Our server generates a random token and asks your browser to get it cryptographically signed by your security key.

WebAuthn is a pretty neat implementation based on public key crypto, and resolves security vulnerabilities like phishing. Any device that supports the U2F standard will work. If you’re interested in getting a security key, you can buy a YubiKey from the Yubico Store, Feitian keys from Amazon, or Titan keys from the Google Store. Adding a second factor does not mean you can get away with a weaker Master Password. Your Master Password, which is used for the encryption of your data, still remains the most important thing protecting your 1Password account. You can add your security keys now by heading over to the 1Password web app and visiting our new Two-Factor Authentication page. So while it works great as your second factor in those browsers, for now you’ll still need an authenticator app set up to use with the 1Password desktop and mobile apps (and any unsupported browsers). Security keys are currently supported on in the latest versions of Chrome, Firefox, Opera, and Edge.

No need to find your phone, open the authenticator app, and type out the six-digit code while trying to race the countdown.

When you’re prompted for your second factor, just tap a button on your security key and you’re in. – Derek Hanson, VP, Solutions Architecture and Alliances at Yubico It’s exciting to see 1Password implement WebAuthn support to enable YubiKey hardware-backed authentication for their users”. “WebAuthn brings to life the concept of using an external security key across multiple devices and platforms, with no shared secrets among services. Support is built into most web browsers and works with many online services like Google and GitHub. Security keys are small physical devices that can be used as a second factor.

1password yubikey