FIDO2YubiKey

FIDO2YubiKey is a hardware security key produced by Yubico designed to enable modern authentication using the FIDO2 standard, including WebAuthn and CTAP. It provides cryptographic credentials stored on the device and used for authentication to online services, reducing reliance on passwords.

The device can operate as a passwordless authenticator or as a second-factor device. During enrollment, the authenticator creates a unique public‑private key pair; the private key remains on the device while the public key is registered with the service. The relying party may store an attestation credential to verify the device type. Logging in requires a user gesture such as touch or a PIN, depending on the model.

YubiKeys in the FIDO2 family support USB-A, USB-C, NFC, and, in some models, Lightning for iPhone. They work with WebAuthn-enabled browsers and platforms such as Windows, macOS, Linux, and Android; iOS support varies by browser and OS version. Firmware updates may be required to enable the latest features.

Security considerations: The keys offer phishing-resistant authentication and credential portability, with private keys bound to the user’s device and origin. If the key is lost, recovery typically involves backup credentials or account recovery processes provided by the service. Some deployments use centralized management and policies for issuance and revocation.

Deployment notes: FIDO2 YubiKeys are widely used in enterprise and consumer contexts. They require server-side WebAuthn/CTAP2 support and user-friendly enrollment and recovery workflows. Compatibility depends on browser support, operating system version, and device form factor.