What is a USB security key? The difference between a YubiKey and a USB flash drive
There are two objects that connect via USB and look almost identical from the outside. One stores files. The other protects your accounts. They are completely different things, and confusing them is the most common mistake when someone looks for a security key for the first time.
What is a normal USB flash drive?
A USB flash drive is a storage device. You save files, copy them from one computer to another, and carry them with you. That is all it does.
Anyone can copy what is inside if they have physical access to the device. It does not require any type of verification to work — you plug it in, and the computer recognises it as a storage unit.
What is a USB security key?
A USB security key does not store files. It does not appear as a storage unit when you plug it in. Its sole purpose is to verify that it is you who is signing into an account.
It acts as a physical second factor of authentication (2FA). When you log into Gmail, your bank, or any compatible service, the system asks you to touch the key. Without that touch, there is no access — even if someone has your password.
What makes it different from an SMS code or an authentication app is that the verification happens on the physical device. There is no code to intercept, no phone number to steal, and no app to hack.
The key contains a cryptographic key that never leaves the device. When the service requests verification, the key signs a unique cryptographic response for that session. Without the physical key in your hand, that signature cannot be generated.
The 5 key differences
1. Purpose
A USB flash drive stores data. A security key authenticates your identity. These are opposite functions.
2. What it contains
A USB flash drive contains files that you can copy and move. A security key contains cryptographic keys that never leave the device — they cannot be copied.
3. How it interacts with the computer
A USB flash drive appears as a storage unit. A security key appears as an authentication device — the computer sees no files.
4. What happens if someone steals it
With a stolen USB flash drive, they have all your files. With a stolen security key, they can do nothing — they also need to know which service you use it for and have your username and password.
5. Everyday use
A USB flash drive is used for moving files. A security key is used to protect Gmail, your bank, password managers, crypto exchanges, and any important account.
What exactly is a YubiKey for?
The YubiKey is the most widely used security key on the market. It is compatible with thousands of services and works in several ways depending on the device:
With NFC — for mobile phones. You tap the YubiKey against the phone without the need for a cable or adapter. Gmail, Instagram, Coinbase, and many other services support this.
With USB — for computers. You plug it into the port, the service asks you to touch it, and that’s it. The touch activates the verification.
With passkey — the most modern method. The YubiKey acts as a hardware passkey, eliminating the password entirely on services that support it.
Gmail, Google Workspace, GitHub, Coinbase, Binance, Bitwarden, 1Password, Dropbox, Facebook, Twitter/X, Microsoft, Revolut, and hundreds more. If a service has 2FA with a security key, the YubiKey works.
Which one do I need?
It depends on your device's port and whether you also want to use it on your mobile. The main difference is between USB-A (the classic rectangular port) and USB-C (the modern oval port).
If you also want to use it on your mobile without adapters, you need a model with NFC.
→ Full guide: Which YubiKey should I buy for my device?
Most popular models
YubiKey 5 NFC
USB-A + NFC. Compatible with all major services. The complete option for users with a classic laptop and mobile phone.
YubiKey 5C NFC
USB-C + NFC. For MacBook, modern laptops, and USB-C mobiles. Same features as the 5 NFC in a USB-C format.
A USB flash drive stores files. A security key protects accounts.
If you are looking for something to move documents from one computer to another, a USB flash drive is what you need. If you are looking to protect your Gmail, your bank, or your cryptocurrencies from hacking, phishing, and SIM swapping, you need a security key.
The YubiKey is the market standard — compatible with thousands of services, manufactured in Sweden, and the choice used by companies like Google, Microsoft, and GitHub to protect their employees.
Frequently Asked Questions
Can I use the YubiKey on my mobile?
Yes, as long as the model has NFC. The YubiKey 5 NFC and 5C NFC models work by holding the key near the mobile — no cable or adapter required. Compatible with iOS and Android.
What happens if I lose my YubiKey?
It is important to have a second key registered as a backup before this happens. Most services allow you to register more than one security key. If you lose your primary one, you access with the backup and deregister the lost one.
Does the YubiKey store my passwords?
No. The YubiKey is not a password manager, nor does it store account data. It is an authentication device — it verifies that it is you, but it does not remember your passwords. To manage passwords, you can use Bitwarden or 1Password alongside the YubiKey.
Does it work without internet?
The key itself does not need internet to work — it has no battery or independent connection. It is the service you are accessing that requires a connection. The YubiKey simply responds to the service's verification request.
