YubiKey

YubiKey 5 Series

As of March 2026^[update], the flagship^[26] product is the YubiKey 5 Series, first released in 2018,^[25] which comes in multiple sizes and interface formats (USB-A with NFC, USB-C with or without NFC, and USB-C + Lightning)^[27] and can be used for a wide range of cryptographic tasks including authentication (for access to websites, apps, operating systems, remote servers, networks etc.), encryption/decryption and digital signing.^[28] It achieves this by hosting multiple "applets" with memory slots/addresses on its secure, tamper-resistant hardware, with most applets being based on a widespread, cross-platform industry standard.^[29] The applets and their protocols are understood by and can be interacted with using a wide variety of software, ranging from Yubico applications to third-party software, web browsers and operating systems, although some administrative tasks can only be performed by Yubico tools.^[30]

The FIDO2 (sometimes referred to as FIDO2/WebAuthn,^[31] WebAuthn being the browser/OS implementation standard) applet can store passkeys for passwordless authentication via the CTAP2 protocol or two-factor authentication (2FA) via the CTAP1 (formerly U2F) protocol.^[32] The OATH applet can store seeds for time-based one-time passwords (TOTP) or HMAC-based one-time passwords (HOTP). The YubiKey 5 Series also has a PIV (a smart card standard) applet and an OpenPGP applet, which each have widespread applications from authentication to message and file encryption and signing. There is also a legacy proprietary applet named "OTP" with two slots, each of which can be programmed to store either a one-time password following a proprietary format ("Yubico OTP", which platforms verify using Yubico's "YubiCloud" servers^[33]), a static password of the user's choosing, a random or user-chosen secret for HMAC challenge–response or an OATH HOTP. This applet causes the YubiKey to function as a USB HID (similar to a keyboard) to enter the "OTP" slot contents on short press (slot 1) or long press (slot 2) of the YubiKey's touch sensor (unless challenge–response is used in the given slot). This USB HID functionality does not apply to the other applets.^[30] A "Yubico OTP" is factory-programmed into slot 1 of the YubiKey 5; the user can regenerate it or overwrite the slot for a different use, but any user-generated Yubico OTPs will have a different prefix ("vv" instead of "cc").^[34]

Other products

The product lineup as of March 2026^[update] also includes the YubiKey Security Key Series, a cheaper, "streamlined"^[26] offering that only contains the FIDO2 applet and does not have a nano or non-NFC version.^[35] Yubico also offers an "Enterprise Edition" of the Security Key Series, available on the "Yubikey as a Service" subscription plan; these feature a serial number to enable asset tracking.^[36]

The YubiKey Bio Series is another offering that supports biometric authentication through its fingerprint sensor. This series does not have a nano or NFC version.^[35] The standard YubiKey Bio Series (known as the "FIDO Edition"^[37]) only supports FIDO2, but in 2024, Yubico announced a "Multi-protocol Edition" that also supports PIV, available to enterprise clients on the YubiEnterprise Subscription.^[38][39]

Yubico offers a FIPS 140-2–certified version of the YubiKey 5 Series for government and enterprise clients subject to regulation requiring stringent certification.^[35] In November 2024, Yubico announced that the YubiKey 5 FIPS Series was undergoing certification according to the new FIPS 140-3 standard.^[40] Yubico had previously offered CSPN [fr]-certified versions of the for European markets (CSPN is an ANSSI certification), but these were discontinued in 2024 due to limited demand.^[41]

Yubico also offers the YubiHSM 2, a hardware security module for generating and storing master cryptographic keys for servers. The YubiHSM 2 also has a FIPS 140-2–certified version.^[42]

Comparison table

A list of the primary features and capabilities of the YubiKey products.^{[25][43][44][45][46]}

YubiKey 4 closed-sourcing concerns

Most of the code that runs on a YubiKey is closed-source. While Yubico has released some code for industry standard functionality like OpenPGP and HOTP, it was disclosed that as of the 4th generation of the product this is not the same code that the new units ship with.^[52][53] Because new units are permanently firmware-locked at the factory, it is not possible to compile the open-source code and load it on the device manually; a user must trust that the code on a new key is authentic and secure.

Code for other functionality such as U2F, PIV and Modhex is entirely closed source.

On May 16, 2016, Yubico CTO Jakob Ehrensvärd responded to the open-source community's concerns with a blog post saying that "we, as a product company, have taken a clear stand against implementations based on off-the-shelf components and further believe that something like a commercial-grade AVR or ARM controller is unfit to be used in a security product."^[54]

Techdirt founder Mike Masnick strongly criticized this decision, saying "Encryption is tricky. There are almost always vulnerabilities and bugs -- a point we've been making a lot lately. But the best way to fix those tends to be getting as many knowledgeable eyes on the code as possible. And that's not possible when it's closed source."^[55]

ROCA vulnerability in certain YubiKey 4, 4C, and 4 Nano devices

In October 2017, security researchers found a vulnerability (known as ROCA) in the implementation of RSA keypair generation in a cryptographic library used by a large number of Infineon security chips, as used in a wide range of security keys and security token products (including YubiKey). The vulnerability allows an attacker to reconstruct the private key by using the public key.^[56][57] All YubiKey 4, YubiKey 4C, and YubiKey 4 Nano devices within the revisions 4.2.6 to 4.3.4 were affected by this vulnerability.^[58] Yubico remedied this issue in all shipping YubiKey 4 devices by switching to a different key generation function and offered free replacements for any affected keys until March 31, 2019. In some cases, the issue could be bypassed by generating new keys outside of the YubiKey and importing them onto the device.^[59]

OTP password protection on YubiKey NEO

In January 2018, Yubico disclosed a moderate vulnerability where password protection for the OTP functionality on the YubiKey NEO could be bypassed under certain conditions. The issue was corrected as of firmware version 3.5.0, and Yubico offered free replacement keys to any user claiming to be affected until April 1, 2019.^[60]

Reduced initial randomness on certain FIPS series devices

In June 2019, Yubico released a security advisory reporting reduced randomness in FIPS-certified devices with firmware version 4.4.2 and 4.4.4 (there is no version 4.4.3), shortly after power-up.^[61] Security keys with reduced randomness may leave keys more easily discovered and compromised than expected. The issue affected the FIPS series only, and then only certain scenarios, although FIPS ECDSA usage was "at higher risk". The company offered free replacements for any affected keys.

Infineon ECDSA private key recovery

In September 2024, security researchers from NinjaLab discovered a cryptographic flaw in Infineon chips that would allow a person to clone a YubiKey if an attacker gained physical access to it. The security vulnerability permanently affects all YubiKeys prior to firmware update 5.7. Yubico rated the issue as "moderate", citing the need for an attacker to have physical access to the key, expensive equipment, and advanced cryptographic and technical knowledge.^[62][63][64]