What Is a Hardware Token? Security Keys and OTP Tokens Explained

A hardware token is a physical device used as an authentication factor — the "something you have" that proves your identity, usually on top of a password and increasingly on its own. The catch is that "hardware token" covers several quite different technologies, and they are not equally strong.

The three kinds of hardware token

Lumping them together causes most of the confusion, so it is worth separating them clearly.

• OTP tokens. These generate a one-time passcode. Most are time-based (a six-digit code that rotates every 30 seconds — the TOTP scheme, the same one an authenticator app uses), though some are event-based (a new code each time you press a button). You read the code off a small screen and type it into the login page. The hardware is just a dedicated place to run the OTP algorithm.
• FIDO2 / U2F security keys. The modern standard — USB, NFC or Bluetooth keys. Instead of showing you a code, the key holds a private key and authenticates by signing a cryptographic challenge. You never read or type a secret; you touch the key to approve. The private key never leaves the device.
• Smart cards. A chip-bearing card storing a certificate and private key, read by a contact or contactless reader, typically within a PKI. Common in government and large enterprises, often doubling as an ID badge.

All three deliver the same basic benefit — an attacker needs the physical device, not just a stolen password — which is why any of them is stronger multi-factor authentication than a password alone. But the resemblance ends at a property that matters enormously: phishing resistance.

The phishing-resistance divide

This is the single most important thing to understand about hardware tokens, because it determines whether they actually stop modern attacks.

OTP tokens are phishable. The secret you present is a human-readable code, and a code does not know which site collected it. A convincing phishing page simply asks for your code and relays it to the real site in real time, before it expires. This is not a theoretical weakness — real-time relay (adversary-in-the-middle) phishing kits do exactly this. An OTP hardware token is no better here than an authenticator app: both produce a typeable code an attacker can intercept and replay.

FIDO2 / U2F security keys are phishing-resistant by design. Authentication is a cryptographic signature that the browser binds to the origin — the actual domain — of the site being visited. If you are tricked onto a look-alike domain, the key will not produce a signature valid for the real site. There is nothing for the attacker to capture and replay, because the response only works on the genuine origin. Phishing resistance is a property of the protocol, not of the user noticing the wrong URL. This is the same public-key approach, and the same origin-binding, that makes FIDO2 passkeys for the workforce such a meaningful upgrade over codes.

Smart cards and PKI

Smart cards sit closer to security keys than to OTP tokens: the private key lives on the chip and never leaves it, and authentication is certificate-based rather than a typeable code. Their natural home is an organisation that already runs a public-key infrastructure — government, defence, large enterprises — where the card can also serve as a physical badge and support digital signatures. The trade-off is operational weight: readers to deploy, certificates to issue and revoke, and a PKI to manage. That overhead is why smart cards appear where the infrastructure already exists rather than in smaller organisations, which tend to reach for FIDO2 keys instead.

Hardware tokens versus authenticator apps

A fair comparison depends on which hardware token you mean.

• Against phishing: a FIDO2 hardware key wins decisively over an authenticator app, because the app still produces a phishable OTP. An OTP hardware token offers no phishing advantage over the app — they are equivalent.
• Against malware and SIM-swapping: hardware tokens win. A dedicated device is not exposed to malware on the phone, and it does not depend on a phone number that can be hijacked through a SIM swap — the weakness that makes SMS the worst common second factor.
• On cost and logistics: authenticator apps win. Hardware costs money, has to be distributed, and has to be replaced when lost — and a lost token with no backup can lock a user out.
• On usability: roughly a wash. A security key is a tap; an app is a glance and a type. Both beat SMS.

Whichever you choose, the account-recovery path matters as much as the token. An attacker who cannot beat your security key will attack the "lost my key" flow instead — which is exactly the kind of gap an identity risk review is designed to surface.

The practical guidance

Three rules cover most situations. First, prefer FIDO2 security keys or passkeys for anything that matters — admin accounts, email, finance, and any identity that is a path to others — because only phishing-resistant factors reliably stop modern credential attacks. Second, treat any OTP, hardware or app, as better than SMS but still phishable; it raises the bar, but do not mistake it for phishing resistance. Third, always enrol a backup factor — a second security key stored safely, or a documented recovery process — so that a lost token is an inconvenience, not a lockout, and so the recovery path is not the weakest link.

The takeaway

A hardware token is a physical authentication factor, but the label hides a real divide. OTP tokens and authenticator apps produce codes that attackers can phish and replay; FIDO2 security keys and smart cards authenticate with origin-bound cryptography that cannot be replayed on a fake site. For protection that holds up against today's phishing, choose the cryptographic kind — and back it up.

Frequently asked questions

What is a hardware token? A physical device used as a "something you have" authentication factor — an OTP token, a FIDO2/U2F security key, or a smart card — that proves identity, usually alongside a password or as a passwordless credential.

OTP token versus FIDO2 security key? An OTP token shows a typeable code (like an authenticator app); a FIDO2 key signs an origin-bound cryptographic challenge and reveals no secret. The key is phishing-resistant; the OTP code is not.

Why are security keys phishing-resistant and OTP tokens not? A FIDO2 key binds its signature to the real site's domain, so it produces nothing usable on a fake one. An OTP code works wherever it is typed, so a phishing site can relay it in real time.

Where do smart cards fit? They store a certificate and private key on a chip within a PKI, offering strong certificate-based authentication — common in government and large enterprises where the infrastructure already exists.

Are hardware tokens better than an authenticator app? A FIDO2 key is, thanks to phishing resistance and immunity to malware and SIM swaps. An OTP hardware token is roughly equivalent to an app. Always enrol a backup factor.