If you lose a hardware security key that you use as a second factor, the finder still needs your password, so the immediate risk is usually small. The real problem is you. Without a spare key or another sign-in method, you're locked out, and getting back in goes through each service's recovery process. Google says that can take 3 to 5 business days.
What to do today: sign in with your spare key or backup method, remove the lost key from every account that had it, and register a replacement. There's no central switch that revokes a key everywhere. You do it account by account, starting with your password manager and your email.
What a finder can actually do
It depends on what the key was protecting and how.
- Key as second factor. The finder has the key but not your password. Without both, they don't get in.
- Key with a PIN. FIDO2 keys support a PIN, and whether it's asked for is up to each service. Where it is, the finder needs the PIN too. Yubico's FIDO documentation covers how the PIN and its retry limit work.
- Key as the only factor. If an account signs you in with the key and nothing else, the finder is one step closer. That's rarer, and it's worth checking which of your accounts are set up that way.
The finder also doesn't know whose key it is, unless it's on a keyring with your name, your office badge or your house keys. It usually is.
What happens to you
This is where it hurts. A security key is designed so that nobody but you can use it, and so that you can't be phished into handing it over. The side effect is that nobody can help you around it quickly either.
With a spare key registered
You sign in with the spare, open your security settings on each account, remove the lost key, and register a new one. Annoying, not serious.
Yubico's advice on spare keys is blunt: the best time to register a spare is at the same time as your primary, and a spare that isn't registered won't help you when you lose the first one.
With another method (an app, a passkey on your phone)
Same process. Sign in with the other method and remove the lost key. Google's guide for a lost security key says exactly this: sign in with your password and your other second step, remove the lost key, get a new one.
With nothing else
You go through account recovery, service by service. For a Google account protected by 2-Step Verification, Google says it can take 3 to 5 business days to confirm it's you. Other services have their own process, and some are slower.
Why there's no "revoke everywhere"
Yubico used to run a central revocation service and discontinued it. Their current advice is to log in to each site where you used the key and switch it to the replacement. Your key is registered separately with every account, so it's removed separately from every account.
Security key vs a card that unlocks your password manager
A card that opens a password manager is a different thing from a FIDO2 key, and losing one is a different problem. Here's the comparison, honestly.
| FIDO2 security key (as second factor) | SecureGate Card | |
|---|---|---|
| What it does | Signs a login challenge for one site | Opens your password vault |
| Can a finder use it alone? | No, they also need your password | Yes, until you deactivate it |
| How you get back in | Spare key, other method, or account recovery | Email and master password, or your linked phone |
| How you shut it off | Remove it from each account, one by one | Deactivate it once, from the panel |
| Can it be copied? | Designed not to be | The ID it sends can be copied, easily on 125 kHz cards |
Read the second row again. That's the trade-off.
The card is convenient because a tap is enough. That's also why it needs keycard habits. A lost office keycard opens the door for whoever picks it up, until someone at reception deactivates it. Our card works the same way.
If you lose your SecureGate Card
Do these in this order.
- Sign in another way. Email and master password, or tap the NFC tag you linked on your Android phone. Your vault isn't on the card. The card is only a way in.
- Deactivate the card from the panel. The card becomes inactive. From then on, signing in with it is refused.
- Close all sessions from the panel. If someone used the card before you noticed, that ends their session too.
- Check the account activity. With a verified email, you get an email when your vault is opened from an IP and device we haven't seen in the last 30 days. If one arrived that wasn't you, change your master password and review what's in the vault.
- Link a new card or tag. Then you're back to three ways in.
You don't need to contact us for any of this. It's all in the panel.
Set it up before you lose it
Everything above assumes two things you need to do on day one.
- Add an email and master password, even if you only ever use the card. Without it, a lost card with nothing else linked is the same problem as a lost key with no spare.
- Verify the email. That's what turns on the new-device alerts.
How the card unlock works covers linking a card and a phone.
For teams
If you manage a team, the risk is multiplied by the number of cards in pockets.
Write a one-line rule: lost card, deactivate it from the panel the same day, then tell whoever manages the team. It sounds obvious. It's the step people skip when they assume the card will turn up in the car.
On the Business plan, vault access can be restricted to your office network, which narrows where a lost card is any use. You also get an audit trail of who got in and when. The business page has the details.
A checklist for any hardware key
Whatever you use, a YubiKey, a Titan key, or a card:
- A second way in on every account that matters, registered now, not after the loss.
- A spare key in a drawer, not on the same keyring.
- A PIN on the key if it supports one.
- Your password manager and your email secured first. Those two open everything else.
- A note of which accounts use the key, so removing it doesn't depend on your memory.
The last one is where a password manager helps. If every account lives in the vault, the list of what to update already exists.
When SecureGate Card fits, and when it doesn't
It fits if you want a tap to open your password manager and you're willing to treat the card like a building keycard: kept on you, deactivated the day it goes missing. Recovery is quick because the vault isn't tied to the card and you shut it off in one place. Personal is free. Team is €4 per user a month and Business €8, with a 14-day trial, on the pricing page.
It doesn't fit if you want a key that's useless to whoever finds it. That's a FIDO2 key with a PIN, and you should use one on your most important accounts regardless of your password manager. It also doesn't fit if you need a vault the provider can't read. SecureGate Card encrypts your data with AES-256-GCM on our servers, with a key we hold. Bitwarden and 1Password both encrypt on your device before anything leaves it.