YubiKey Review

A YubiKey is the hardware a security lead issues when SMS codes and an authenticator app are no longer the control for email and the identity provider. The sticker is the small number, because the order that survives a lost key is two devices per person.

The connector has to match the laptops and phones already in the fleet. The wrong plug becomes a dongle on every laptop, a cost the sticker never shows.

This review prices the 5 Series, the Security Key, the Bio, and the FIPS line on Yubico's USD pages, then sets them next to Google Titan, Thetis, Token2, and Nitrokey. Enrollment in practice usually lands in Okta or Duo.

Toolradar data: the September 2026 security ranking evaluated 816 tools. Hardware keys are not their own category there, so the directory neighbors are the identity products a key plugs into.

Cyberpresso data: 27,000 security readers get this brief, and the audience file dated 20 September 2026 puts the open rate at 28%.

How we compared: Yubico's store and product pages, the US Google Store, Thetis, Token2, and the Nitrokey shop, read on 24 September 2026. Prices were verified on those vendor pages in September 2026. No vendor paid for a place.

YubiKey is a hardware security key from Yubico, and it signs a login with a private key that stays on the device. A lookalike site can collect a six-digit code and still fail, which is why a single key is a bad order: that signature cannot move to a replacement.

The 5C NFC is the key most fleets should price first. It is USB-C and NFC, so a laptop plugs in and a phone taps, at FIDO2 Level 2, with passkeys, codes, certificates, and OpenPGP on one device. The USB-A 5 NFC carries the same sticker and slot counts, so an older laptop does not cost more.

The Security Key series is FIDO2 and U2F only. On the Security Key C NFC, Yubico marks code generation unavailable, and PIV, OpenPGP, and OATH are marked no, even though passkey capacity and FIDO2 Level 2 match the 5 Series.

It is the right spare when every account already speaks passkeys, and the wrong company standard when a VPN still wants a code from an authenticator.

A synced passkey inside 1Password or Bitwarden is a different bet, because the vault can move to a new phone and a hardware-bound passkey cannot. Put the identity provider and the mailbox that resets everything else on the key, and leave ordinary sites in the vault.

Setup is a FIDO registration, not a software install. You plug the key in or tap it on an NFC phone, set a PIN in the browser or in Yubico Authenticator, and enroll it on the account.

The 5 Series can also store OATH secrets, so Yubico Authenticator shows codes for sites that still refuse passkeys. Those sites cannot move to the cheaper FIDO-only model.

Day to day, the tap replaces the six-digit code on Google, Microsoft, and the identity provider. A phishing page described in how phishing actually lands can still steal a password, but it cannot replay the signature the key produces for the real origin.

Yubico does not sell a cloud copy of the credential. If the only enrolled key goes through the wash, the backup is whatever you registered beside it. Enroll the spare the same day, and keep a break-glass path in a password manager that is not the only factor on the mailbox.

A leave-in Nano stays in the USB-C port, so a stolen laptop includes the key, unlike a key you can pull off a ring.

Yubico's USD product pages, read on 24 September 2026, are a hardware price list. There is no monthly seat and no free key, so a rollout is a purchase order. The 45-day return covers a purchase, not a lost key, so the spare has to be in the cart before anyone enrolls.

The 5C NFC is the default for a mixed fleet. It is USB-C and NFC on firmware 5.8 at FIDO2 Level 2, and VPN codes and certificates sit on that same key.

The USB-A 5 NFC matches that price, so an older dock does not change the budget. A pair is $116, which clears free shipping for the US and Canada, while a single key pays freight.

The compact 5C is $65 and drops NFC, so you pay more than the default to lose the phone tap. The 5Ci is $85 for USB-C plus Lightning, also without NFC, and it is worth buying only while those phones remain.

The 5C Nano and the YubiKey 5 Nano are each $68. The 5C Nano weighs 1 gram and stays in the port, so a stolen laptop takes the key with it.

The Security Key C NFC and the USB-A Security Key NFC are each $29. The C NFC matches the 5 Series on FIDO2 Level 2 and passkey capacity, with OATH, PIV, and OpenPGP marked no. Codes require the 5 Series, so do not make this the only company key.

The C Bio FIDO edition is $98, with a fingerprint, a PIN fallback, USB-C, no NFC, and FIDO only. Yubico states a mean time between failure of 17+ years on that key, against 100+ years on the 5C NFC. Buy it for a shared desktop rather than a phone-based staff.

FIPS 140-3 on the 5C NFC shape is $88, on firmware 5.7, at overall Level 2 and physical security Level 3. Buy it only when a written control names FIPS. A tray of 50 of the 5C NFC FIPS 140-2 model is $4400, for projects already approved on that older validation.

Single-key orders of 50 to 199 products are 4% off, and 200 or more are 6% off. Trays cannot be mixed into that discount, so a mixed cart pays the single sticker.

A tray of 50 YubiKey 5C NFC keys is $2900, and a tray of 50 Security Key C NFC keys is $1450. That total is the single sticker times the tray, not the percent off.

YubiKey as a Service publishes no per-user USD price. It names Base, Advanced, and Compliance, plus a replacement pool of up to 25% of subscribed users per year.

Thetis PRO is $32.99 with USB-A, USB-C, and NFC, and the 2-pack is $59.99, which undercuts two default YubiKeys if FIDO2 Level 1 is acceptable. Token2's PIN+ Dual is $29.67 in the US at 0% VAT, and a second unit is $29.52, so the spare is printed on the page.

Titan includes free shipping on one key, so a Google account can buy a single device without paying Yubico's freight minimum. Nitrokey's 3C is not published in USD, so a US purchase order has no list price to attach.

Buy the 5C NFC for a company standard when staff use USB-C laptops and NFC phones, and at least one system still wants a code or a smart card. Issue the USB-A 5 NFC where the dock is still USB-A, because the price does not change.

Buy the Security Key when the fleet is already on FIDO and you are paying for a spare. Keep the 5 Series if a VPN, a badge, or OpenPGP is still required.

Buy the FIPS 140-3 key only when the written control names that validation. Buy the C Bio for a shared desktop that needs a fingerprint and will not tap a phone.

An authenticator app is enough when a phishable code is an acceptable risk, and a synced vault is enough for ordinary sites. The 1Password and Bitwarden comparison is the vault decision, and break-glass admin secrets belong in a secrets manager.

The key sits in the access policy, which the zero trust guide covers, and readers can subscribe free for the next control note.