What Is a YubiKey? How It Works, Types, Setup, and How to Choose One

Reusing passwords or relying on authentication codes sent by SMS may feel secure enough, but these methods still have weaknesses. Even common forms of two-factor authentication can be vulnerable to phishing attacks.

One way to address this problem is with a physical security key such as YubiKey. Hardware security keys are widely used by individuals and organizations that want stronger protection against phishing and account takeovers.

But if you have only heard the name YubiKey before, it may not be immediately obvious what it does, how it differs from an authenticator app, or which model you should choose.

In this guide, we will explain how YubiKey works, the different types available, how to set one up, its advantages and disadvantages, and what you should prepare before relying on one for important accounts.

What Is a YubiKey?

YubiKey is a hardware security key made by Yubico, a security company founded in Stockholm, Sweden.

Depending on the model and device, you can authenticate yourself by inserting the key into a USB port and touching its contact area, or by tapping it against an NFC-compatible smartphone.

Some of the main features of YubiKey include:

• No battery is required
• No network connection is required
• Many common uses do not require dedicated drivers
• One key can be used with multiple services and devices
• Models are available for USB-A, USB-C, Lightning, and NFC
• It works across platforms including Windows, macOS, Linux, iOS, and Android

A YubiKey is essentially something you physically possess that can be used as part of the authentication process.

Why Use a Hardware Security Key?

Passwords Alone Are Not Enough

Passwords can be guessed, stolen through phishing, exposed in data breaches, or reused across multiple services.

If the same password is used on several websites, a breach at one service can potentially put other accounts at risk as well.

This is one reason why two-factor authentication, or 2FA, has become increasingly common.

Traditional Two-Factor Authentication Still Has Weaknesses

Two-factor authentication adds another verification step in addition to a password. However, not every authentication method provides the same level of protection.

With SMS codes and one-time passwords, an attacker can create a fake login page that looks almost identical to the real website.

If a victim enters both their password and verification code into that page, the attacker may be able to forward those credentials to the legitimate service and sign in.

YubiKey Is Designed to Resist Phishing

One of the biggest advantages of YubiKey is its support for standards such as FIDO2 and WebAuthn.

With WebAuthn-based authentication, credentials are tied to the legitimate website or service. A fake domain cannot simply request the same authentication and reuse it elsewhere.

As a result, even if you accidentally visit a convincing phishing page, the security key is designed not to authenticate it as the legitimate service.

This makes hardware security keys particularly useful for protecting high-value accounts.

How Does YubiKey Work?

Public-Key Cryptography

For FIDO-based authentication, YubiKey uses public-key cryptography.

When you register a security key with a service:

1. The key creates a cryptographic key pair.
2. The public key is registered with the service.
3. The corresponding private key remains on the security key.

When you later sign in:

1. The service sends a cryptographic challenge.
2. The YubiKey signs that challenge using the private key.
3. The service verifies the signature using the previously registered public key.

The private key does not need to be sent across the internet.

Different services can also use separate credentials, which reduces the risk of one compromised service affecting another.

YubiKey Supports Multiple Authentication Protocols

One reason the YubiKey 5 Series is popular is that it supports both modern and legacy authentication technologies.

Depending on the model, supported protocols can include:

• FIDO2 / WebAuthn: Modern authentication used for passwordless login and passkeys
• FIDO U2F: An earlier FIDO standard designed primarily for two-factor authentication
• OTP: One-time passwords that can be entered as keyboard input
• PIV smart card: Certificate-based authentication often used in enterprise environments
• OpenPGP: Used for cryptographic signing and encryption
• OATH TOTP/HOTP: Allows credentials for authentication codes to be stored on the key and used with Yubico Authenticator

This makes some YubiKey models useful not only for modern web accounts, but also for enterprise systems and older authentication environments.

What Happens If Someone Steals Your YubiKey?

A common concern is whether someone could simply pick up a lost YubiKey and immediately access your accounts.

In most configurations, the key alone is not enough.

For example:

• In traditional two-factor authentication, the attacker would still need your username and password.
• Passwordless authentication may require the YubiKey PIN.
• YubiKey Bio models can use fingerprint verification.
• Repeated incorrect PIN attempts can lock the relevant authentication function.
• The physical key itself does not indicate which online accounts it belongs to.

However, the exact security level depends on how the key has been configured.

Some YubiKey functions can operate without a PIN. Static password functionality, for example, requires additional care.

For important accounts, use appropriate PIN protection and maintain another secure recovery method.

YubiKey Models and Product Lines

Yubico offers several YubiKey families. The main differences include supported protocols, connector type, NFC support, and biometric authentication.

YubiKey 5 Series

The YubiKey 5 Series is the general-purpose, multi-protocol lineup.

It supports technologies such as FIDO2, U2F, OTP, PIV, and OpenPGP.

Product availability and specifications can change, so check Yubico’s current product information before purchasing.

YubiKey Bio Series

The YubiKey Bio Series adds fingerprint authentication.

Fingerprint data is stored inside the security key rather than being sent to a computer or cloud service.

The Bio Series supports FIDO2/WebAuthn and FIDO U2F and is designed primarily for modern authentication and passwordless login.

USB-A and USB-C versions are available.

Security Key Series

The Security Key Series focuses on FIDO2 and U2F.

It does not provide all of the additional functionality found in the YubiKey 5 Series, such as OTP, PIV, and OpenPGP.

However, if your main goal is securing popular online accounts with FIDO-based two-factor authentication or passkeys, the Security Key Series may be sufficient.

USB-A/NFC and USB-C/NFC models are available.

YubiKey 5 FIPS Series

The YubiKey 5 FIPS Series is designed for organizations with specific compliance and government security requirements.

These models are typically aimed at government agencies, regulated industries, and enterprise environments rather than general personal use.

Which YubiKey Should You Choose?

A simple way to choose is to start with your devices and then consider which authentication protocols you actually need.

First check whether your devices primarily use USB-A or USB-C.

Then decide whether you need NFC for smartphone authentication.

For many users with modern hardware, the YubiKey 5C NFC is one of the most flexible options because it combines USB-C connectivity with NFC.

What Can You Do With a YubiKey?

Two-Factor Authentication

One of the most common uses is adding YubiKey as a second authentication factor.

Instead of entering an SMS or authenticator-app code, you insert or tap the key and confirm the authentication request.

Passwordless Authentication

Services that support FIDO2 can allow authentication without entering a traditional password.

Depending on the configuration, you may authenticate with:

• A PIN and physical touch
• A fingerprint on a YubiKey Bio
• A FIDO credential stored on the security key

Removing traditional passwords can reduce risks associated with password reuse and password leaks.

Computer and Enterprise Authentication

YubiKey can also be used in enterprise authentication environments, including computer access, certificate-based authentication, and single sign-on systems.

The exact functionality depends on the operating system, authentication protocol, and organization configuration.

Encryption and Digital Signatures

Models supporting OpenPGP can store cryptographic keys used for encryption and digital signatures.

YubiKey can also be used in certain SSH authentication setups.

Popular Services That Support YubiKey

YubiKey can be used with many major services, including:

• Google and Google Workspace
• Microsoft
• GitHub
• Dropbox
• Salesforce
• X
• Facebook

Compatibility varies by service and authentication method.

Yubico maintains a Works with YubiKey catalog that can be used to check current compatibility.

Advantages of YubiKey

Strong Phishing Resistance

FIDO2/WebAuthn authentication is designed to prevent credentials from being used on an unauthorized domain.

This provides much stronger protection against credential phishing than manually entered authentication codes.

Fast Authentication

There is no need to open an app, wait for a text message, or manually type a six-digit code.

In many cases, authentication only requires inserting or tapping the key and touching it.

No Battery or Charging

YubiKey does not require charging, making it convenient as a long-term authentication device.

Durable Physical Design

YubiKeys are designed for everyday use and can be carried on a keychain.

Private Keys Stay on the Device

For public-key authentication, private keys remain on the security key rather than being transmitted to the service.

Works Across Multiple Devices

The same physical key can be used across multiple compatible computers, phones, and services.

This can be especially useful if you regularly switch between devices.

Disadvantages and Things to Consider

YubiKey is not the best solution for every situation.

Before adopting one, consider the following limitations.

Upfront Cost

Unlike many authenticator apps, hardware security keys must be purchased.

Ideally, you should also have a second key available as a backup.

Physical Loss

Because YubiKey is a physical device, it can be lost.

If a key is your only authentication method, losing it can make account recovery difficult.

A spare key and recovery codes are strongly recommended.

Not Every Service Supports Security Keys

FIDO2 and WebAuthn support has expanded significantly, but compatibility still varies by website, application, and organization.

Some accounts may still require other authentication methods.

Each Service Must Be Registered

A new YubiKey generally needs to be added individually to each service you want to protect.

Your primary key and backup key are not automatically synchronized.

You Need to Carry It

Depending on your setup, you may need to keep the key on a keychain or leave a Nano model connected to a computer.

Accidental OTP Input on Nano Models

If a Nano model remains connected to a computer, accidentally touching the contact may trigger OTP output and type a long string into the active application.

This behavior can be adjusted in the key’s OTP configuration.

Before You Start: Prepare a Backup Key and Recovery Method

One of the most important parts of using a hardware security key is planning for loss or failure.

Register a Spare Security Key

Yubico recommends having a backup key, much like keeping a spare house or car key.

Register the second key with each important service.

The primary and backup YubiKeys do not automatically share registrations, so each key must normally be registered separately.

Store the Spare Somewhere Safe

Do not carry your primary and backup keys together.

Keep the spare in another secure location.

Save Recovery Codes

Many services generate emergency recovery codes when two-factor authentication is enabled.

Store them somewhere secure, preferably separately from your primary devices.

Consider an Additional Authentication Method

Where appropriate, you may also keep another recovery option, such as an authenticator app.

The backup YubiKey does not necessarily need to be the exact same model as your primary key. It only needs to support the authentication protocol required by the services you use.

How to Set Up a YubiKey

The exact steps vary by service, but the general process is similar.

1. Connect the Key

Insert the YubiKey into your computer’s USB port.

For supported smartphones and YubiKey models, you can also use NFC.

2. Configure a PIN When Required

FIDO2 can use a PIN for passwordless authentication and other user-verification scenarios.

YubiKey supports separate PINs for different functions, such as:

• FIDO2
• PIV
• OpenPGP

These credentials are managed independently.

Yubico’s management software can be used to configure supported functions.

If you use PIV or OpenPGP, make sure any default credentials are changed before relying on them for sensitive applications.

3. Register the Security Key With a Service

For example, with a Google Account, the general process is:

1. Open your Google Account security settings.
2. Open the two-step verification or passkey/security key settings.
3. Choose the option to add a security key or passkey.
4. Insert or tap your YubiKey when prompted.
5. Touch the key if requested.
6. Give the key a recognizable name.

The exact interface may change over time.

4. Register Your Backup Key

Repeat the registration process with your spare YubiKey.

This is also a good time to save any recovery codes offered by the service.

Preventing Accidental OTP Input on Nano Models

If a Nano model stays connected to your computer and frequently types a long OTP string after accidental touches, you can adjust the OTP slots.

Using YubiKey management software:

1. Open the OTP configuration.
2. Locate Slot 1 and Slot 2.
3. Configure the desired OTP behavior for short and long touches.

For example, moving OTP output to the long-touch slot can reduce accidental activation.

If you already use both slots for other purposes, review your configuration before making changes.

What Should You Do If You Lose Your YubiKey?

If your key is lost, take action as soon as possible.

1. Sign in using your backup key, recovery code, or another registered authentication method.
2. Open the security settings for each important account.
3. Remove the lost security key.
4. Register a replacement key.

If you have no spare key, recovery code, or alternative authentication method, you may need to use the service’s account recovery process.

Recovery can take time, and successful account recovery is not always guaranteed.

A YubiKey does not normally contain a visible list of your usernames and passwords, so simply finding the key does not automatically tell someone which accounts it protects.

However, a lost key should still be removed from your accounts as soon as practical.

Frequently Asked Questions

Can Anyone Use My YubiKey If They Find It?

Possessing the key alone is usually not enough to access your accounts.

Traditional two-factor authentication still requires the account password, while some FIDO2 configurations require a PIN or other user verification.

However, the exact protection depends on how the key and account have been configured.

How Many Accounts Can One YubiKey Be Used With?

For traditional FIDO/U2F-style second-factor authentication, one YubiKey can be registered with many services.

Discoverable credentials, sometimes referred to as resident credentials or passkeys stored directly on the device, have a finite storage capacity.

The exact capacity depends on the YubiKey model and firmware.

Is the Metal Contact a Fingerprint Reader?

Not on standard YubiKey 5 or Security Key models.

The touch-sensitive contact detects physical interaction, but it does not scan your fingerprint.

If you want biometric authentication, choose a YubiKey Bio model.

Do I Still Need a YubiKey If I Already Use Passkeys on My Phone?

For many people, a smartphone-based passkey may provide enough security and convenience.

A physical security key can still be useful when you want to:

• Avoid depending entirely on Apple, Google, or another cloud synchronization ecosystem
• Authenticate in environments where smartphones are restricted
• Add stronger protection to especially important accounts
• Use the same authentication device across multiple computers and platforms
• Keep authentication credentials on a dedicated physical device

YubiKey and smartphone-based passkeys do not necessarily compete with each other. They can also be used together as part of a broader recovery and authentication strategy.

What Should I Check If My YubiKey Is Not Working?

Check the following:

• Make sure the device is properly connected
• Confirm that the operating system recognizes the USB device
• Verify that the required interface, such as FIDO, OTP, or CCID, is enabled
• Make sure the service you are using supports your chosen authentication method
• If using NFC, confirm that both the phone and YubiKey support it
• When touching the key, make sure your finger properly contacts the touch-sensitive area

Where Can I Buy a YubiKey?

YubiKeys are available through Yubico and authorized retailers in many regions.

Availability, pricing, product selection, taxes, and shipping vary by country, so check Yubico’s official website or an authorized local retailer for current purchasing options.

Using YubiKey in Businesses and Organizations

YubiKey is also commonly used in business and enterprise environments.

Potential use cases include:

• Employees who cannot use company-issued smartphones
• Contractors and external collaborators
• Data centers, factories, and other locations where phones may be restricted
• Shared workstations
• Privileged administrator accounts
• Enterprise identity and single sign-on systems

Large deployments require additional planning.

Organizations need to consider issues such as:

• Initial PIN configuration
• Key distribution
• Replacement procedures
• Employee training
• Recovery policies
• Initial hardware cost

Yubico also offers enterprise-oriented deployment and subscription options for organizations managing security keys at scale.

Conclusion

Here are the main points to remember:

• YubiKey is a physical security key designed to provide strong authentication and phishing resistance.
• FIDO-based authentication uses public-key cryptography, and private keys remain on the security key.
• The YubiKey 5 Series supports multiple technologies including FIDO2, U2F, OTP, PIV, and OpenPGP.
• For general use, the YubiKey 5C NFC is a versatile choice for USB-C devices, while the YubiKey 5 NFC is suitable for USB-A environments.
• The Security Key Series is suitable if you primarily need FIDO-based authentication.
• The YubiKey Bio Series adds fingerprint verification.
• A backup key and recovery method are strongly recommended.

You do not necessarily need to protect every account with a YubiKey from day one.

A practical approach is to start with accounts that would cause the most damage if compromised, such as your primary email account, cloud storage, password manager, developer accounts, financial or business systems, and other services that control access to important data.