Setting up a YubiKey takes about five minutes per account. Plug the key in, open the account’s security settings, choose the option to add a security key, and touch the key when prompted. The most important step is easy to skip: buy two keys and register both at the same time. A hardware key has no cloud copy, so if you lose your only key, you can be locked out of every account where it is your sign-in method.
This guide walks through setup in order, explains how the key differs from text messages and authenticator apps, covers the PIN and passkey choices that confuse beginners, and shows what to do when a key is lost.
What a Hardware Security Key Does
A hardware key is a small device that proves you are physically present when you sign in. After you enter your password, the site asks the key to confirm. You plug it in or tap it against your phone and touch it. The key signs a challenge that only works for the real website, which is why security keys resist phishing. A fake login page cannot get a valid response from the key.
That makes a key stronger than a code sent by text message or typed from an app, because a code can be read out or typed into a fake page. Yubico describes registering a security key in an account’s settings as its preferred method for multi-factor authentication. The Yubico Authenticator app offers a second option, and passkeys offer a third.
Before You Start
Buy Two Keys
PwdFortress, in an article published June 24, 2026, states the rule as “buy two keys, register both, and store them apart.” A key cannot be cloned, but each account can hold two registered keys, and either one can sign you in. Yubico’s setup page agrees: it says to set up a spare YubiKey, and recommends registering the primary and spare at the same time.
A spare can have a different form factor, such as USB-C on one and USB-A on the other, but it must be from the same YubiKey series, according to Yubico. Yubico’s page showed no prices, so check the store. PwdFortress mentions two lower-cost backup options, the Token2 T2F2 NFC at about $22 and the Google Titan at about $30, and says FIDO2 sign-in works the same across these brands.
Check Which Port and NFC Support You Need
Look at your computer and phone. Many laptops have USB-C. Phones use USB-C or NFC for tap-to-sign-in. Yubico notes that if a key has NFC and this is your first use, you should keep it in a powered USB port for at least three seconds to activate NFC.
Pick Accounts in Priority Order
Yubico suggests starting with email, password managers, and financial accounts. Email comes first because a compromised email account lets an attacker reset the rest. Add cloud storage and social accounts next. Check the Works With YubiKey catalog on Yubico’s site to see which services support the key.
Step-by-Step Setup
Step 1: Plug In the Key
Insert the YubiKey into a USB port, or hold it to your phone if it supports NFC.
Step 2: Open the Account’s Security Settings
Sign in to the service and find the security section. Yubico notes that each service handles YubiKey support differently, so names and steps vary. Look for Two-Step Verification, Two-Factor Authentication, or Multi-Factor Authentication, then find a security key, passkey, or authentication app option.
Step 3: Choose Security Key
Select the option to add a security key. The service will prompt you to insert the key and touch it. You may be asked to name the key. Use a label such as “Main” or “Backup,” as PwdFortress suggests.
Step 4: Touch the Key When It Flashes
Touch the metal contact or button. The service confirms the key is registered.
Step 5: Register the Backup Key
Repeat the same steps with your second key on the same account, right away. Do not postpone this for later.
Step 6: Save Recovery Codes
Most services give one-time recovery codes when you add a new sign-in method. PwdFortress advises saving them apart from both keys. Store them in a password manager or print them and keep them in a safe place.
Step 7: Test the Backup
PwdFortress recommends testing by signing in with the backup key alone. Do this before you remove any older sign-in methods, so you know the backup works.
Step 8: Remove Weaker Methods
Only after the test, consider removing text-message verification. PwdFortress lists this as the last step. If you keep SMS enabled, an attacker may use it instead of the key.
Security Key MFA, Passkey, or Authenticator App
Yubico’s setup page describes three ways to use the key.
Security Key as a Second Factor
You add the key in the account settings and use it after your password. This is Yubico’s stated preference.
Passkey
A passkey replaces the password with a cryptographic credential. When your browser prompts you, Yubico says to pick the option that mentions “Security key.” Otherwise, the passkey may not be protected by your YubiKey, and it could be saved on a phone or computer instead. That distinction matters if you want the physical key to be required.
Authentication App
You install Yubico Authenticator, add an account, and scan the service’s QR code. Yubico advises saving that QR code so you can register more keys later. This method is useful for services that do not support security keys directly.
The FIDO2 PIN
Some services may ask you to create a PIN or verify an existing one. Yubico calls it the FIDO2 PIN and says the Yubico Authenticator is the easiest way to manage it. The PIN is local to the key. It protects against someone who finds your key and tries to use it. Choose something you can remember, and note that the YubiKey Bio uses a fingerprint instead. For that model, after three failed biometric attempts the key falls back to PIN and touch, and you can unblock biometrics by entering your PIN and touching the bezel when the green light flashes.
What to Do If You Lose a Key
PwdFortress describes the recovery paths clearly.
If You Have a Backup Key or Recovery Codes
Sign in with the backup key or a saved recovery code. Remove the lost key from each service’s security settings. Then register a replacement as the new backup. This is why registering two keys matters.
If You Have No Backup
Yubico advises adding another form of two-factor authentication to your accounts so you are not locked out. Without a spare or recovery codes, recovery goes through each provider’s account-recovery process, which PwdFortress says can involve identity checks and waiting periods, handled one service at a time, and can take days.
Common Mistakes to Avoid
Registering Only One Key
A single key is a single point of failure. Register two at the same time.
Storing Both Keys Together
If a fire or theft takes one, it takes both. Keep the spare in a separate, secure location.
Skipping Recovery Codes
Codes are the safety net when keys are lost. Save them offline.
Leaving SMS Turned On
Attackers choose the weakest path. Once your keys are tested, remove text-message verification where the service lets you.
Choosing the Wrong Passkey Option
Select the entry that mentions a security key, or the passkey may not live on the YubiKey.
Which Accounts to Protect First
Not every account deserves the same effort. Start with the ones that can reset others. Your main email account comes first, because password resets for nearly every other service are sent there. Your password manager comes next, since it holds the keys to everything else. Then protect financial accounts, cloud storage, and the accounts tied to your phone number or identity.
Yubico suggests the same starting point of email, password managers, and financial accounts. After that, work outward to social accounts and shopping accounts as time allows. You do not need to finish in one sitting. Registering the first three or four accounts removes most of the risk.
How a Key Compares With Other Sign-In Methods
Text Message Codes
Codes sent by SMS can be intercepted or talked out of you by a scammer. A key does not send a code at all, which is why PwdFortress places removing SMS at the end of its checklist, after the backup key is tested.
Authenticator App Codes
An app code is stronger than SMS, but you can still type it into a fake login page. A security key signs a challenge tied to the real site, so a lookalike page cannot use it.
Passkeys
Passkeys replace passwords altogether. Yubico’s guidance is to pick the option that mentions a security key, so the credential lives on the YubiKey and not on a phone or computer.
Storing Your Keys Safely
PwdFortress advises storing the keys apart. Keep the primary key on your key ring or in your bag, since you will use it daily. Keep the spare in a safe place at home, or somewhere else you can reach, such as a locked drawer. Keep recovery codes separate from both keys. If one location is lost to theft or a fire, you still have a path back into your accounts.
Do not photograph or post pictures of your keys. A key is useless to a thief without your password, but there is no reason to advertise it. Treat the PIN like any other secret and avoid reusing a PIN from a bank card.
When a Service Does Not Support Keys
Some services accept only authenticator codes or SMS. For these, Yubico’s guide describes Yubico Authenticator, which stores the codes on the key itself. Yubico advises saving the QR code you scan during setup so you can register additional keys later. For services with no stronger option, use a long unique password and the best available second factor, and check back as support improves.
Frequently Asked Questions
How do I set up a YubiKey?
Plug it in, open the account’s security settings, choose a security key option, and touch the key when prompted. Register a second key on the same account.
Do I need two YubiKeys?
You should have a spare. Yubico recommends setting up a spare and registering both at the same time, and the spare must be from the same YubiKey series.
What happens if I lose my YubiKey?
If you have a backup key or recovery codes, sign in with those, remove the lost key from your accounts, and register a replacement. Without a backup, recovery goes through each service and can take days.
Is a security key better than an authenticator app?
Yubico lists security key MFA as its stated preference, and a key resists phishing because it signs a challenge tied to the real website. An app code can be typed into a fake page.
What is the FIDO2 PIN?
It is a local PIN that some services ask you to create for the key. Yubico says the Yubico Authenticator is the easiest way to manage it.
References and Sources
Yubico, “Setup”: https://www.yubico.com/setup/
PwdFortress, “Backup YubiKey: Why You Need a Second Security Key (2026)”: https://www.pwdfortress.com/en/blog/backup-yubikey-second-security-key-2026
Yubico, “Security Key Series”: https://www.yubico.com/products/security-key/
About The Author
