Quantum key distribution (QKD) allows two users to communicate with theoretically provable secrecy by encoding information on photonic qubits. Current encoders are complex, however, which reduces their appeal for practical use and introduces potential vulnerabilities to quantum attacks. Distributed-phase-reference (DPR) systems were introduced as a simpler alternative, but have not yet been proven practically secure against all classes of attack. Here we demonstrate the first DPR QKD system with information-theoretic security. Using a novel light source, where the coherence between pulses can be controlled on a pulse-by-pulse basis, we implement a secure DPR system based on the differential quadrature phase shift protocol. The system is modulator-free, does not require active stabilization or a complex receiver, and also offers megabit per second key rates, almost three times higher than the standard Bennett-Brassard 1984 (BB84) protocol. This enhanced performance and security highlights the potential for DPR protocols to be adopted for real-world applications.Quantum key distribution (QKD) has developed strongly since the proposal of the first protocol in 1984 1-3 . The future could see widespread quantum networks similar to those in Tokyo 4 and Vienna 5 and global secure communication enabled by QKD over satellites 6 . These advances depend on the development of simple, cost-effective and high performance implementations. Innovations in both protocols and system hardware are required to achieve this.Nearly two decades after the inception of BennettBrassard 1984 (BB84) 1 , distributed phase reference (DPR) QKD was proposed, allowing for much simpler experimental implementations. The class includes the differential phase shift 7,8 and coherent-one-way 9,10 protocols. One advantage is that the transmitters needed to realize these DPR protocols can be made using off-the-shelf telecom lasers and modulators. However the benefit of their simpler implementation is outweighed by a seriously degraded performance when full security is taken into account 3,11,12 . To plug the security gap, two further DPR protocols were proposed: round-robin differential phase shift and differential quadrature phase shift (DQPS). The former simplifies the estimation of Eve's information, but requires an overly complicated QKD receiver setup 13-16 , making it impractical. The latter separates the signal from the differential phase shift protocol into blocks, each having a global phase that varies randomly, ensuring the protocol is immune against coherent attacks 17,18 . It does, however, stray from the main goal of DPR protocols to provide simpler QKD implementations, due to the phase randomization requirement that would ordinarily require extra system components. In this work we show it is possible to produce phase coherent and phase randomized pulses from a single device. This device is based on optical injection of one laser diode into another, removing the need for a phaserandomization component in DQPS by relying on the randomness pr...