NFC Security Keys and FIDO2: How Tapping to Sign In Actually Works
An NFC security key lets you tap a hardware key to your phone instead of typing a password. It uses FIDO2 — WebAuthn plus CTAP2 — to sign a challenge with a private key that never leaves the device. NFC is just the tap-based transport; the same key can also connect over USB or Bluetooth. Here's how the tap works on Android and iPhone, why NFCore shows nothing when you scan one, and what to check before you rely on it.
What it is
An NFC security key is a small hardware device that signs you into an account when you tap it against your phone or laptop instead of typing a password. The tap itself is just the handshake — the real authentication runs on FIDO2, the standard built from WebAuthn and CTAP2. NFC is one of three ways a FIDO2 key can talk to your device, alongside USB and Bluetooth. The security model doesn't change depending on which one you pick.
That's no small niche. By May 2026, roughly 5 billion passkeys had been deployed worldwide, and NFC is the fastest way to use a hardware key on a phone with no spare USB-C port to give up.
How it actually works
Public-key crypto, not a password over the air
When you register a key with a site, it generates a key pair and hands over only the public half. From then on, signing in means the site sends a challenge and the key signs it with the private key — a value that never leaves the hardware. Nothing resembling a password crosses the NFC link. And because the private key lives on a separate device, malware on your computer simply can't reach it.
One key, two possible modes
The same physical key can support two flows. CTAP2 enables full passwordless sign-in with a passkey; CTAP1, formerly called U2F, is a second factor that still expects a password first. The key doesn't choose which one runs — the site does.
Why it's not an NDEF tag
If you've used NFCore to read Wi-Fi tags, business cards, or smart-home triggers, it's tempting to assume any NFC device works the same way. A security key doesn't. NFCore and other tag readers parse the NDEF record format — see what's actually stored on an NFC tag — while a FIDO2 key speaks CTAP2 over the same ISO 14443 radio layer with a different command set entirely. Tap a security key with a tag-reader app and you'll correctly see nothing useful. That's not a bug in the app; the two devices just aren't having the same conversation.
Where you'll see it
Android: the tap depends on the key's shape
Google's instructions break down by hardware design: gold-disc keys need a plain tap, gold-tip keys need a tap followed by a press, button keys need the button held during the tap, and some designs must be removed and reinserted between uses. If a registered key stops working, restart the phone, toggle NFC off and on, or update Google Play Services.
iPhone only — not Mac, not iPad
Platform support isn't even here. As covered in how iOS and Android handle NFC differently, Apple limits NFC keys to iPhone: tap it to the top back edge, and Mac or iPad can't read it at all. Apple also requires at least two registered keys as backup, since losing every key and trusted device at once can lock you out for good.
Tips, gotchas, and a quick how-to with NFCore
A thick case, a metal back, or a stack of cards against the phone can all weaken a tap enough that nothing registers. Remove the obstruction and try again, closer to the antenna. Not sure where that antenna sits? NFCore's tag-reading tools are a fast way to confirm reception on your own tags before you blame the security key.
One habit worth keeping: NFCore reads and writes NDEF tags you own — Wi-Fi cards, vCards, automation triggers — while a FIDO2 key runs an authentication handshake that never touches NDEF at all. Different job, same radio.
Frequently Asked Questions
Can my phone act as a FIDO2 security key instead of buying a separate one?
On Android, many phones can act as a roaming FIDO2 authenticator over Bluetooth, though that's a different flow from tapping an external NFC key. On iPhone, Apple's own passkeys use Face ID or Touch ID rather than an external tap, so the phone itself is the authenticator — you generally don't need a physical key unless a site supports adding one as a backup.
Why does NFCore show nothing when I scan my security key?
Because NFCore reads NDEF records, and a FIDO2 key doesn't store any. It responds to CTAP2 commands over the same NFC radio, but that's a different protocol entirely — an empty result is expected, not a failed scan.
Does my phone case affect whether the tap works?
Yes. Thick cases, metal backs, and cards stacked against the phone can attenuate the signal enough to stop a read. Remove the case and hold the key flat against the antenna area, and it usually resolves itself.
What happens if I lose my only security key?
On accounts like Apple's, losing every key and trusted device at once can lock you out permanently. That's why keeping at least two keys, with one stored as a dedicated backup, is a requirement rather than a suggestion.
Conclusion
NFC on a security key is just the tap-based transport for FIDO2's public-key sign-in — a different job entirely from the NDEF tags NFCore reads and writes. As passkeys spread toward the billions of devices already using them, expect more sites to offer an NFC security key next to SMS codes and authenticator apps. Knowing which protocol you're tapping into makes it much easier to tell a working setup from a broken one.