Thetis Pro FIDO2 Hardware Security Key

Thetis Pro FIDO2 - USB-A/C + NFC Hardware Security Key

For the Thetis Pro FIDO2, FIDO2 authentication uses SHA-256 internally¹. When the Thetis Pro FIDO2 authenticates a WebAuthn request, the device signs an authenticator data structure using ECDSA-P256 - which internally hashes with SHA-256. The hash function secures the authentication assertion: the signed payload includes a SHA-256 hash of the client data JSON, binding the authentication response to the specific origin and challenge. This means even though the Thetis Pro does not expose a user-accessible HMAC API, SHA-256 is integral to every login it performs.

At approximately $33 USD², the Thetis Pro FIDO2 is the leading budget option among hardware security keys in the US market as of mid-2026. Its primary differentiator is the dual USB-A/USB-C connector - a physical slider switches between the two form factors on a single device. NFC support enables authentication on mobile devices. The device supports FIDO2, FIDO U2F, and OATH TOTP/HOTP protocols; it does not support HMAC challenge-response, OpenPGP, PIV, or Yubico OTP modes.

The Thetis Pro targets users who need strong second-factor authentication without the cost of a YubiKey 5 series or Nitrokey 3. FIDO2 authentication is phishing-resistant by design: the key binds each credential to a specific origin (website domain), making credential reuse across domains impossible. An attacker who redirects you to a phishing domain cannot get a valid FIDO2 assertion for the legitimate domain.

For use cases that require HMAC challenge-response for offline applications (VeraCrypt, KeePass, custom HMAC authentication), the Thetis Pro is not the right choice - it is FIDO2-only. For browser-based second-factor authentication across accounts, it provides strong security at a price accessible to individual developers and small teams.

Specifications²

FIDO2 origin binding blocks phishing at the hardware level

Each credential the Thetis Pro generates is cryptographically bound to the website origin it was registered on, which means the key material is tied to a specific domain at the hardware level and cannot be used anywhere else³. During registration, the device records the relying party ID, which is the site's domain. When you authenticate, the browser sends the current origin to the device. If the origin does not match the registered domain, the device refuses to sign the challenge, and the login attempt fails. A phishing site at a lookalike domain cannot receive a valid FIDO2 assertion for the legitimate service, regardless of whether you entered your password.

Why origin binding matters in phishing attacks

The browser sends the exact origin to the authenticator, so a lookalike domain cannot reuse a credential registered elsewhere. This hardware check is stronger than a password prompt because the key refuses the challenge before signing, and no amount of social engineering can persuade the device to sign for a domain it did not originally register with. Even if an attacker tricks you into entering your password on a perfect clone of your bank's login page, the FIDO2 key simply will not produce a valid assertion for the wrong domain, and the login fails before any session token is issued. This is the core property that separates FIDO2 from SMS-based or TOTP-based second factors, which remain vulnerable to real-time phishing proxies that forward the one-time code to the legitimate site within its short validity window.

This binding is enforced in hardware and cannot be overridden by a browser extension, injected script, or malware running on the host. It is the primary reason FIDO2 security keys are classified as phishing-resistant authenticators under NIST SP 800-63B⁴, and it is also why major browsers and identity providers have made FIDO2 the recommended second-factor method over older approaches like SMS codes and TOTP apps.

For registering with common services, the setup process is the same everywhere

For any service that supports FIDO2 or WebAuthn, registration follows the same three steps regardless of which key brand you use. Navigate to your account security settings and select Add security key. When the browser prompts you, insert the Thetis Pro and press the button. The device generates a unique key pair for that service, stores the private key internally, and sends the public key to the service. The process takes under thirty seconds, and you can repeat it for every account you want to protect with the same physical key.

Registering the same key across multiple accounts

A single Thetis Pro can hold separate credentials for many services, and each credential remains isolated by origin so that a compromise of one service never leaks the key material for another⁵. That lets you use one device for work, personal, and developer accounts without reusing a FIDO2 key pair across different relying parties. The device stores each credential independently, so registering a new service does not expose or weaken any existing credential, and you can revoke access for one service at any time without affecting the others. Most services display the key's nickname or registration date in their security settings, making it straightforward to audit which accounts a given Thetis Pro protects and to remove credentials for services you no longer use.

Google, GitHub, Microsoft Entra, Cloudflare, and Okta all support FIDO2 security keys for second-factor or password-less login. Connect via USB-A or USB-C using the physical slider switch, or tap the NFC antenna on a compatible Android or iOS device. CapyToolkit lists which protocols each key supports so you can match a key model to the connectors and services your team actually uses before placing an order.

Comparing the Thetis Pro against the YubiKey 5 NFC by protocol scope

Comparing the Thetis Pro to the YubiKey 5 NFC comes down to protocol breadth and price. Both devices provide FIDO2 and FIDO U2F authentication. The YubiKey 5 NFC adds HMAC-SHA1 challenge-response, OpenPGP, PIV smart card, and TOTP; the Thetis Pro provides none of these. For users whose only requirement is browser-based second-factor authentication, the price difference per key represents straightforward savings with no reduction in FIDO2 protection quality.

Checking protocol scope before procurement

For teams that need HMAC challenge-response for KeePassXC or VeraCrypt, or PIV authentication for Windows domain login, the YubiKey 5 NFC is the correct choice. Evaluate protocol requirements across your full user base before committing to a key model for a deployment, and where the key hashes internally during FIDO2 assertions, you can watch SHA-256 run outside the FIDO2 hardware to understand the algorithm, even though this specific device never exposes it as a user-facing function. Survey every team that will use the keys, because a developer who relies on PIV for corporate VPN access has a very different requirement than a designer who only needs FIDO2 for GitHub login, and buying the wrong key model means either paying for unused features or discovering a missing protocol after the keys are already deployed.