Cryptographic key exchange protocols traditionally rely on computational conjectures such as the hardness of prime factorization to provide security against eavesdropping attacks. Remarkably, quantum key distribution protocols such as the Bennett–Brassard scheme provide information-theoretic security against such attacks, a much stronger form of security unreachable by classical means. However, quantum protocols realized so far are subject to a new class of attacks exploiting a mismatch between the quantum states or measurements implemented and their theoretical modelling, as demonstrated in numerous experiments. Here we present the experimental realization of a complete quantum key distribution protocol immune to these vulnerabilities, fol...