can cost anywhere between $20 and $70 or so.

Most people are likely to want at least one portable key with a keychain loop.

These designs are useful if you work only on a computer, but they’re a pain to use on mobile devices. Some companies also make smaller, “nano”-size keys that fit flush with your computer’s USB port.

We looked at whether the necessary components were well protected. Portability and durability: We put the keys we tested through the type of wear and tear that can be expected over a normal day of use, including tossing them around on a keychain and dropping them into the bottom of a bag, and we looked for any parts that seemed as if they could easily snap or break off too quickly with use.We preferred companies that were well known and had been around for a while, an indicator of continued support in the future. Customer support: We looked at the types of support each company offered, as well as how much documentation was available on its website both for setting up keys and for troubleshooting.Setup and user experience: We wanted security keys that were easy to set up and use.We preferred security keys that came with a variety of connection options so they could work on both Android and iOS, as well as both Windows and macOS computers.

Consistency and compatibility: We looked for security keys that worked as consistently as possible with each of the services we tested them with.

Security keys typically have no moving parts and are durable, so you’ll probably use the same keys for many years. This means that they support more applications and websites, and it suggests that they are less likely to need replacing.

Future-proof support for multiple standards: We focused on keys supporting the newest set of specifications, such as FIDO2.

Security protocols: Since hardware keys are a security item, we dug into each company’s track record on previous recalls and looked at whether the company had a coordinated vulnerability-disclosure program to allow security researchers to report bugs.

Google u2f