FIDO2 Security Keys

How to Choose a FIDO2 Security Key

Pick the connector first: USB-A for desktops and docks (A4B, K9B), USB-C for newer laptops and phones (K40, K39), NFC to tap on phones, Bluetooth for tablets (K41, K33) and Lightning for older iPhones (K44). Then choose how users unlock the key: a PIN on standard keys, or a fingerprint on biometric keys such as the K26 and K45, which suit shared workstations. Need smart card login or a federal requirement? Choose a PIV model with FIPS 140-2 Level 2, such as the K40+, K9+ or K26+. Buy two keys per person, one as a backup.

Compare FEITIAN FIDO2 Security Keys

Price on ftsafe.us on 29 October 2026. "-" means the feature is not listed on the product page. "Passkeys stored" is the number of resident (discoverable) credentials; every key can also protect an unlimited number of accounts that use non-resident credentials.

How to Find FIDO2 Certified Security Keys

Every key in this collection is FIDO2 and FIDO U2F certified, as stated on its product page. You can check any model yourself in two places:

• FIDO Alliance certified products: search for FEITIAN in the FIDO Certified Products directory.
• Microsoft Entra ID attestation list: Microsoft lists every key that is eligible for attestation in Entra ID, with its AAGUID. The list includes the Feitian ePass FIDO2, ePass FIDO2-NFC, BioPass FIDO2 and AllinOne FIDO2 authenticators (Microsoft Learn, MDS version 285). To be on this list a key must hold a FIDO2 certification.

FIDO2 Security Keys provide secure, passwordless authentication for online accounts, cloud applications, and enterprise systems. Built on modern authentication standards from the FIDO Alliance, these hardware security keys protect against phishing, man-in-the-middle attacks, and credential theft.

Compatible with Windows, macOS, Linux, and major browsers, FIDO2 keys support two-factor (2FA), multi-factor (MFA), and passwordless login for platforms like Microsoft 365, Google Workspace, and more. Ideal for IT administrators, enterprises, and individual users seeking fast, reliable, and secure login solutions.

FEITIAN makes certified security keys for businesses and enterprises. Keys such as the A4B, K9B, K40 and K45 are certified to both FIDO2 and FIDO U2F, and they work with identity and access platforms including Microsoft Entra ID, Microsoft Active Directory, Okta, Ping Identity, Duo Security and Google Accounts.

How FIDO2 Security Keys Protect Enterprise Data

A FIDO2 security key is a hardware authentication token for data protection. It keeps its cryptographic keys on the device and creates site-specific keys, so secrets are never shared between service providers. Because the key signs each login for the real website, a phishing page or man-in-the-middle cannot reuse it. The same key supports passwordless login, two-factor authentication (2FA) and multi-factor authentication (MFA) for employee logins and business applications. Read more on how a security key stops account takeover.

Certified Security Hardware for Enterprises

• FIDO2 and FIDO U2F certified: works out of the box with hundreds of services that support FIDO2 and FIDO U2F.
• FIPS 140-2 Level 2: models such as the K44 and K45 carry FIPS 140-2 Level 2 certification.
• PIV smart card support: the K9+, K40+, K26+, K45+, K49+ and K44 add PIV for certificate-based login.
• Legacy systems: many keys add OATH-HOTP one-time passwords for applications that do not support FIDO yet.

Explore Our FIDO2 Security Key Options

• USB-A security keys: for desktops, laptops and docks with standard USB-A ports, including the K10 micro key.
• USB-C security keys: for newer laptops, tablets and phones with USB-C ports.
• NFC security keys: tap-to-authenticate on compatible phones and readers.
• Biometric security keys: fingerprint verification on the key, such as the K26 and K33 AllinPass (USB, NFC and Bluetooth).

Planning a rollout? Contact sales@ftsafe.us for bulk orders.

Frequently Asked Questions

What is the difference between FIDO2 and FIDO U2F?

FIDO U2F adds a security key as a second factor after your password. FIDO2 also supports passwordless sign-in, where the key is unlocked with a local PIN or, on biometric models, a fingerprint. Most FEITIAN keys, such as the A4B and K9B, are certified for both, so one key covers older U2F services and newer FIDO2 logins.

What is a resident credential, and how many can a key store?

A resident (discoverable) credential is a passkey stored on the key itself and used for passwordless sign-in. Capacity depends on the model, for example 22 on the K9B, 44 on the K40+ and 128 on the A4B. Accounts that use non-resident credentials do not use this storage, so one key can protect an unlimited number of them.

Can FIDO2 security keys help with systems that do not support FIDO yet?

Yes. Many FEITIAN FIDO2 keys also generate one-time passwords: the A4B and K10 add OATH-HOTP, and the K9B, K40 and K39 support both OATH-HOTP and OATH-TOTP. Use those codes for VPNs and applications that still ask for a one-time code.

How do I roll out FIDO2 security keys to a whole company?

Start with a pilot group: enable Passkey (FIDO2) in your identity platform, such as the Microsoft Entra authentication methods policy, and have users register their keys. Register two keys per person, one for daily use and one as a backup, then turn off weaker methods once everyone is enrolled. For large rollouts, contact sales@ftsafe.us for volume pricing and deployment help.

How do I choose the right FIDO2 security key?

Start with the ports and devices your users have: USB-A for desktops and docks, USB-C for newer laptops, and NFC or Bluetooth for phones. Then add the features you need, such as a fingerprint sensor for shared workstations or PIV for smart card login. The K40+ (USB-C, NFC) and K9+ (USB-A, NFC) combine FIDO2, OATH one-time passwords and PIV in one key.

Which FEITIAN security key works with iPhone?

On iPhone 15 and later, which have USB-C, any USB-C key works, such as the K40 or K40+. On iPhones with a Lightning port, plug in the K44 (USB-C and Lightning) or tap an NFC key such as the K9B, K40 or K40+. Apple requires iOS 16.3 or later to protect an Apple Account with security keys.

Can I use a FEITIAN security key with my Google account?

Yes. FEITIAN keys work with Google Accounts as a passkey or as a second step after your password. Add it in your Google Account under Security, in Passkeys and security keys, and register a second key as a backup. NFC keys such as the K9B and K40 also sign in on Android phones with a tap.

Do FEITIAN security keys work with Microsoft accounts and Entra ID?

Yes. FEITIAN keys work with Microsoft accounts and Microsoft Entra ID. Microsoft lists the Feitian ePass FIDO2, ePass FIDO2-NFC, BioPass FIDO2 and AllinOne FIDO2 authenticators as eligible for attestation in Entra ID, so they can be used even when an administrator enforces attestation. Fingerprint keys such as the K26 also sign in to Windows with Windows Hello on Entra ID joined PCs.

What happens if I lose my security key?

Sign in with your backup key, then remove the lost key from each account so it can no longer be used. A FIDO2 key is protected by a PIN or a fingerprint, so someone who finds it cannot sign in with it alone. This is why we recommend registering two keys per person from day one.