Passwords leak. SMS codes get intercepted. Even authenticator apps can be phished by a fake login page that relays your one-time code to the real site in real time. A YubiKey sidesteps all three problems by binding every login to a physical object and a cryptographic check that a phishing site cannot pass. This tutorial walks through picking a model, registering it across email, developer tools, SSH, and GPG, and building a backup key strategy that survives a lost or stolen device.
By the end of this YubiKey setup, you’ll have a primary and backup key covering phishing-resistant sign-in on your most important accounts, plus a tested recovery path. Budget about 60 minutes if you’re starting from zero, less if some accounts already have a second factor in place.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What a YubiKey Actually Does (and Why It Beats Passwords, SMS, and TOTP Apps)
A YubiKey is a small hardware device built around the FIDO2/WebAuthn standard. When you register it with a site, the site and the key exchange a cryptographic challenge tied to that site’s exact domain. Log in from the real site and the challenge checks out. Land on a look-alike phishing domain and the challenge fails automatically, because the key never releases a signature for the wrong origin. That mechanism is what separates a hardware key from a password, an SMS code, or a six-digit TOTP app code, all of which a victim can be tricked into typing into a fake page.
This distinction has a name in federal guidance. NIST SP 800-63B requires that authenticators used at Authenticator Assurance Level 3, the highest tier, be “verifier impersonation resistant” and “replay resistant.” In practice, the authenticator binds its response to the specific channel it was issued on, so a captured response can’t be replayed against a different site. FIDO2 security keys clear that bar. SMS and app-based TOTP codes do not, according to NIST’s published guidance.
The stakes aren’t abstract. More than 24 billion credentials surfaced in a single dump uncovered in 2026, and the FIDO Alliance’s State of Passkeys 2026 report, based on an April 2026 survey of 11,000 consumers across ten countries, found that 33% of respondents had experienced an account compromise or breach notification in the past year alone. The same report puts global passkey use at 5 billion, with 90% consumer awareness and 75% of people having enabled a passkey on at least one account, though only 49% use one regularly. On the enterprise side, 68% of organizations have deployed or are actively deploying passkeys for employee sign-in, based on a parallel workforce study of 1,400 decision-makers at companies with 500 or more employees.
Microsoft’s own rollout shows what this looks like at scale. Under its Secure Future Initiative, the company reports that 92% of employee productivity accounts are now protected by phishing-resistant authentication, built on FIDO2 security keys, Windows Hello for Business, and passkeys. For the fuller picture on how passkeys, passwords, and app-based 2FA stack up against each other, this site’s passkey comparison covers the trade-offs in more depth. This guide focuses on the hardware key path specifically: what to buy, how to register it everywhere that matters, and how to avoid getting locked out of your own accounts along the way.
Prerequisites: What You Need Before Your YubiKey Setup
You don’t need to be a systems administrator to get a YubiKey setup working, but a few things should be in place before step 1. Gather these first so you’re not stopping mid-tutorial to install software or dig up old logins.
| Requirement | Minimum Spec | Why It Matters |
|---|---|---|
| Two YubiKeys | Same model, or a compatible pair | One is your primary, one is a tested backup |
| Operating system | Windows 10 21H2+/11, macOS 12+, or a modern Linux distro | Needed for YubiKey Manager and OS-level login steps |
| Browser | Chrome 67+, Edge 79+, Safari 13+, Firefox 60+ (119+ for full passkey support) | WebAuthn/FIDO2 registration happens in-browser |
| YubiKey Manager | 5.9.2 or later | Reads firmware version and sets PIN policy |
| Admin or sudo access | Local admin rights | Required to install ykman and PAM modules |
| Free time | About 60 uninterrupted minutes | Registering 6-8 accounts takes longer in fits and starts |
| Account list | Email, password manager, GitHub/GitLab, cloud console, social logins | Have credentials ready before you start |
Here’s the full path, step by step, with a realistic time budget for each one:
| Step | Task | Time |
|---|---|---|
| 1 | Buy at least two keys | Before you start |
| 2 | Match model to ports and protocols | 4 min |
| 3 | Install YubiKey Manager + Authenticator | 4 min |
| 4 | Check firmware vs. Eucleak advisory | 2 min |
| 5 | Set FIDO2 PIN | 2 min |
| 6 | Register primary email | 5 min |
| 7 | Add to password manager | 4 min |
| 8 | Lock down developer accounts | 7 min |
| 9 | Set up SSH authentication | 7 min |
| 10 | Add GPG commit signing | 6 min |
| 11 | Enable OS-level login | 9 min |
| 12 | Register backup key everywhere | 4 min |
| 13 | Recovery codes + lockout drill | 6 min |
Step 1: Buy At Least Two Keys, Not One
Do this before anything else, because it changes how you approach every step that follows. A single YubiKey is a single point of failure. Lose it, damage it, or leave it in a hotel room, and you’re stuck outside every account you locked down, waiting on account-recovery flows that can take days. Buy two now: a primary key you carry daily and a backup you register on every account alongside it, then store somewhere separate from the primary, like a home safe or a drawer at a different location.
Yubico’s Security Key Series starts at $29 and covers FIDO2/WebAuthn and FIDO U2F only, which is enough for most consumer accounts. The YubiKey 5 Series runs $58 to $85 depending on form factor and adds OTP, smart card (PIV), and OpenPGP support, which matters if you plan to use the key for SSH or GPG signing later in this guide. A common, budget-friendly pairing is one YubiKey 5 NFC as your primary and one Security Key as backup, since the backup only needs to cover FIDO2 logins in an emergency.
If your employer requires FIPS 140-2 or FIPS 140-3 validated hardware, Yubico sells dedicated YubiKey 5 FIPS Series keys for that purpose. They cost more than standard models and are worth it only if a compliance policy specifically calls for them. Check with your security team before buying, since the wrong SKU is a common, avoidable expense.
Step 2: Match the Model to Your Ports and Protocols
Every YubiKey looks similar at a glance, but the model determines which port it fits and which protocols it speaks. Check your laptop’s ports and your phone’s connector before ordering, since a USB-C key won’t help much if every port on your machine is USB-A.
| Model | Price | Connector | Protocols | Best For |
|---|---|---|---|---|
| Security Key | $29 | USB-A or USB-C + NFC | FIDO2/WebAuthn, FIDO U2F | Budget backup key, consumer accounts |
| YubiKey 5 NFC | $58 | USB-A + NFC | FIDO2, U2F, OTP, OATH, PIV, OpenPGP | Most desktop/laptop users |
| YubiKey 5C NFC | $58 | USB-C + NFC | Same as above | USB-C laptops, NFC-enabled phones |
| YubiKey 5C | $65 | USB-C only | Same as above, no NFC | USB-C-only setups that skip NFC |
| YubiKey 5 Nano | $68 | USB-A (low profile) | Same as above | Leaving permanently in a desktop port |
| YubiKey 5C Nano | $68 | USB-C (low profile) | Same as above | Same, on USB-C machines |
| YubiKey 5Ci | $85 | USB-C + Lightning | Same as above | Mixed Lightning and USB-C devices |
| YubiKey 5 FIPS Series | Higher, via reseller | Varies | FIPS 140-2/140-3 validated | Regulated industries, government contractors |
The YubiKey 5 Series is the most versatile line and can store up to 100 resident FIDO2 credentials, or passkeys, on one device. If you’re protecting more than a handful of accounts, or plan to use SSH and GPG later in this guide, the 5 Series earns its extra cost over the FIDO-only Security Key.
Step 3: Install YubiKey Manager and Yubico Authenticator
YubiKey Manager (ykman) is the command-line and GUI tool for configuring the key itself: PINs, touch policies, and firmware inspection. Yubico Authenticator is the companion app for generating OATH-TOTP codes on services that don’t yet support FIDO2. Install both before you plug anything in.
# macOS (Homebrew)
brew install ykman
# Windows (winget)
winget install Yubico.YubiKeyManager
# Linux (Debian/Ubuntu)
sudo apt install yubikey-managerYubiKey Manager 5.9.2, the current release as of mid-2026, runs on Windows, macOS, and Linux. Yubico Authenticator for iOS and Android sits at version 1.13, last updated in March 2026 per its App Store listing.
Plug in your primary key and check that the system sees it:
ykman infoYou should see output similar to this:
Device type: YubiKey 5 NFC
Serial number: 12345678
Firmware version: 5.7.1
Form factor: Keychain (USB-A)
Enabled USB interfaces: OTP+FIDO+CCID
PIV, OATH, OpenPGP, FIDO2, OTP: enabledIf nothing shows up, unplug and try a different USB port before troubleshooting further (see the troubleshooting section below).
Step 4: Verify Firmware Version and Check the Eucleak Advisory
Before registering anything, confirm your key isn’t running firmware affected by CVE-2024-45678, the side-channel vulnerability nicknamed Eucleak. The ykman info output from step 3 already shows your firmware version, so check it against the table below.
| Product | Affected Firmware | Fixed Firmware | Field-Updatable |
|---|---|---|---|
| YubiKey 5 Series | Before 5.7.0 | 5.7.0 and later | No |
| YubiKey 5 FIPS Series | Before 5.7.0 | 5.7.0 and later | No |
| YubiKey Bio Series | Before 5.7.2 | 5.7.2 and later | No |
| Security Key Series | Before 5.7.0 | 5.7.0 and later | No |
| YubiHSM 2 | Before 2.4.0 | 2.4.0 and later | No |
Yubico’s security advisory YSA-2024-03 confirms devices manufactured from May 21, 2024 onward ship with the fixed firmware by default, so anything bought new in 2025 or 2026 should already be clear. If ykman info shows an older firmware version, the key can’t be patched in place. Yubico’s guidance is direct about it: replace the affected unit rather than wait for an update that isn’t coming.
The practical risk is lower than the CVE number alone suggests. The National Vulnerability Database scores it 4.2 on a 10-point scale, while Yubico’s own advisory rates it slightly higher at 4.9, because exploitation requires physical possession of the key plus lab-grade equipment to measure electromagnetic emissions during a cryptographic operation. It isn’t a remote attack. For most people, a key bought since mid-2024 is unaffected, and there’s nothing to do here beyond confirming the version.
Step 5: Set a FIDO2 PIN and Lock Down Default Settings
A FIDO2 PIN adds a second check beyond touching the key, so a stolen device alone isn’t enough to authenticate as you. Set one before you register any account.
ykman fido access change-pinYubico’s Enhanced PIN Series enforces a 6-character minimum with complexity requirements and ships with “always require user verification” turned on by default, meaning every sign-in needs the PIN, not just a touch. Older 5 Series keys default to touch-only for many protocols, so if you want PIN enforcement everywhere, check this setting explicitly rather than assume it’s already on.
Pick a PIN you don’t use anywhere else. If you forget it, most services let you remove and re-register the key, but some enforce a hard reset that wipes all resident credentials on the device. Treat the PIN with the same care you give your password manager’s master password.
Step 6: Register Your Primary Email First
Email is the account every password reset flows through, which makes it the highest-value target and the first thing to protect. For Gmail, go to your Google Account, open the 2-Step Verification settings, and choose “Add security key.” Insert or tap your YubiKey when prompted and give it a label you’ll recognize later, like “Primary, blue keychain.”
For Microsoft accounts, sign in to your Microsoft account security settings, select “Add a new way to sign in,” and choose “Use a security key.” Entra ID (formerly Azure AD) admins managing organizational accounts do this through Authentication Methods policies rather than the consumer flow, but the key registration step itself is the same tap-and-confirm process. Yubico also maintains a setup catalog with exact click-paths for dozens of services if a specific provider’s menu has moved since this was written.
Whichever provider you use, resist the urge to skip ahead to other accounts yet. Confirm the security key actually works by signing out and back in once, using only the key, before moving to step 7.
Step 7: Add the Key to Your Password Manager
If you already run a self-hosted vault or a hosted option like Bitwarden or 1Password, a hardware key protecting the vault itself matters more than protecting any single site login, since the vault holds everything else.
In Bitwarden, go to Settings, then Security, then Two-step Login, and add a FIDO2 WebAuthn security key. 1Password handles it similarly under Security and Two-Factor Authentication, with an option to require the key for unlocking on new devices specifically. Register both your primary and backup key here in the same sitting, since re-opening this menu later is easy to forget.
Don’t stop at the vault entry screen. If your password manager syncs across a browser extension, desktop app, and mobile app, test the security key prompt on at least two of those surfaces before you consider this step done.
Step 8: Lock Down Developer Accounts (GitHub, GitLab, AWS, Cloudflare)
Developer accounts are attractive targets because a single compromised login can expose source code, CI/CD secrets, or production infrastructure. GitHub adds security keys under Settings, Password and authentication, Two-factor authentication, Security keys. GitLab’s equivalent lives under User Settings, Account, and both support registering multiple keys per account, so add the backup here too.
AWS requires a root-account MFA device at minimum, configurable from IAM, Security credentials, with FIDO2 security keys supported directly. Cloudflare offers the same option under My Profile, Authentication. For any platform that gates infrastructure access, treat security key registration as non-optional, since password-only access to a cloud console is one phishing email away from a full account takeover.
If your organization uses single sign-on through Okta or Entra ID for these tools, register the key at the identity-provider level instead of on each individual platform. That way, one registration step protects everything behind the SSO gate.
Step 9: Set Up SSH Authentication with Your YubiKey
OpenSSH has supported FIDO2 security keys directly since version 8.2, which means you can generate an SSH key pair where the private key material never leaves the hardware token. This is where the YubiKey 5 Series pulls ahead of the FIDO-only Security Key, since SSH-in-hardware needs the broader protocol support the 5 Series provides.
ssh-keygen -t ed25519-sk -O resident -O verify-required -f ~/.ssh/id_ed25519_skThe resident flag stores the key handle on the YubiKey itself, so you can pull it onto a new machine with ssh-keygen -K instead of starting over. The verify-required flag forces a PIN check on every use, not just a touch. Copy the resulting public key to any server’s authorized_keys file exactly as you would a normal SSH key.
Add an entry to your SSH config so the right key gets offered automatically:
Host production-server
HostName 203.0.113.10
User deploy
IdentityFile ~/.ssh/id_ed25519_skTest the connection with ssh -v production-server and confirm you’re prompted to touch the key. If the connection succeeds without any prompt, double check you copied the .pub file and not the private key handle to the server.
Step 10: Add GPG Commit Signing
Signed commits prove a change actually came from you, which matters more now that GitHub and GitLab both surface a “Verified” badge on signed commits and flag unsigned ones by default in some organization settings. A YubiKey 5 Series key can hold a GPG signing subkey on its smart card (PIV/OpenPGP) applet.
Check that the key’s OpenPGP applet is visible to GPG:
gpg --card-statusOnce your signing subkey is loaded onto the card, point Git at it:
git config --global user.signingkey YOUR_KEY_ID
git config --global commit.gpgsign trueCommit as usual with git commit -S -m "message" and you’ll be prompted to touch the key before the commit finalizes. Verify it worked with:
git log --show-signature -1
gpg: Signature made Fri 05 Jun 2026
gpg: Good signature from "Your Name <[email protected]>"Push the commit and check for the verified badge on GitHub or GitLab’s web interface. If the badge doesn’t appear, the most common cause is a public key that hasn’t been uploaded to your account yet, under Settings, SSH and GPG keys.
Step 11: Enable OS-Level Login on Windows, macOS, and Linux
Using a YubiKey to unlock the machine itself, not just individual accounts, closes the gap between “my accounts are secure” and “anyone with physical access to my laptop can get in.” Support differs sharply by platform.
Windows Hello for Business
Windows 10 and 11 support signing in with a FIDO2 security key directly from the lock screen. Enable it under Settings, Accounts, Sign-in options, Security key, then follow the prompts to register your YubiKey as a sign-in method. Domain-joined machines may need an administrator to enable this through Group Policy or Intune first.
macOS
macOS doesn’t offer native YubiKey login at the OS account level the way Windows does. What it does support well is using the key as a FIDO2 security key inside Safari and Chrome, and as a smart card for specific enterprise configurations. If full-disk unlock via hardware token matters to you on a Mac, that’s a harder, more manual setup than this tutorial covers, and most users get equivalent protection from FileVault plus a strong local password instead.
Linux (PAM)
Linux gets the most flexible support through the pam_u2f module, which can gate sudo, login, or screen unlock behind the key.
sudo apt install libpam-u2f
mkdir -p ~/.config/Yubico
pamu2fcfg > ~/.config/Yubico/u2f_keysThen add a line referencing pam_u2f.so near the top of /etc/pam.d/sudo, above the existing auth lines. Test in a second terminal session before closing your first one, since a misconfigured PAM file can lock you out of sudo entirely on that machine.
Step 12: Register the Backup Key on Every Account
This is the step people skip, and it’s the one that turns a lost key from an inconvenience into a lockout. Go back through every account from steps 6 through 11 and add your second YubiKey as an additional security key, not a replacement for the first.
Keep a simple checklist as you go: email, password manager, GitHub/GitLab, cloud consoles, and OS login all need the backup key added individually. Most services support at least two keys, and many support more, so there’s no technical reason to leave any account single-keyed.
Store the backup somewhere genuinely separate from the primary, physically. A backup key in the same laptop bag as your primary defeats the purpose if the bag goes missing. If budget only allows one key for now, at minimum generate and safely store the recovery codes described in step 13 before you rely on FIDO2 as your only second factor.
Step 13: Generate Recovery Codes and Run a Lockout Drill
Every major service that supports security keys also generates one-time recovery codes as a last-resort fallback. Download these from each account’s two-factor settings page and store them somewhere that isn’t your password manager and isn’t your YubiKey itself, such as a printed copy in a locked drawer or an encrypted offline file.
Then do the part almost nobody does: test the failure case on purpose. Unplug your primary key, and using only your backup key, sign in to your email, password manager, and at least one developer account. If any of those sign-ins fail, or fall back to a weaker method you didn’t expect, fix that registration now, while you’re paying attention, rather than during an actual emergency.
This drill is what turns a pile of individually configured accounts into a working, complete setup you can rely on. Once your backup key gets you into everything your primary does, the YubiKey setup described in this guide is done.
Your Finished Setup: What a Complete YubiKey Project Looks Like
Thirteen steps in, it helps to see the finished project as a whole rather than as a list of separate tasks. A complete, working YubiKey setup looks like this checklist, all boxes checked and tested rather than just configured:
- Two physical keys owned, one primary and one backup stored in a separate location
- Firmware checked on both keys against the Eucleak advisory in step 4
- A FIDO2 PIN set on both keys, not left at default
- Primary email account, password manager, and developer accounts all registered with both keys
- SSH authentication and GPG commit signing working from the command line
- OS-level login enabled wherever the platform supports it
- Recovery codes generated, printed or stored offline, away from both the keys and the password manager
- A lockout drill completed: primary key unplugged, backup key alone signs into every critical account
If every item on that list is checked, the project is done in the way that matters: not just configured, but proven to survive the one scenario, a lost or damaged primary key, that this entire guide exists to protect against.
Understanding the Eucleak Vulnerability: What CVE-2024-45678 Changes
The step 4 check is enough for day-to-day use, but it’s worth understanding what the Eucleak vulnerability actually is, since “side-channel attack” gets thrown around loosely in security news.
Security researcher Thomas Roche and the team at NinjaLab found that the Infineon cryptographic library used inside YubiKey 5 Series, 5 FIPS Series, Bio Series, Security Key Series, and YubiHSM 2 devices performed a modular inversion step, part of the ECDSA signing math, in a way that wasn’t constant-time. That timing variation leaks through electromagnetic emissions the chip gives off during the operation. An attacker who physically disassembles the key and measures those emissions with an oscilloscope during repeated authentication attempts can, in theory, extract the private key material tied to that device and clone it.
NinjaLab’s research notes the flaw sat unnoticed for 14 years, surviving roughly 80 separate Common Criteria security certifications along the way, and the same Infineon library also turns up in TPM chips and IoT security controllers well beyond Yubico’s own product line. That’s less an indictment of YubiKey specifically than a reminder that even certified, widely-audited hardware can carry a bug this subtle for over a decade before anyone catches it.
That’s a meaningfully different threat model from a remote phishing attack. The National Vulnerability Database assigned CVE-2024-45678 a CVSS score of 4.2, in the medium range, reflecting an attack vector marked “physical” and attack complexity marked “high.” Yubico’s own advisory scores it slightly higher, at 4.9, but agrees on the core point: an attacker needs the physical key, specialized lab equipment, and time alone with the device, not just a password or a phishing link.
Yubico’s fix shipped in firmware 5.7.0 for the YubiKey 5 and Security Key Series, and 5.7.2 for the Bio Series, starting with units manufactured on or after May 21, 2024. Because YubiKeys can’t be updated in the field the way phone or laptop firmware can, older affected units stay vulnerable for their entire service life. The advisory’s practical recommendations: deregister any lost or stolen key immediately from every account, keep physical control of your keys, and, where a service lets you choose the signing algorithm, prefer RSA or Ed25519 over ECDSA. For most home users and small teams, replacing an affected key isn’t urgent. For journalists, executives, government employees, or anyone facing a resourced physical adversary, it’s worth prioritizing.
If step 4 already showed your firmware at 5.7.0 or later (5.7.2 for Bio Series), none of this applies to you. This section exists for the older keys already sitting in drawers and desk shelves that quietly kept working after 2024 without anyone checking.
YubiKey vs Other Security Keys and Passkeys
A YubiKey isn’t the only phishing-resistant option, and it isn’t always the right one for every account. Here’s how the alternatives stack up.
| Option | Phishing-Resistant | Works Without a Phone/Laptop | Typical Cost | Best For |
|---|---|---|---|---|
| YubiKey (FIDO2 hardware key) | Yes | Yes | $29-$85 | Cross-platform use, SSH/GPG, shared or work devices |
| Platform passkey (phone/laptop biometric) | Yes | No, tied to the device | Free, built into the OS | Personal accounts on a device you always carry |
| Google Titan Security Key | Yes | Yes | Similar price range to YubiKey | Google-centric setups, similar use case to YubiKey |
| Authenticator app (TOTP) | No | Yes | Free | Services without FIDO2 support yet |
| SMS one-time code | No | Requires phone signal | Free | Last-resort fallback only, avoid as a primary method |
Passkeys stored on your phone or laptop are genuinely phishing-resistant too, and for most personal accounts, they’re the lower-friction choice, part of why the FIDO Alliance’s 2026 data shows such fast consumer uptake. A YubiKey earns its cost back in scenarios a phone-based passkey handles awkwardly: signing into a shared workstation, authenticating over SSH to a server, signing Git commits, or moving between multiple computers where a platform-bound passkey doesn’t travel with you. Many people end up running both: platform passkeys for quick personal logins, and a YubiKey for developer tools, work accounts, and anything that needs to behave identically across several machines.
Google’s Titan line and Yubico’s YubiKey line are close enough in capability that the deciding factor is usually ecosystem fit and price, not a meaningful security gap between them. Both implement the same FIDO2/WebAuthn standard, so a site that supports one generally supports the other.
Common Pitfalls When Setting Up a YubiKey
Most YubiKey problems trace back to one of these mistakes, all avoidable if you catch them during setup instead of after.
- Registering only one key. Covered in steps 1 and 12, but worth repeating, since it’s the single most common regret people report after losing a key.
- Leaving the default PIN and touch policy unchanged. A key with no PIN protects against phishing but not against someone who steals the physical device.
- Never testing the backup key. A backup that’s registered but unverified might fail silently, and you won’t find out until you actually need it.
- Storing recovery codes next to the keys themselves. If both live in the same bag or drawer, you’ve built a single point of failure twice over.
- Assuming macOS works like Windows for OS login. As covered in step 11, native full-account login isn’t the same on a Mac, and assuming otherwise leads to a frustrating troubleshooting session.
- Buying a used or old-stock key without checking firmware. Secondhand marketplaces and old retail stock can carry pre-5.7.0 firmware affected by the Eucleak advisory. Check with
ykman infobefore trusting a key you didn’t buy new.
None of these are hard to avoid. They just require the unglamorous parts, testing failure modes and writing things down, that are easy to skip once the exciting part (the key works) has already happened.
Troubleshooting: 8 Common YubiKey Problems and Fixes
Even a correct setup runs into friction occasionally. These are the problems people hit most often, mapped to the same registration flow covered in the steps above.
| Problem | Likely Cause | Fix |
|---|---|---|
| Key not detected over USB | Port, cable, or a sleeping USB controller | Try a different port, avoid unpowered hubs, reboot if the OS lost the device |
| NFC tap doesn’t register on a phone | Phone case blocking the antenna, or NFC disabled | Remove thick cases, confirm NFC is enabled, tap the exact antenna location |
| Browser never prompts for a security key | Outdated browser or WebAuthn disabled | Update to Chrome 67+/Firefox 119+/Safari 13+/Edge 79+, check site settings |
| “This key is already registered” error | Re-adding the same key to an account that already has it | Remove the old registration first, or use the second key instead |
| ykman command not found | PATH not updated after install, or install failed silently | Reinstall via the official method for your OS, restart the terminal |
| PIN locked after repeated wrong attempts | FIDO2 PINs lock after a small number of failed tries | Reset the PIN through the service or ykman, then re-register the key |
| SSH fails with “no mutual signature algorithm” | Server’s OpenSSH version predates FIDO2 key support | Upgrade OpenSSH to 8.2 or later on the server, or use a non-resident key |
| GPG shows “selecting card failed” | GPG’s smart card daemon isn’t seeing the key | Restart the scdaemon process and reinsert the key |
The browser and SSH issues deserve a little more detail, since they generate the most support questions. If your browser never shows a security key prompt at all, check on Windows that Windows Hello isn’t intercepting the request before it reaches the browser. On the SSH side, the “no mutual signature algorithm” error almost always means the server is running an OpenSSH build from before February 2020, since that’s when FIDO2 key types landed in version 8.2. Run ssh -V on the server to confirm before troubleshooting anything else.
If none of these match what you’re seeing, Yubico’s own support site keeps a longer troubleshooting index organized by exact device and OS combination, worth checking before assuming the key itself is defective.
Advanced Tips for Power Users
Once the core setup works, a few extensions are worth knowing about even if you don’t need them on day one.
- Resident credentials add up fast. A YubiKey 5 Series key can hold up to 100 discoverable FIDO2 credentials, per Yubico’s own technical documentation, enough for most people’s entire account list on one device.
- Touch policies are configurable per protocol. YubiKey Manager lets you require a touch, cache it briefly, or require it every time, separately for the OTP, PIV, and OpenPGP applets, so you can tune friction against security per use case.
- Full-disk encryption unlock is possible on Linux, using Clevis and Tang bound to a YubiKey-backed key, though it’s a more involved setup than anything covered in this tutorial.
- Separate keys for separate identities is a common pattern among people managing both a personal and work identity: one key registered only to personal accounts, another only to work accounts, so a compromise or loss in one context doesn’t cascade into the other.
- FIPS-validated keys exist for a reason. If you work in defense, healthcare, or another regulated sector, check whether your compliance program specifically requires FIPS 140-2 or 140-3 validated hardware before buying standard 5 Series keys.
- OATH-TOTP slots are a fallback, not a downgrade. For the handful of services that still don’t support FIDO2, Yubico Authenticator can generate standard TOTP codes from credentials stored on the same physical key, so you’re not forced to run a separate authenticator app just for stragglers.
Keeping Your Security Stack Coherent
A YubiKey solves phishing-resistant login. It doesn’t replace a password manager, a VPN for untrusted networks, or basic account hygiene elsewhere in your stack. Treat this tutorial as one piece that plugs into the rest of what you’re already running, or building next.
Related Coverage
- How to Set Up Vaultwarden: 12 Steps, 80 Min [2026]
- How to Set Up TOTP MFA: 12 Steps, 60 Min [2026]
- Passkeys vs Passwords vs 2FA: 93% Success Rate [2026]
- How to Set Up WireGuard VPN: 12 Steps, 45 Min [2026]
- 24 Billion Credentials Leaked in Record Data Dump [2026]
For the wider set of threats this setup is designed to withstand, this site’s cybersecurity coverage hub tracks breaches, zero-days, and defensive tooling as they develop.
Frequently Asked Questions
Do I really need two YubiKeys?
Yes, unless you enjoy account-recovery phone trees. A single key works fine until it doesn’t, whether that’s loss, damage, or leaving it plugged into a machine you no longer have access to. Register a second key everywhere you register the first, per steps 1 and 12 above.
Does a YubiKey work with my phone?
Most current YubiKeys support NFC, so an Android phone or iPhone with NFC enabled can tap the key against the back of the phone during sign-in. USB-C models also work with USB-C phones directly. Check the model’s connector and NFC support against your specific phone before buying.
What happens if I lose my YubiKey?
Sign in with your backup key immediately and remove the lost key’s registration from every account it was tied to, exactly as Yubico’s own advisory recommends for a compromised device. This is why step 13’s lockout drill matters: if you’ve already tested that your backup works, this becomes a five-minute cleanup task instead of a crisis.
Is my YubiKey affected by the Eucleak vulnerability?
Only if it’s running firmware older than 5.7.0 (5.7.2 for Bio Series) and was manufactured before May 21, 2024. Run ykman info to check your firmware version, as covered in step 4.
Can a YubiKey replace my password manager?
No. A YubiKey proves you’re you during sign-in. A password manager generates and stores the unique credentials for every account you have. They solve different problems and work best paired together, with the key protecting the vault itself, as described in step 7.
Do I need a YubiKey 5 Series, or is the cheaper Security Key enough?
The $29 Security Key covers FIDO2/WebAuthn for most consumer logins. Pay the extra $29 to $56 for a 5 Series key only if you need SSH authentication, GPG signing, OATH-TOTP, or smart card (PIV) support, all covered in steps 9 and 10.
Will a YubiKey slow down how fast I log in?
It adds a physical tap or PIN entry, typically one to two seconds, in exchange for removing the password-typing step entirely on supported sites. Most people find it faster than a password plus a six-digit code from an app, not slower.
What’s the difference between a YubiKey and a passkey on my phone?
Both are FIDO2/WebAuthn credentials, and both resist phishing the same way. The difference is portability: a phone passkey is tied to that device and its ecosystem (iCloud Keychain or Google Password Manager sync), while a YubiKey moves freely between any machine with a USB port or NFC reader, which matters for shared computers, servers, and cross-platform work.
