What is YubiKey and how does it work?
Author: Domeny.ForSale editorial team Published
In brief: YubiKey is a small hardware security key made by Yubico, used to authenticate logins to accounts and services. When used with FIDO2 or U2F, it protects against phishing more effectively than codes you type in, because it checks that authentication is tied to the correct website. You do not need two keys, but a spare significantly reduces the risk of losing access if your primary key is lost or damaged.
What is YubiKey and what does it protect against?
YubiKey looks like a small USB flash drive, but it is not for storing documents. Depending on the model, you plug it into a compatible USB port or hold it near your phone to connect via NFC, a short-range wireless technology. Check the exact connectors and supported features before buying.
The key can serve as a second authentication factor. This provides additional proof of identity beyond a password: someone trying to log in must not only know a secret but also have access to the physical device. Some services also let you use the key to log in without a password.
The main benefit is protection against account takeover, especially through phishing—impersonating a genuine login page. This does not mean complete protection for your computer: YubiKey is not antivirus software and does not automatically protect against malware or the theft of an already active session.
How does logging in with YubiKey work?
In a common setup, the key uses FIDO2 or the older U2F—standards that use cryptography to authenticate users. When you add the key to an account, a cryptographic key pair is created. The service receives the public key, while the private key stays on the device.
During login, the service sends a challenge, and YubiKey generates a signed response. The browser and key bind this operation to the correct website. This prevents a fake page from simply intercepting the response and using it to log in to the genuine service.
For the user, the process usually looks like this:
- Open the service’s website and start logging in.
- Enter your password if your setup requires it.
- Plug in YubiKey or hold it near your phone.
- When prompted, enter the key’s PIN and touch its contact sensor.
Touching the sensor usually confirms the user’s physical presence, rather than verifying their identity through a fingerprint. Biometrics are available on selected models, not every YubiKey.
FIDO2 also allows compatible keys to store passkeys: credentials that let you log in without a traditional password. Whether this option is available depends on the model, the service and the configuration.
How does it compare with SMS and authenticator apps?
An SMS code or a code from an authenticator app can be entered on a fake website and immediately used by an attacker. YubiKey used with FIDO2 or U2F does not rely on typing in such a code, so it offers better protection against this scenario.
For example, you receive a message claiming that your email account has been blocked. The link leads to a convincing copy of the login page. If you enter your password and the current code from your app, the attacker may try to take over your account. FIDO authentication will not work on this copy as it would on the genuine website, because its address is different.
However, not every YubiKey feature provides the same protection. Selected models also support one-time codes and other mechanisms. The phishing resistance described above applies to logging in with FIDO2 or U2F, not to every use of the device.
The key is particularly useful for protecting your primary email account, password manager, administrator accounts and domain registrar control panel. Taking over your email may allow an attacker to reset passwords for other services. Taking over your domain account may let them change the settings that direct website traffic and email.
Do you need two keys?
One key is usually enough to use a service, but having two is a sensible backup arrangement. Use the first day to day and keep the second in a separate, secure location. Carrying both on the same keyring does not protect against losing them together.
You must add the spare key to each account separately. It does not automatically become a copy of the first, and buying a second key after losing access will not recreate your previous registrations. Also check whether the service allows you to register multiple keys.
If you have only one YubiKey, make sure you have an alternative way to recover your account. This could mean recovery codes stored outside that account or another method supported by the service. However, a weaker backup method can weaken the protection of the entire account.
If you lose your key, log in using a backup method and remove the lost device from your security settings. Losing a key does not necessarily mean your account has been compromised, but you should not leave it registered as an active login method.
How do you choose and safely set up YubiKey?
First, check the official documentation for your most important services to see whether they support security keys and, if you want it, passwordless login. Then use Yubico’s documentation to compare connectors, NFC support, standards and the chosen model’s compatibility with your phone and computer. A connector that fits your device does not guarantee support for every feature.
Start by setting up one important account. Add your primary key, register the spare and save any available recovery codes. Before disabling other methods, use a separate browser window to check that you can log in with each key and use the planned recovery method.
See also: What is HAproxy?
Read also
