Using a hardware security key on your exchange accounts: register two, store the spare, keep a fallback
A hardware security key is a small USB or NFC device that confirms your login only on the genuine website it was registered with. A fake login page cannot reuse it, which is exactly the weakness of codes sent by SMS or typed from an app. The catch is that a single key is a single point of failure. Lose it on a train, or leave it in a drawer in another city, and you are suddenly relying on the recovery process. Setting up keys properly means planning for that day at the start.
Find where your exchange lists security keys
Open the security section of your account settings. Depending on the exchange and the version of the app, hardware keys appear under passkeys, security keys or a similar heading; on some platforms the option is only offered in the web version. Read the exchange's help article for the feature before you begin, because it explains which actions the key protects, such as login, withdrawals or changes to security settings, and whether it replaces or sits alongside your authenticator app.
Register two keys in the same session
Buy two keys, register the first, then immediately register the second and give each a recognisable name in the list, for example everyday key and drawer key. Test both by logging out and back in with each one. Keep the everyday key on your keyring and the spare somewhere safe at home, separate from the device you trade on. If the exchange allows only one hardware key, keep your authenticator app active as the second factor and back up its setup secret on paper.
Keep a recovery path you have actually tried
Make sure the email address and phone number on the account are current, and that the email account itself is protected with a strong password and its own second factor. Note where your authenticator backup is stored. A recovery route you have never checked is a guess; logging in once with the fallback method, while you still have everything, shows you whether it works before you depend on it.
Review the list when anything changes
Whenever you replace a phone, lose a key or stop using a computer, open the security settings and remove the entries you no longer control. Old keys and forgotten passkeys in the list do no harm while you hold them, but a lost key that is still registered deserves removal straight away. Check the list of logged-in devices at the same time and end sessions you do not recognise.
Risk boundary: Germany Crypto Guide
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Read the exchange's help article on security keys to see which actions the key protects.
- Register two keys in one session, name them clearly and test each with a fresh login.
- Store the spare key away from your trading device and keep the authenticator backup on paper.
- Remove lost keys and unknown sessions from the security settings as soon as something changes.