The full review
What it is
YubiKey is a range of hardware security keys from Yubico, a publicly traded company based in Stockholm that has worked on the problem since 2007. The entry-level Security Key series is FIDO-only. The 5 Series adds FIDO U2F, Yubico OTP, OATH-TOTP and HOTP, smart card (PIV), OpenPGP, challenge-response and static passwords, in USB-A, USB-C, NFC, Nano and Lightning form factors.
FIPS 140-2 and FIPS 140-3 variants are sold for regulated use, with full-device certification, DoD authorisation for both PKI and FIDO2, and physical security level 3. The Bio and C Bio FIDO Edition keys add a fingerprint reader. The YubiHSM 2 is a separate hardware security module aimed at servers rather than individuals.
What it costs in practice
Everything is a one-time purchase. Security Keys are $29, the 5 NFC and 5C NFC are $58, the 5C is $65, Nano models are $68, the 5Ci is $85, FIPS models run from $88 to $115, and Bio keys are $98. Because secrets on the device are write-only and cannot be read back or cloned, Yubico advises keeping a copy of each shared secret in a safe place or enrolling several keys at once, so the realistic outlay is two keys.
Consumers who buy direct from Yubico.com can return products within 45 days of receipt for a full refund to the original payment method; purchases through Amazon or resellers must be returned to that vendor. The hardware warranty is one year from delivery, with repair, replacement or refund at Yubico’s discretion. Shipping fees vary by country, and Yubico does not deliver to a list of countries that includes China, Russia, Ukraine, Belarus, Iran and Vietnam.
Strengths
- Entry-level Security Key costs $29 one-time, with no subscription
- 5 Series covers FIDO2/WebAuthn, U2F, Yubico OTP, OATH-TOTP/HOTP, PIV, OpenPGP, challenge-response and static passwords
- FIPS 140-2 and FIPS 140-3 validated variants are sold in the store
- 45-day returns for consumers buying direct from Yubico.com, refunded to the original payment method
Watch out for
- Secrets are write-only and cannot be read out or cloned, so a second key is needed as a backup
- Hardware warranty runs one year from delivery, with repair, replacement or refund at Yubico’s discretion
- Returns apply only to direct Yubico.com purchases; Amazon or reseller orders go back to that vendor
- Security Key series and Bio FIDO Edition are FIDO-only; the full protocol set is on the 5 Series
Key features
| Feature | What it does |
|---|
| Multi-protocol 5 Series | FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP, OATH-HOTP, smart card (PIV), OpenPGP, challenge-response and static password on one key. |
| FIPS-validated variants | FIPS 140-2 and FIPS 140-3 SKUs with full-device certification, DoD authorised for PKI and FIDO2. |
| Biometric option | YubiKey Bio and C Bio FIDO Edition fingerprint keys at $98 USD each. |
| One-year hardware warranty | One year from delivery to the original purchaser; Yubico repairs, replaces or refunds at its discretion. |
How Yubico YubiKey compares
| Alternative | How it differs |
|---|
| RoboForm | Software password manager; its business page lists hardware keys among supported 2FA options. |
| Enpass | Software password manager with passkey support on paid plans. |
| KeePassXC | Free, open-source desktop password manager; software rather than a physical key. |
Frequently asked questions
How much does a YubiKey cost?
Prices are one-time, in USD. The FIDO-only Security Key NFC and Security Key C NFC are $29 each. The multi-protocol YubiKey 5 NFC and 5C NFC are $58, the 5C is $65, the 5 Nano and 5C Nano are $68, and the 5Ci is $85. FIPS variants run from $88 to $115, and the fingerprint Bio FIDO Edition keys are $98. Consumers buying direct from Yubico.com get 45-day returns.
Do I need more than one YubiKey?
In practice, yes. Secrets on a YubiKey are write-only and cannot be read out or copied, so Yubico advises storing each shared secret somewhere safe or enrolling multiple keys at the same time. Budget for a second key as a backup.
Yubico YubiKey ratings on other platforms
Independent user ratings from third-party review sites, linked here for transparency.
These are not our editorial score, are captured on the date shown, and may have changed since.