# What Is a Hardware Token? Security Keys and OTP Tokens Explained

> A clear, defensive explainer of hardware tokens: what they are, the difference between OTP tokens, FIDO2/U2F security keys and smart cards, why security keys are phishing-resistant and OTP tokens are not, and the pros and cons of hardware tokens versus authenticator apps.

Source: https://playciso.com/blog/what-is-a-hardware-token · Published: 2026-10-23 · Publisher: PlayCISO (https://playciso.com)

---

A hardware token is a physical device used as an authentication factor — the "something you have" that proves your identity, usually on top of a password and increasingly on its own. The catch is that "hardware token" covers several quite different technologies, and they are not equally strong. ## The three kinds of hardware token Lumping them together causes most of the confusion, so it is worth separating them clearly. - OTP tokens. These generate a one-time passcode. Most are time-based (a six-digit code that rotates every 30 seconds — the TOTP scheme, the same one an authenticator app uses), though some are event-based (a new code each time you press a button). You read the code off a small screen and type it into the login page. The hardware is just a dedicated place to run the OTP algorithm. - FIDO2 / U2F security keys. The modern standard — USB, NFC or Bluetooth keys. Instead of showing you a code, the key holds a private key and authenticates by signing a cryptographic challenge. You never read or type a secret; you touch the key to approve. The private key never leaves the device. - Smart cards. A chip-bearing card storing a certificate and private key, read by a contact or contactless reader, typically within a PKI. Common in government and large enterprises, often doubling as an ID badge. All three deliver the same basic benefit — an attacker needs the physical device, not just a stolen password — which is why any of them is stronger multi-factor authentication than a password alone. But the resemblance ends at a property that matters enormously: phishing resistance. ## The phishing-resistance divide This is the single most important thing to understand about hardware tokens, because it determines whether they actually stop modern attacks. **OTP tokens are phishable.** The secret you present is a human-readable code, and a code does not know which site collected it. A convincing phishing page simply asks for your code and relays it to the real site in real time, before it expires. This is not a theoretical weakness — real-time relay (adversary-in-the-middle) phishing kits do exactly this. An OTP hardware token is no better here than an authenticator app: both produce a typeable code an attacker can intercept and replay. **FIDO2 / U2F security keys are phishing-resistant by design.** Authentication is a cryptographic signature that the browser binds to the _origin_ — the actual domain — of the site being visited. If you are tricked onto a look-alike domain, the key will not produce a signature valid for the real site. There is nothing for the attacker to capture and replay, because the response only works on the genuine origin. Phishing resistance is a property of the protocol, not of the user noticing the wrong URL. This is the same public-key approach, and the same origin-binding, that makes [FIDO2 passkeys for the workforce](/blog/fido2-passkeys-for-workforce-benefits) such a meaningful upgrade over codes. ## Smart cards and PKI Smart cards sit closer to security keys than to OTP tokens: the private key lives on the chip and never leaves it, and authentication is certificate-based rather than a typeable code. Their natural home is an organisation that already runs a **public-key infrastructure** — government, defence, large enterprises — where the card can also serve as a physical badge and support digital signatures. The trade-off is operational weight: readers to deploy, certificates to issue and revoke, and a PKI to manage. That overhead is why smart cards appear where the infrastructure already exists rather than in smaller organisations, which tend to reach for FIDO2 keys instead. ## Hardware tokens versus authenticator apps A fair comparison depends on which hardware token you mean. - Against phishing: a FIDO2 hardware key wins decisively over an authenticator app, because the app still produces a phishable OTP. An OTP hardware token offers no phishing advantage over the app — they are equivalent. - Against malware and SIM-swapping: hardware tokens win. A dedicated device is not exposed to malware on the phone, and it does not depend on a phone number that can be hijacked through a SIM swap — the weakness that makes SMS the worst common second factor. - On cost and logistics: authenticator apps win. Hardware costs money, has to be distributed, and has to be replaced when lost — and a lost token with no backup can lock a user out. - On usability: roughly a wash. A security key is a tap; an app is a glance and a type. Both beat SMS. Whichever you choose, the account-recovery path matters as much as the token. An attacker who cannot beat your security key will attack the "lost my key" flow instead — which is exactly the kind of gap an [identity risk review](/tools/identity-risk) is designed to surface. ## The practical guidance Three rules cover most situations. First, **prefer FIDO2 security keys or passkeys for anything that matters** — admin accounts, email, finance, and any identity that is a path to others — because only phishing-resistant factors reliably stop modern credential attacks. Second, treat **any OTP, hardware or app, as better than SMS but still phishable**; it raises the bar, but do not mistake it for phishing resistance. Third, **always enrol a backup factor** — a second security key stored safely, or a documented recovery process — so that a lost token is an inconvenience, not a lockout, and so the recovery path is not the weakest link. ## The takeaway A hardware token is a physical authentication factor, but the label hides a real divide. OTP tokens and authenticator apps produce codes that attackers can phish and replay; FIDO2 security keys and smart cards authenticate with origin-bound cryptography that cannot be replayed on a fake site. For protection that holds up against today's phishing, choose the cryptographic kind — and back it up. ## Frequently asked questions **What is a hardware token?** A physical device used as a "something you have" authentication factor — an OTP token, a FIDO2/U2F security key, or a smart card — that proves identity, usually alongside a password or as a passwordless credential. **OTP token versus FIDO2 security key?** An OTP token shows a typeable code (like an authenticator app); a FIDO2 key signs an origin-bound cryptographic challenge and reveals no secret. The key is phishing-resistant; the OTP code is not. **Why are security keys phishing-resistant and OTP tokens not?** A FIDO2 key binds its signature to the real site's domain, so it produces nothing usable on a fake one. An OTP code works wherever it is typed, so a phishing site can relay it in real time. **Where do smart cards fit?** They store a certificate and private key on a chip within a PKI, offering strong certificate-based authentication — common in government and large enterprises where the infrastructure already exists. **Are hardware tokens better than an authenticator app?** A FIDO2 key is, thanks to phishing resistance and immunity to malware and SIM swaps. An OTP hardware token is roughly equivalent to an app. Always enrol a backup factor.