What is a U2F key and how to use it to protect your data?

Secfense meta 2a

The U2F key is a network authentication tool. In a very simplified way, the U2F key is the key to the internet. 

What does U2F stand for?

U2F is an abbreviation of the English phrase Universal Second Factor, which is the universal second component used to authenticate online. This name is associated with two-factor authentication, i.e. network authentication, in which, in addition to the traditional static password, a second component is used to increase the login security level.

U2F Keys and Two-Factor Authentication

Two-Factor Authentication or 2FA was created to better secure user accounts on the Internet. Thanks to 2FA, it is more difficult for cybercriminals to gain access to users’ private data, as they have to get through not one (password) but two firewalls (the second component). There are many methods of two-factor authentication, although authentication based on U2F keys is indicated by cybersecurity specialists as the most secure mechanism.

Confirmed security of U2F keys   

U2F keys are often called the strongest authentication method, by some described as completely resistant to phishing. U2F keys gained their good reputation after the Google corporation introduced them massively for all its employees (over 85,000 people) and thus eliminated the risks associated with phishing and credentials theft. U2F keys at Google have been used since 2017 and since then the company has not registered a single case of employee’s account takeover.

How do U2F keys work?

In addition to security, the great advantage of U2F keys over other strong authentication methods is their incredible ease of use. U2F keys allow users to quickly and securely access any website or online service. To authenticate, the user simply inserts the U2F key into a USB port and then confirms their identity by pressing a button on the key. On smartphones or tablets, the key needs to be placed close to the NFC antenna.

Deploy Multi-Factor Authentication on Any Application | Fast Track to Passwordless Transformation

What are the advantages of U2F keys?

Strong Authentication with U2F keys

Strong authentication using public-key cryptography that protects users from phishing, session hijacking, man-in-the-middle attacks, and malware.

Ease of use of U2F keys

The key works immediately after registration with the service, thanks to native support for operating systems and browsers, enabling instant authentication in any number of services. The key does not require memorizing, entering, or rewriting any codes, installing any drivers, or any additional applications.

High level of privacy

The U2F key allows users to create and fully control their online identities. A user may have multiple identities across different services, without any personal information tied to the identity. The U2F key generates a new key pair (private and public key) for each service where the service stores the public key and the private key never leaves the U2F device. Thanks to this approach, the risk of credential theft is eliminated.

A multitude of possibilities

Open standards provide U2F keys with flexibility and the possibility of various applications. Currently, U2F keys are mainly used to confirm identity in the network, in the future, they can also be used as access keys to authenticate the opening of physical doors, as a presence confirmation tool, voting tool, etc.

U2F key history

U2F keys were originally developed by a joint effort of Google and Yubico, with the participation of NXP Semiconductors. Currently, the standard is open and expanded by the FIDO Alliance – an open association whose mission is to reduce the role of passwords and replace them with stronger authentication methods.

Is U2F key the same as FIDO key?

There are many other words and phrases associated with U2F keys that are often confused with each other. The following glossary is intended to help you understand the most important terms.

What is FIDO?

FIDO is an open standard for web authentication developed by the FIDO Alliance. FIDO authentication allows you to replace a login that uses only a static password with a secure login that uses public key cryptography. The name FIDO comes from the abbreviation Fast IDentity Online (that is, fast online identity).

What is Fido Alliance?

The FIDO (“Fast IDentity Online”) Alliance is an open industry association founded in February 2013 with the mission of developing and promoting authentication standards that “help reduce over-reliance on passwords worldwide.” FIDO was founded by a group of companies which included, among others, Lenovo or PayPal. At the end of 2016, the number of FIDO members exceeded 260 and is still growing. Currently, the management board of the organization includes representatives of companies such as Alibaba Group, Amazon, American Express, Apple, Google, Intel, MasterCard, Microsoft and Visa.

What is FIDO2?

In the simplest terms, FIDO2 is an introductory step to passwordless, i.e. online authentication without the use of static passwords.

Delving into more detail, FIDO2 is the latest set of specifications developed by the FIDO Alliance. FIDO2 enables users to use devices used on a daily basis (such as smartphones and laptops) for easy authentication with online services in both mobile and stationary environments. The FIDO2 specifications are the World Wide Web Consortium (W3C) Internet Authentication (WebAuthn) specification and the corresponding Client-to-Authenticator (CTAP) FIDO Alliance protocol.

How does U2F compare to FIDO2?

U2F is the ancestor or progenitor of authentication devices that support the FIDO standard. U2F keys allow you to create and confirm your identity on the network using public-key cryptography. Thanks to the FIDO2 specification set, devices such as smartphones with fingerprint readers and laptops with infrared cameras can also serve as authentication devices and – like the U2F key – can create and confirm identities on the network using public-key cryptography.  

Where can I use U2F keys?

Each of us can use U2F keys today. Many services that we use on a daily basis allow you to secure your data using U2F keys. The most popular social media or the largest service providers on the Internet already allow the launch of U2F as the second login component. 

How to introduce U2F in an organization?

Large organizations already secure the most important applications or accounts of key employees using U2F keys. The aforementioned Google Corporation uses keys to secure all employees on all applications. 

The implementation of U2F keys in business can be a complicated process or even impossible in the traditional approach to the implementation of security tools. However, there are ways to adopt strong authentication methods that completely eliminate the development work and allow you to enter U2F keys without the need to customize the application. This approach was developed by Secfense and is based on the implementation of security broker mechanisms that shifts the burden of implementation from difficult programming work to a simple network configuration. 

To learn how U2F keys and other strong authentication methods can be implemented globally across your organization, visit the User Access Security Broker technology page and contact us.  

Antoni takes care of all the marketing content that comes from Secfense. Read More


We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Poland

As part of the pre-implementation analysis, we verified that users utilize a wide range of client platforms: desktop computers, laptops, tablets, smartphones, and traditional mobile phones. Each of these devices differs in technological advancement, features, and level of security. Because of this, and also due to the recommendation of the Polish Financial Supervision Authority (UKNF), we decided to introduce additional protection in the form of multi-factor authentication mechanisms based on FIDO. As a result, users of our applications can log in safely, avoiding common cyber threats such as phishing, account takeover, and theft of their own and their clients’ data.

Marcin Bobruk



We are excited to partner with Secfense to enhance our user access security for our web apps. By integrating their User Access Security Broker, we ensure seamless and secure protection for our applications and systems, delivering superior security and convenience to our customers.

Charm Abeywardana

IT & Infrastructure

Visium Networks

Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.

Mateusz Bodio

Managing Director


Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.

Eduard Kučera


Presto Ventures

One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.

Stanislav Ivanov

Founding Partner

Tera Ventures

Two-factor authentication is known to be one of the best ways to protect against phishing; however, its implementation has always been difficult. Secfense helped us solve that problem. With their security broker, we were able to introduce various 2FA methods on our web applications at once.

Dariusz Pitala

Head of IT