Buy at least two security keys, register both on every important account, and keep them in different places. A hardware key resists phishing, but a lost single key can lock you out. Apple's own security key feature requires you to register at least two for that reason.
Why two
Apple's page on security keys for an Apple Account says you must add and maintain at least two FIDO certified keys, and you can add up to six. It warns that if you lose all your trusted devices and security keys, you could be locked out permanently. It recommends storing keys in more than one place, such as one at home and one at work.
That rule is good practice beyond Apple. Any account that depends on one physical object has a single point of failure.
Where to keep each key
- Key one: daily use. On your keyring or in your bag, attached to the habit of leaving the house.
- Key two: home. In a locked drawer or a safe, not next to your laptop.
- Key three, optional: another site. The office, a relative's home or a safe deposit box.
Do not leave a spare in your laptop bag. If the bag is stolen or lost, you lose both.
Register in one sitting
- Collect your keys and a list of important accounts: email, Apple or Google or Microsoft account, password manager, bank, brokerage, social accounts.
- For each account, register key one, then key two.
- Record the date and which keys are on which account in a note inside your password manager.
- Generate and store recovery codes where the service offers them.
- Test each key by signing in on a second device.
What else can stand in
Apple notes that a trusted Apple device signed in to your account can substitute for a physical key when signing in. Passkeys that sync across your devices give a similar fallback. CISA calls passkeys an acceptable alternative to hardware keys where keys are not feasible.
What if you lose one
- Sign in with the spare.
- Remove the lost key from every account.
- Buy a replacement and register it.
- If the account supports it, review recent sign in activity.
Do this the same day. A lost key is not useful to an attacker without your password in most setups, but you do not want to be one loss from a lockout.
Limits
Apple's feature does not support child accounts, Managed Apple Accounts, or devices that cannot be updated. It also needs two-factor authentication on and supported OS versions. Check the page for your devices before you buy.
For a stricter setup on a Google account, see who should enroll in Advanced Protection.
Quick check
How many keys does Apple require?
At least two, and up to six.
Should the spare key live in my laptop bag?
No. Keep it somewhere separate, such as at home, so one loss does not take both.
Sources
- Apple, About Security Keys for Apple Account
- CISA, Mobile Communications Best Practice Guidance, version 2.0 PDF
Last reviewed: 19 October 2026.
