Which YubiKey to Choose: 5 Series, Security Key or Bio

Compare Yubico models and choose a security key for your devices and accounts

When you use FIDO2 to sign in, a YubiKey helps protect your account even if someone steals your password or you enter it on a phishing site. Deciding which YubiKey to choose comes down to whether you need the extra features of the 5 Series, which connector fits your devices, and how you will use the key each day. This guide compares the 5 NFC, 5C NFC, 5C Nano, Security Key and Bio.

Every model covered here supports FIDO2 and protects against fake sign-in pages when you use that standard. The differences lie in their additional features, connection options and everyday convenience.

If you are still comparing Yubico with other manufacturers, see our FIDO2 security key comparison, which also covers Google Titan, Nitrokey and other alternatives.

Choosing a YubiKey at a glance

Start with the connection you need and the features you plan to use:

• YubiKey 5C NFC is a versatile choice if you want all the protocols supported by the 5 Series. It connects to compatible laptops and phones over USB-C, or to a phone over NFC.
• YubiKey 5 NFC has the same features but uses USB-A, making it more convenient for a computer without USB-C.
• YubiKey 5C Nano can stay plugged into your laptop. We recommend pairing it with a second key that has NFC, so you can also use your phone and retain access if you lose the main key.
• Security Key NFC or Security Key C NFC is enough for FIDO2 sign-in and passkeys, which let you sign in without a password. These models suit compatible Google accounts, cryptocurrency exchanges and Delta if you do not need TOTP codes, GPG signing and encryption, or smart card functionality.
• YubiKey Bio suits frequent sign-ins on a computer if you prefer a fingerprint to a PIN. For a phone, an NFC model is more convenient, since Bio does not have NFC.

Alongside your main key, set up a backup and register it separately with each service you need. Below, we explain how to do this and where to keep the second key.

What a YubiKey protects

A YubiKey is a hardware device you use to verify account sign-ins. When you register it with a service, it creates a cryptographic key pair, keeping the private key inside its secure chip. Authentication is bound to the service’s domain, the website address shown in your browser, so a lookalike such as g00gle-login.com cannot obtain a valid response for the real service, even if it copies the original page exactly. You can give a scammer an SMS or authenticator app code, or enter it on a fake website; a FIDO2 hardware key will not authenticate to the real service through that page.

You can use the key as a second authentication factor: after entering your password, you touch the key and, if the service requires it, enter the key’s PIN. For passwordless sign-in, a passkey is stored on the key, which you use with a PIN and a touch, or a fingerprint on Bio. Firmware 5.7 and later can store up to 100 passkeys. When a service uses your YubiKey as a second factor without storing a passkey on it, that account does not take up a passkey slot, so this limit does not apply.

Prioritise your email, Google, Apple and Microsoft accounts, password manager, GitHub, cryptocurrency exchanges and work systems such as Delta.

A YubiKey protects access to your accounts, while a hardware wallet is designed for cryptocurrency self-custody. A YubiKey cannot replace a cryptocurrency wallet; you use it to secure your exchange login, the associated email account and your password manager.

Which features do you need?

The keys covered here fall into two groups. Security Key and Bio FIDO Edition support FIDO2 and U2F for two-factor authentication and passkeys. The YubiKey 5 Series offers those same capabilities, plus one-time codes, certificate-based authentication, digital signatures and encryption.

OATH-TOTP and HOTP let you use one-time codes like those shown by Google Authenticator. The secret used to generate each code stays on the key, which calculates the code itself. Yubico Authenticator displays it when you connect the key over USB or hold it against your phone’s NFC antenna. Firmware 5.7 and later supports up to 64 TOTP or HOTP credentials. These codes are useful for services that offer only TOTP, which Security Key does not support. You can still enter a code from a YubiKey on a phishing site, so keeping the secret on the key does not provide the same protection against fake sign-in pages as FIDO2.

PIV smart card functionality lets you work with certificates for tasks such as signing in to Windows on a corporate domain, signing documents and connecting through compatible VPN clients. These features are rarely needed at home, but your organisation’s security team may require them at work.

OpenPGP is used to sign Git commits with GPG, encrypt email and files, and authenticate over SSH through gpg-agent. These features are most relevant to developers and system administrators.

The 5 Series has two OTP slots, each of which can be configured for a static password, Yubico OTP or challenge-response. In challenge-response mode, an application sends a challenge and receives a response calculated by the key using a secret stored on it. KeePassXC, for example, uses this response to add protection to a password database. If you already use KeePassXC and want to secure your database with a hardware key, this feature may be useful.

Security Key is often enough for SSH: OpenSSH can use a hardware key through FIDO2. This uses SSH keys in ecdsa-sk or ed25519-sk format, depending on the algorithms the device supports. All Yubico FIDO2 models support ecdsa-sk. Choose the 5 Series if you plan to use PIV or OpenPGP for SSH.

Security Key is enough for FIDO2 or U2F sign-in. Choose the 5 Series if you also need TOTP codes, GPG, smart card functionality or KeePassXC challenge-response protection.

USB-A, USB-C and NFC: choosing a connection

Choose a connector that matches the device you use most: USB-C or USB-A. All iPhone 15 and later models have USB-C. A compatible adapter lets you connect a key to a different port, but the key and adapter will protrude further, increasing the risk of damage if knocked. A direct connection is more convenient for daily use.

To authenticate over NFC, wait for the prompt, then hold the key against the location of your phone’s NFC antenna. Compatible iPhones and Android phones support this method. You can also plug a USB-C key into your phone if the operating system and service support it. NFC is useful for phones with Lightning or other connectors, too. Of the keys compared here, the 5C Nano and Bio do not have NFC.

Nano is designed to stay plugged into a laptop: it barely protrudes from the port, and you authenticate by touching its edge. This is convenient if you frequently sign in or approve actions throughout the day. Since a key left in the port could be stolen along with the laptop, set a FIDO2 PIN, enable screen locking and protect access to saved passwords. Some services require only a touch for two-factor authentication, even if you have set a PIN.

Which YubiKey model should you choose?

YubiKey 5 NFC: USB-A and NFC

YubiKey 5 NFC combines USB-A and NFC with all the protocols supported by the 5 Series: FIDO2 and U2F, OATH, PIV, OpenPGP and the OTP slot functions. With no battery or moving parts, it is convenient to carry on a keyring alongside your house keys.

This model suits a desktop PC, an older laptop or a work computer without USB-C. You can use NFC with your phone, so the key itself does not need a USB-C connector for that.

If your laptop has only USB-C, or you plan to switch to one that does, choose the 5C NFC to avoid needing an adapter.

YubiKey 5C NFC: USB-C and NFC

YubiKey 5C NFC has the same features as the 5 NFC, with USB-C and NFC connectivity. We recommend it if you want a versatile key for a compatible laptop and phone, particularly if you have not yet decided which services you will use it with. It can secure account sign-ins, generate TOTP codes and provide the additional features of the 5 Series.

For a computer with only USB-A, the 5 NFC is more convenient, since the 5C NFC would need an adapter.

YubiKey 5C Nano: a compact key for your laptop

YubiKey 5C Nano is a miniature 5 Series key that can stay plugged into a USB-C port. It supports the same protocols as the 5C NFC but has no NFC, so connecting it to a phone requires USB-C support from both the operating system and the service.

Nano is convenient for developers who frequently sign commits, administrators and anyone who regularly signs in to work systems throughout the day. Leaving it in the laptop saves you from having to find and connect it each time.

We recommend a second key alongside your Nano, especially if you also use a phone. A 5C NFC makes a useful companion: the Nano can stay in your laptop while the second key goes on your keyring, works with your phone and gives you access to your accounts if you lose the main key.

Security Key NFC and Security Key C NFC

The Security Key Series supports FIDO2 and U2F, providing the same protection against fake sign-in pages as the 5 Series when you use these protocols. Firmware 5.7 and later can store up to 100 passkeys. Both models have NFC; the difference is the connector: Security Key NFC uses USB-A, while Security Key C NFC uses USB-C.

This series does not support OATH-TOTP/HOTP, smart cards, OpenPGP or programmable OTP slots. If you do not plan to use these features, there is no need to pay extra for the 5 Series just for FIDO2 sign-in.

Security Key suits compatible Google and Apple accounts, password managers and cryptocurrency exchanges. It can also be a good choice for a parent, or a less expensive backup to a 5 Series key. As a backup, it will let you sign in over FIDO2 or U2F if you lose the main key, but it cannot replace the extra features of the 5 Series.

YubiKey Bio: sign in with your fingerprint

YubiKey Bio has a fingerprint reader that lets you authenticate without entering a PIN. The biometric template used to recognise your fingerprint stays on the key and is not sent to services. You can enrol up to five fingerprints. YubiKey Bio connects over USB-A, while YubiKey C Bio uses USB-C.

This guide covers Bio FIDO Edition, which supports FIDO2 and U2F. A separate Multi-protocol edition adds smart card functionality and is available through the enterprise YubiKey as a Service programme. FIDO Edition supports the same protocols as Security Key, so the extra cost buys the convenience of fingerprint authentication.

Bio does not have NFC, and whether you can use it with a phone over USB depends on the operating system and browser. To add or remove fingerprints, use Yubico Authenticator on a computer; the mobile versions do not support fingerprint management. Some browsers may also require a PIN instead of accepting a fingerprint.

If Bio fails to recognise your fingerprint three times in a row, fingerprint authentication is temporarily blocked until you enter the PIN. If a service uses U2F and does not prompt for a PIN, unblock fingerprint authentication through Yubico Authenticator on a computer. Dry or cold fingers may be harder for the reader to recognise. The section on first-time setup explains what happens after incorrect PIN entries and a reset.

Choose Bio if you frequently sign in on a computer and prefer a fingerprint to a PIN. If your phone is your main device, an NFC model will be more convenient.

Other Yubico models

The 5 Series also includes the YubiKey 5C without NFC and the YubiKey 5 Nano, designed to stay plugged into a USB-A port. The YubiKey 5Ci has USB-C and Lightning connectors, making it an option if you specifically need a wired connection to an iPhone 14 or an earlier model with Lightning.

The separate FIPS Series, which includes YubiKey 5C NFC FIPS, is certified to a US government standard for cryptographic modules. It is intended for institutions and businesses that require this certification; it is not needed for signing in to personal accounts.

YubiKey comparison tables

Models, connections and everyday use

Protocols and additional features

All models covered here support FIDO2 and U2F. The capacities shown apply to firmware 5.7 and later; when buying a new key, we recommend 5.7.4 or later, for the reasons explained in the next section. A key can store up to 100 passkeys. Registering it as a second factor without the service storing a passkey on it does not use one of those slots.

How to check your YubiKey firmware version

YubiKey firmware cannot be updated, so the key keeps its factory-installed version throughout its lifetime. Check it in Yubico Authenticator when your key arrives.

Install the application from the official Yubico website and connect your key. The main screen shows the model and firmware version, along with the serial number on models that provide it.

Firmware 5.7, released in May 2024, increased passkey storage from 25 to 100 and the number of TOTP or HOTP credentials in the 5 Series from 32 to 64. Yubico also replaced the Infineon cryptographic library with its own, so the newer keys are not affected by the EUCLEAK vulnerability disclosed in September 2024.

According to Yubico’s advisory, the vulnerability affects the 5 Series and Security Key with firmware earlier than 5.7, and Bio with firmware earlier than 5.7.2. The attack can recover an ECDSA private key by measuring electromagnetic emissions from the chip, but it requires physical access, specialised equipment and expertise. If you already own an older key, assess the risk of someone gaining physical access before deciding whether to replace it.

When buying a new 5 Series, Security Key or Bio, we recommend firmware 5.7.4 or later. Version 5.7.4 also fixed a FIDO2 issue related to PIN verification. Yubico rates its severity as low because it is difficult to exploit and the protocol provides additional protection.

On 21 July 2026, Yubico announced the availability of firmware 5.8 with CTAP 2.3, a new version of the protocol used by the key to communicate with the browser and operating system. It adds experimental support for signing data through WebAuthn, confirming online payments, and expanded enterprise attestation, which lets an organisation’s systems identify a specific key.

For personal use, a more noticeable change may be seeing YubiKey passkeys alongside those from your phone or password manager in a single list, where the operating system and application support it. Firmware 5.7.4 or later is sufficient for ordinary account sign-ins, so there is no need to seek out 5.8 solely for that purpose.

Why you need a second key

You cannot copy a YubiKey’s FIDO2 or U2F credentials to another key, and there is no seed phrase to restore them. If your only key is lost or broken, you will have to use whatever recovery methods the service provides, such as recovery codes or contacting support. Some services restrict or disable these options once you enable security key protection.

Register the second key separately with each service, immediately after the first, wherever multiple keys are supported. Each key will work independently. Keep a list of these accounts in your password manager so that, if a key is lost, you know where to remove it.

To set up a backup for TOTP, save the TOTP credentials on both 5 Series keys during setup: scan the same QR code in Yubico Authenticator with the first key connected, then repeat with the second. Do this while the setup page is open, since the service may not show the QR code or setup secret again after you close it.

Depending on your needs, consider one of these pairs:

• Two identical keys, such as two 5C NFCs, support the same features, making backup access easier to configure. You still need to register and configure each one separately.
• A 5C Nano in your laptop and a 5C NFC on your keyring make a convenient pair for computer and phone use, provided both are registered with the services you need in advance.
• A 5C NFC as your main key and a Security Key C NFC as a backup cost less than two 5 Series keys. The spare Security Key lets you sign in over FIDO2 or U2F but does not support TOTP, PIV or OpenPGP, so you need a separate recovery plan for each of those features. Recovery codes may restore access to a TOTP-protected account if the service provides them, but they cannot restore PIV certificates or OpenPGP keys.
• Bio and Security Key can each be registered with the same services that support FIDO2 or U2F. With the backup Security Key, you authenticate using a touch and, where required, a PIN instead of a fingerprint.

Keep your backup key separate from your main key so that you cannot lose both with the same bag or keyring. Leave it somewhere secure at home or ask someone you trust to keep it for you. Store recovery codes for your most important accounts somewhere other people cannot access them.

Which YubiKey to choose for your needs

For cryptocurrency exchanges

Binance, Kraken and Coinbase support security keys or passkeys for signing in or approving certain actions. Before setting one up, check which operations your exchange lets you protect with a key. Security Key is enough for FIDO2; choose the 5 Series if you also want to keep TOTP credentials on the key.

Also secure the email account you use to recover access to your exchange account. For long-term cryptocurrency storage, consider a hardware wallet; our guide to choosing a hardware wallet in 2026 compares the models and their differences.

For military personnel using Delta

To sign in to Delta with a hardware key, choose a Security Key or 5 Series model with FIDO2 support. If you use Delta on your phone, choose a model with NFC: Delta’s iPhone instructions use NFC to register a physical Yubico key with an account. Follow the official Delta instructions and your unit’s guidance. Our guide to FIDO2 keys for Delta: compatible models and setup also compares the models and explains registration.

For developers and administrators

The key series covered here support SSH authentication through FIDO2; choose ecdsa-sk or ed25519-sk according to the algorithms supported by your device. You can also use the key to sign commits in SSH format, which GitHub supports. GPG or smart card functionality requires the 5 Series. If you work on a laptop throughout the day, leave a 5C Nano in its port and use a 5C NFC with your phone and as a backup if the main key is lost. Our guide to GitHub two-factor authentication and passkeys with YubiKey walks through registration.

For parents

If your parents would rather avoid codes and authenticator apps, a Security Key with NFC may suit them: when prompted on a compatible phone, they can hold the key against the NFC antenna to authenticate. Bio is less convenient for this use because it lacks NFC, and its reader may struggle with dry fingers. Help your parents register a second key; with their permission, you can keep it for them.

If you mainly use your phone

For phone use, choose a 5 NFC, 5C NFC or Security Key with NFC. A USB-C key can also plug into a compatible phone, but support depends on the operating system and service, and some Yubico Authenticator features are unavailable over USB-C on iPhone. To get a TOTP code, open Yubico Authenticator on your phone and hold a 5 Series key against the NFC antenna. Nano and Bio are more convenient for computers.

What to check before first use

A new key sold for you to configure yourself should have no user-set FIDO2 PIN and no stored passkeys. When it arrives, check the following:

• The packaging is sealed, with no signs of opening or damage.
• The model shown in Yubico Authenticator matches your order. For a new 5 Series, Security Key or Bio, we recommend firmware 5.7.4 or later.
• No user FIDO2 PIN has been set, and there are no stored passkeys. If the key already has a PIN or passkeys, do not use it; contact the seller.

The first slot on a 5 Series key contains a factory-configured Yubico OTP credential, so its presence does not mean the key has been used before. This is a separate protocol and should not be confused with stored passkeys or a user-set PIN.

Genuine keys have factory-installed Yubico attestation certificates, which compatible systems can use to verify their origin during registration. Buy from authorised resellers and avoid unknown marketplace sellers.

After checking the key, set a FIDO2 PIN of at least six characters, or more if the key’s policy requires it. Avoid combinations such as 123456 or your date of birth. This PIN belongs to the key itself, and you will use it across FIDO2 services. For Bio, enrol your fingerprints on a computer after setting the PIN.

If you enter the wrong PIN three times in a row, you must unplug and reconnect the key before trying again. You have a total of eight failed attempts before FIDO2 is blocked; entering the correct PIN restores the allowance to eight. Unplugging and reconnecting the key does not restore the number of attempts.

Once you have checked the key, you can register it with your accounts. Our guide to using a FIDO2 security key to protect Google and other services covers setup and sign-in options.

Which YubiKey to choose: final recommendations

Choose Security Key for FIDO2 or U2F sign-in, or the 5 Series if you also need TOTP codes, GPG or smart card functionality. Match the connector to your main device and choose NFC for phone use. Nano is convenient for leaving in a laptop, while Bio lets you authenticate with a fingerprint. Set up a backup alongside your main key, and check how you would recover access to your accounts.

For more advice on protecting your cryptocurrency, read How to avoid crypto scams: 10 schemes to watch for in 2026. A YubiKey cannot stop a transfer you make yourself at a scammer’s instruction, even when your account login is secured with a key.