Use Your Phone as a Hardware 2FA Security Key (FIDO2/WebAuthn)

Why SMS and TOTP Codes Aren't Enough

SMS one-time passcodes can be intercepted through SIM-swapping, and even app-based TOTP codes (Google Authenticator, Authy) can be phished — a fake login page can relay a code you type in real time to the real site within its 30-second validity window. FIDO2/WebAuthn eliminates this entire class of attack because the cryptographic challenge-response is bound to the actual website's domain. A phishing site with a lookalike domain simply cannot complete the handshake, even if you're fooled into visiting it. Your phone can act as this hardware authenticator without buying a dedicated key like a YubiKey, using either a synced passkey or its Bluetooth radio as a FIDO2 security key.

Two Different Things: Passkeys vs. "Phone as Security Key"

These get conflated but work differently:

• Passkeys are FIDO2 credentials stored in your phone's platform keychain (iCloud Keychain or Google Password Manager) and synced across your own devices. When you sign in on that same phone, or a nearby device that can reach it, no separate pairing step is needed.
• Phone as a roaming security key uses your phone as an external authenticator for a different device — for example, unlocking a login on a Windows PC or a friend's laptop by scanning a QR code and confirming on your phone over Bluetooth. This is the FIDO "hybrid transport" (formerly known as caBLE).

Setting Up Your Phone as a Security Key on iPhone

1. Make sure you're running iOS 16 or later.
2. Go to Settings > [your name] > Passwords & Security and confirm iCloud Keychain is enabled — this is what stores passkeys.
3. On the website or service you want to secure (GitHub, Google, Microsoft, a password manager), go to its security settings and choose Add security key or Set up a passkey.
4. When prompted, choose This device if setting up on the iPhone itself, or scan the on-screen QR code from another device (like a desktop browser) and confirm with Face ID or Touch ID when your phone prompts you.

Setting Up Your Phone as a Security Key on Android

1. Ensure Bluetooth and location services are turned on — FIDO2 hybrid transport requires Bluetooth Low Energy proximity verification, and Android needs location permissions granted to complete the BLE handshake.
2. Sign in to your Google Account on the phone, since Google Password Manager backs Android's passkey storage (Android 9+ for basic FIDO2, full passkey support on Android 14+ with Google Play Services updated).
3. On the target website, choose Add security key or Use a passkey.
4. Select Use a different device / phone or tablet and scan the QR code shown with your Android phone's camera.
5. Confirm with your fingerprint, face unlock, or PIN.

Using Your Phone to Log Into a PC or Different Device

This is the "hardware key" workflow most people actually want — logging into a work laptop or a fresh Chrome profile using your phone:

1. On the sign-in page (Google, Microsoft, GitHub, most major services support this), select Sign in with a passkey or Use another device.
2. A QR code appears on the desktop screen.
3. On your phone, scan the QR code — on iPhone, use the Camera app; on Android, you may need to tap a "scan QR code" prompt inside Chrome's or the browser's passkey flow, since not all vendors trigger it automatically from Camera.
4. Your phone establishes a Bluetooth proximity check with the desktop (confirming both devices are physically near each other, which blocks remote relay attacks) and then asks you to confirm with biometrics.
5. The desktop browser logs in instantly — no code to type.

Registering as a True FIDO2 Roaming Authenticator (NFC)

Some services (notably certain enterprise identity providers and Windows Hello for Business setups) support tapping your phone via NFC instead of Bluetooth/QR, similar to how a physical YubiKey works. Both modern iPhones and Android phones with NFC can act in this role if the relying party's software stack supports it — check the vendor's documentation, since support varies more here than with the Bluetooth hybrid flow.

Caveats and Recovery Planning

• Register at least two authenticators per account. If your phone is lost, stolen, or factory reset without a cloud backup, you need a fallback — a second phone, a physical security key, or documented recovery codes stored somewhere safe (not in the same account you're protecting).
• Passkey sync is platform-locked by default. An iPhone-generated passkey syncs via iCloud Keychain to your other Apple devices, not to Android, and vice versa for Google Password Manager. Cross-platform sign-in still works via the QR/Bluetooth flow above, but the credential itself doesn't leave its ecosystem unless you explicitly export it (a feature still rolling out across vendors).
• Corporate MDM restrictions: Some enterprise device policies disable Bluetooth or block third-party keychain access, which can silently break the hybrid transport flow — test this before relying on it for a work account.