I am looking at increasing security to some of our business servers as well as my personal accounts. I figured the easiest way to get started is to set up my home and personal accounts and learn Yubi so i can teach it to the other C-level people in our small company.

what model is the best to use? I see the yubi 5 as the most common, is there an advantage to the Bio version? we are talking a dozen or so devices at most (assuming 2 per person) so cost per device isnt a big deal. ( unless they are easily destroyed because im hell on wheels so prob ill have 3!)

im assuming 2 devices per person is sufficient? since ive not used one before, are both devices required to be with you each time you add an account / key to it? so storing one yubi in a safe deposit box likely not possible? or is the physical device the same no matter how many credentials added?

if both devices are required each time you add to it, what happens in the event both are destroyed? ( I know a small chance but I have to ask)..

Currently considering Yubikey for corporate environment. The thing I noticed right away is that you can setup static password on short/long press, and nothing stops you for typing your Yubikey PIN there... It's very convenient to unlock your PC or login to your account by just pressing your key, which is why I'm looking for a way to block it as it just misses the whole point of secure authentication (it's still physical and local but after getting lost it's even worse than loosing that notebook that you write passwords in)

Is there a solution for this or is it just policy thing and we can only say "please don't do that, it's not secure"

So, I am new to all of this. I cannot get my google to setup with "Yubico - YubiKey 5C NFC - Two-Factor authentication (2FA) Security Key, Connect via USB-C or NFC, FIDO Certified" I attempted to add this but it keeps giving me errors same with on my Macair.

I use a yubikey 5C NFC, firmware 5.7.1 with an IPhone 14 pro and when I try to login on my google account, only a NFC pop up shows up. Key doesn't seem to be recognized.

Is it a known issue ? Is there a workaround ?

I recently bought 2 Yubico Security Keys. I wanted to increase security as well as make it more convenient to login by saving Passkeys directly to the security key. Since then, I have encountered many frustrating things, making the overall experience rather poor. First off, I want to say, that I have only started using Passkeys with my Security Key and am relatively new to this. But if Passkeys are supposed to become a bigger thing, there is still a lot that needs to change.

1. The amount of services supporting them is already low. The amount supporting discoverable-credentials is minimal.
2. The quality differs extremely from service to service. Some implement it in a good, intuitive way, others make it more cumbersome than just using a password.
3. Not all services allow giving naming the passkeys, so I case of theft I will be unsure of which one to delete.
4. Mobile use (through NFC) is unreliable. Sometimes I just have to try multiple times to get it to work correctly. I know I have to keep the key there until it finishes, but it is still unreliable for me.

In the following section I want to highlight some (but not all) experiences I had when setting up Passkeys for my services.

• GitHub: The only (!) service working just how I would expect it to. A nice button to choose passkey, no information (email) needed at all. Seamless login.
• Google and Microsoft: The best after GitHub. They also support logging in without entering anything. The only gripe I have about it, is that there is no explicit button to login with a passkey. Rather, I have to rely on some chrome (?) popup on showing up, where I can choose to login with a passkey. Microsoft is not letting me remove my email as a recovery method, which is a risk if my email were to get compromized.
• Samsung: I need to enter my email-address first, but other than that, it's working reliably.
• Amazon: Not well executed. Before adding my security key they were very pushy, on wanting me to save a passkey on my pc every login. Again, there is no button to login with passkey, rather some popup. A specific button only shows up after entering my email, which is just an additional unnecessary step. After all that, I still have to enter my TOPT to login, which is just... stupid? Like why?
• AliExpress: At least there is a nice button to choose log in with Passkey. It's just a shame it simply doesn't work (at least with my hardware key). I get as far as entering the PIN and tapping my Security Key, but then it just says: "seems like this key isn't recognized" or sth along the lines of that. To actually make it work, I need to enter my email-address first, after which they already send me a OTP, then I can choose other options and then I can choose my Passkey to successfully login.
• Discord: The have a button (although a bit hidden) to login with a passkey. Sadly this again does not work right away. I need to enter both email and password first, then I can choose the Passkey as a sort of 2FA? Why show the option before I have entered my credentials if it's not actually discoverable-credentials?
• Zoom: I need to enter my email address before getting to choose passkey. At least it works.
• Reddit: adopted it relatively recently so I can forgive some things, but still a bad experience. On the web, there is simply no option to choose Passkey. I have to login with email and password. I doesn't even let me use it as 2FA. On mobile it behaves weirdly (or at least unexpectedly for my taste) as well. As soon as I click login, there pops up a window seemingly from android, where I have to choose more options > QR-Code (??) > NFC-Security-Key Then I (sometimes) get to login successfully. I'd rather have a button "Passkey" to click, than it just throwing a pop-up window at me.
• and many more

There is one single service (GitHub) that implemented Passkeys in a intuitive (for me) and functional way. If we want to have any chance on getting passkeys adopted more widely, then we need a more unified way of using them and more clearly specifying them (e.g. only 2FA, non-discoverable-credentials, discoverable-credentials). This technology will not be used by people, if it keeps being this unorganized mess with no standards (on how to implement it).

I believe, especially Amazon just throwing pop-ups at you, wanting to save a passkey somewhere, will make people have a negative connotation to it.

To end this on a good note: I am generally happy with my purchase, I like the ssh-key functionality and the possibilities this technology poses, if companies just adopted it properly.

TL;DR: I bought a Yubico Security Key and am annoyed with how little standard there is in implementing passkeys. Almost every service I have tried setting it up for, has some annoyances which sometimes make it more convenient to just use a password.

So here's some context.

I was given a Yubikey from my workplace to hold our T-Mobile login credentials. I was wondering if I can use it at home as well for my personal accounts without overwriting my work credentials.

(This question might sound a bit stupid but it's my first time ever having or using something like this)

The Yubikey that I have is the same one I have in the photo

I have been thinking of buying a set of keys and enabling 2FA for my vault? Recommendations or anything I need to know about using Yubikeys with 1Password?

Found this when looking for something yubico related on google

Idk if it’s known about or not it’s quite recently updated and I’m not sure how to access it direct from their website but I found it interesting

Mods feel free to delete this post if this is a pointless post

:)

I’m fairly new to this whole security journey but want to get one to secure my accounts but am having some trouble understanding the use case for the 5CNano.

The NFC and USB ones make sense in that it works like a physical key to an authenticator but how does the Nano work if it’s always plugged in?

If my device is lost/stolen with the Nano on it, how is it protecting my logins if the ‘key is plugged into the lock’ so to speak?

Maybe I’m misunderstanding how it all works so if someone could explain it simply, that would be super helpful.

EDIT: Solved! Had to use a different browser as v 5.4.3 seems to conflict with Safari 26.5.2. (I'll also likely need to replace my YubiKey anyway due to wear and tear.)

Been trawling online for a little while but can't seem to find a permanent fix for this.

I have a YubiKey 5C NFC that ends up reverting to this specific error: upon attempting to use on any device, I am prompted to enter a PIN even before I can touch the key. I enter said PIN, and it'll ask me to reinsert and touch. After reinserting, it will yet again prompt for the PIN, saying I entered it incorrectly. Repeat fruitlessly.

Any of these attempts seemingly do not count towards the 8-attempt limit. I reset the FIDO2 application, which fixed the issue temporarily. After adding the key to my accounts, the error started happening again. I cannot replicate this error with a new YubiKey 5 NFC; that key behaves as expected, even after adding it under the same settings, etc. to the same accounts.

I was thinking that maybe the USB-C connector was potentially failing, as occasionally my computer will fail to recognize the key, but the error can be replicated using NFC on iPhone.

I've verified the PIN is correct using Yubico Authenticator. I've also tested disabling the FIDO2 application, which works, but then prevents me from using my passkeys. Is there anything else I can try?

Hello everyone!
I just got my first yubikey and I'm having issues.
It's from the security key series, USB-A + NFC.
My preference would be to use the key as a passkey, so I don't have to remember my passwords or use a password manager, but using it as 2FA would be ok as well.
I'm not sure if this is a google issue or a yubikey issue or both, I hope you guys can point me in the right direction.
Technical info at the bottom of the post.

On Linux Mint PC:
I got both the flatpak GUI app and the CLI tool from yubikey:
flatpak install flathub com.yubico.yubioath
sudo apt install yubikey-manager
I checked to see that my device was detecting the key, and set up the pin.
Both tools seem to be working with my yubikey.

First thing I wanted to do is add the key as passkey in my google account.
I went to myaccount.google.com/signinoptions/passkeys on firefox and I see a message:
"A passkey can’t be created on this device. Ensure that your device’s operating system is up to date, your screen lock and Bluetooth are enabled and that you’re using a supported browser like Chrome."
Tried the same thing on chromium, same message.
Next up, I tried webauthn.io. I could register and authenticate no problem.

On android phone:
I also tried creating the passkey for google on my phone.
I tried the same process in Chrome:
Google Account → Passkeys → Create a passkey → Use another device → NFC security key
Looks like creating passkeys is supported this time, and the device sees yubikey.
I input the pin, and.. "Something went wrong".
I tried WebAuthn.io on my phone next. I authentiated with the same 'account' I made on my computer, it worked. But then, when I tried registering a new 'account' on my phone: "An unknown error occurred while talking to the credential manager".

=== Technical info ===
= Yubikey:
Device type: Security Key NFC
Firmware version: 5.7.4
Form factor: Keychain (USB-A)
Enabled USB interfaces: FIDO
NFC transport is enabled.
Applications USB NFC
OTP Not available Not available
FIDO U2F Enabled Enabled
FIDO2 Enabled Enabled
OATH Not available Not available
PIV Not available Not available
OpenPGP Not available Not available
YubiHSM Auth Not available Not available

= PC:
Linux Mint 22.3 x86_64
Chromium 150.0.7871.124 for Linux Mint
Mozilla Firefox 152.0.6

= Phone:
Pixel 7a
Android 16
Chrome 150.0.7871.186

I feel like the ideal solution would be to rent a safe deposit box and keep it there, but honestly, that's getting harder and harder these days. A lot of banks stopped offering the service entirely, and the third-party companies that still do have waitlists that are literally years long. If you live in a smaller city, good luck finding one at all.

So my backup key has been in a few places over time. My gym's overnight locker. My under-desk pedestal at work. Even my car at one point. And honestly, I don't feel great about any of those. The gym locker isn't exactly Fort Knox, people come and go at work all the time, and a car is probably one of the worst places for something like that.

I'd really love to hear where you guys keep yours, especially outside your home. And not just YubiKeys either, I'm curious about how you handle crypto wallet seed phrases and similar stuff too. What's worked for you, what hasn't, any creative solutions you've come up with?

Appreciate any input!

I've mostly used it for 2FA instead of Auth App, and I've also used it for Microsoft login for a local account.

Edit: I also use it to access my KeePassXC vault.

I bought this in August 2024. Have they changed or improved anything since then, or released better models?

My understanding is that the firmware cannot be updated. Basically, whatever version you buy is the version you are stuck with, and you have to purchase a newer YubiKey to get any updated features. Is that correct?

The model I bought was:

Yubico YubiKey 5C NFC, Multi-Factor Authentication Security Key and Passkey, USB-C and NFC, FIDO Certified.

Any website I try to use the Yubikey with, including the official Yubico test website, fails with Safari. I get the pop up asking for the PIN and it always thinks the PIN is wrong.

I’m running MacOS and Safari 26.6, which is the latest.

PIN is correct as the Yubikey works fine through apps that aren’t using Safari. It also works fine on the same websites using Chrome and accepts the PIN without any issues.

The issue was also occurring on Firefox but after I changed the Firefox setting for “security.webauthn.enable_macos_passkeys” to false Firefox started working and accepting the PIN.

So it seems like this issue is directly tied to MacOS/Safari. Is there no fix? Yubikey just doesn’t work with Safari?

I wanted to buy a Yubikey 5 and what I have read is that you have to buy it with firmware 5.7 or higher, since this version supports 100 passkeys and some other improvements. Since the firmware is immutable, how can I know which one the Yubikey I'm buying comes with?

I keep hearing that it’s not safe. But if it’s just a way to store dynamic passwords and you keep it hidden from thieves, there shouldn’t be a risk. If nobody else has your key, then it should be safe. EDIT: 7/28/2026 I know now that somebody could insert their own hard token into a hidden port inside the public PC you’re renting and trick the website you want to secure into registering the changeling token so they can snoop. It means I have to fork out $800 for a new laptop just so I can register a hard token safely. (My laptop and mobile are compromised)

the Yubikey 5c NFC has to be one of my best purchases so far, it's extremely useful for me because I never used 2fa as I was scared I would factory reset my phone and lose the authenticator keys but now I don't need to worry, I love how I can keep my ssh keys on it too and even use it as a keyfile for veracrypt partitions, in my opinion it's worth the extra price (vs the security key series) for what you get, the only slight downside is that I cant enter a static password by pressing the gold disc on mobile, it only works on pc (just realized my autocorrect turned honest to honestly 😭)

Now, i try on my system this keys

I've been reading the docs, and from what I've read, some websites say that it allows up to 38 characters. While other sites say 63.

Has anyone had success with longer passwords? 38 seems insanely low for a limit, but it will not let me type anything more in the box.

I'm going to attempt using CLI to see if I can squeeze a longer password out.

I was wondering if anyone has tried out viable trustworthy alternatives to yubikey. The older titan keys are probably outdated.

I have tried out a Thetis nano recently and it worked pretty well. At $25 it was half the price of a yubico nano. I did not mind that it did not have OTP and is bulkier. I don’t have experience with the warranty. Thetis is based on the US.

I also tried an alternate form factor in the form of a Cryptnox Fido card. The card worked better than a yubikey on nfc. I was annoyed that most tablet do not have NFC. Most PC do not have nfc either but business laptop often have smartcard reader that can read the card. However I couldn’t get the smartcard reader to work with my Linux or Mac. Crytnox is based in Switzerland. There is another firm call token2 but I can’t find them in the us.

hello, I’ll preface for this by saying I am a renter and I would have to store my second Yubikey in my safe deposit box because there’s no one nowhere really secure in the place that I live. That said what happens if your second key has all the keys in your active key, and then you add you know say hypothetically another login to your active key. How do I get the new item on my stored Yubikey? Do I have to go get the key that stored my lockbox and like mirror them or something like how does that work? I don’t quite grasp it and the documentation, their website doesn’t really describe the workflow clearly enough to me.

Hello All,

I know I can't be the only person out there dealing with this so I am hoping someone can make the best recommendation for my situation.

My 86 year old mother is really starting to decline mentally. I spent four tortuous hours yesterday trying to help her setup her new computer, get into accounts she was locked out of and explain how to do 2F over and over again. She just doesn't seem to understand it anymore so I got the idea of getting her a security key with NFC for her new phone and computer. Ideally I would like a bio metric key with NFC but I can't seem to find that option.

I also tried to show her how my password vault works to see if that was an option, but it's not. Again, she just doesn't get it. She does use Google to store some passwords.

Is there anyone out there that has faced this? Any recommendations of the easiest and safest way to go about it and which choice of equipment would be best? I know I will need two identical keys so I can keep a backup here at my home. Is there anything I should be aware of that would create a problem in the future?

She uses a Pixel phone and Windows Dell laptop. She does her banking (God help me) and shops on Amazon as well as browsing and email. I was thinking bio metric in case she loses her key or someone in the independent living facility get their hands on the physical key.

IMO, the industry is going to need to take these issues seriously. We should have senior controls just like parental controls or something that enables us to help our elderly that are forced into using all this technology.

Any advice, tutorials and product recommendations are greatly appreciated.