Microsoft retires SMS and voice MFA on 1 February 2027. What actually qualifies

IronSightsStore

YubiKey vs Google Titan vs Feitian

Three security key brands, one standard. What actually separates them, where each one makes sense, and why the cheapest is not always wrong.

IronSights Editorial ·

We sell YubiKeys, so read this with that in mind. It is also why the comparison is worth writing carefully rather than not at all.

All three brands make FIDO2 security keys. Against phishing, they behave the same way, because the protection comes from the standard rather than the badge. A Titan, a Feitian and a YubiKey will all refuse to authenticate to a fake sign-in page. If phishing resistance is the only thing you need, all three deliver it.

The differences sit around the edges, and for some buyers those edges matter a great deal.

Google Titan

Google's own key, sold through the Google Store. It does FIDO2 and U2F, which covers passkeys and security key sign-in across every major platform, not only Google's.

It is a sensible key, particularly if your world is Google Workspace and Chrome. The catch is scope. Titan is a FIDO key and nothing more, so if you later need smart card logon, certificate authentication or stored authenticator codes, it will not do those jobs and you will be buying again.

Availability in Australia has historically been through the Google Store rather than local resellers, which matters if you need a business invoice, a purchase order or a replacement quickly.

Feitian

Feitian makes a wide range of FIDO keys, often at the lowest prices in the category, and they are legitimately certified rather than being generic imports. If budget is the binding constraint and you need to put a phishing-resistant credential in a lot of hands, Feitian is a real option and dismissing it would be dishonest.

Two practical notes. The range is broad enough to be confusing, with many models differing in ways that are hard to compare, so standardising a fleet takes more homework. And support and warranty handling for Australian buyers depends heavily on which reseller you go through.

Yubico

Yubico's advantage is not the FIDO part. It is everything alongside it.

The 5 Series speaks smart card, OpenPGP, stored OATH codes and Yubico OTP in addition to FIDO2, which means one key covers cases you have not thought of yet. Yubico also publishes detailed documentation, supports enterprise enrolment properly, and has a long track record of keys still working many years after purchase.

That breadth is what you pay the premium for. If you will never use it, you are paying for capability you do not need, and we would rather say that than sell you the wrong thing.

How to choose

If you need only FIDO2, you are buying a handful of keys, and price is the deciding factor, Titan and Feitian are both defensible choices. Nothing about the security argument pushes you to us.

If you need certificate or smart card authentication, stored authenticator codes, or a single model you can standardise a fleet on for years, the 5 Series is the one that covers it.

If you are buying for an Australian business and need invoices, purchase orders, GST handled correctly and someone local to talk to, that is a distribution question rather than a product one, and it is where buying from a local supplier earns its keep regardless of brand.

The thing that matters more than brand

Whichever badge you choose, buy two. A single key of any brand is a lockout waiting to happen, and the recovery process you fall back on is weaker than the key you just bought.

Brand choice is a smaller decision than most people think. Key count is a bigger one.

Frequently asked questions

  1. Is a YubiKey more secure than a Google Titan?

    For phishing resistance, no. Both implement FIDO2 and both refuse to authenticate to the wrong domain. The YubiKey 5 Series supports more protocols, which is a difference in capability rather than in strength.

  2. Do Titan and Feitian keys work with Microsoft 365?

    Yes, where they support FIDO2. Some tenants restrict which key models are allowed by their AAGUID, so check your own policy before buying any brand.

  3. Are cheap security keys safe?

    Certified FIDO2 keys from established manufacturers implement the same standard. The risk sits with uncertified generic keys of unclear origin, not with the recognised budget brands.

  4. Which brand should an Australian small business buy?

    If FIDO2 is all you need, any of the three works. Weigh local supply, invoicing and replacement speed alongside the product, because those are what you will deal with after the purchase.