A physical security key can provide a phishing-resistant Google sign-in step. One key is a single point of failure when it is lost, damaged or unavailable during travel. A spare that is registered in advance gives you another route without relying only on your everyday phone.
Before you start
Get a compatible key from a trusted retailer and know whether you need FIDO2 passkey support or a key used as a second step. Keep your existing key and other recovery route while adding the new one.Do it step by step
- From a trusted device, open your Google Account's Security & sign-in section and find the security-key enrollment within 2-Step Verification or passkeys.
- Follow Google's enrollment flow for the spare. Touch or unlock the physical key only in the real Google prompt shown on the correct account site.
- Give the new key a descriptive label if offered, such as 'home spare,' without writing a PIN or secret on the key itself.
- Keep the spare physically separate from the everyday key, in a secure place you can reach after a lost bag or phone. Record how to access that place in your recovery plan.
- Test a normal sign-in on a separate browser or device when Google permits the key. Keep the original session open until you confirm the new route and a backup method work.