YubiKey setup: lock down your email and exchange accounts
A YubiKey is a small USB key that stops phishing and SIM swaps from reaching the accounts that matter most.
Buy two YubiKeys, register both on your email account first, then on your password manager and every exchange account you still use. A YubiKey signs you in with FIDO2, which only answers to the real website, so a phishing page or a stolen phone number cannot get past it. For most people the YubiKey 5C NFC ($58 at Yubico) is the right model, and the $29 Security Key C NFC is enough if you only need passkeys and two-factor sign-in.
Why a hardware key beats SMS and authenticator codes
Two-factor methods differ in which attacks they stop. CISA, the US government's cybersecurity agency, says text and voice codes are exposed to SIM swaps and phone network attacks, and that app codes and push prompts can still be phished. Its fact sheet calls FIDO/WebAuthn "the only widely available phishing-resistant authentication."
A six-digit code works wherever you type it, including on a fake login page. A FIDO2 key's credential is tied to the real site's domain, and the browser tells the key which domain is asking, so a lookalike domain gets nothing.
| Method | Stops a password leak | Stops a SIM swap | Stops a phishing page |
|---|---|---|---|
| SMS or voice code | Yes | No | No |
| Authenticator app (TOTP) | Yes | Yes | No |
| Push prompt | Yes | Yes | No (and open to prompt spam) |
| Hardware key or passkey (FIDO2) | Yes | Yes | Yes |
An authenticator app is still a big step up from SMS. Use the app where an account offers nothing better, and use a key wherever the account accepts security keys.
Which YubiKey to buy
Prices are from Yubico's store. Pick the connector that matches your laptop and phone, then decide whether you need anything beyond FIDO2.
| Model | Price | Connectors | What it does |
|---|---|---|---|
| YubiKey 5C NFC | $58 | USB-C, NFC | FIDO2, U2F, Yubico OTP, TOTP codes, PIV smart card, OpenPGP. 100 passkey slots. |
| YubiKey 5 NFC | $58 | USB-A, NFC | Same as the 5C NFC with a USB-A plug. |
| Security Key C NFC | $29 | USB-C, NFC | FIDO2 and U2F only. 100 passkey slots. |
| Security Key NFC | $29 | USB-A, NFC | Same as above, older USB port. |
| YubiKey 5C | $65 | USB-C | The 5 Series feature set with no NFC. |
| YubiKey 5Ci | $85 | USB-C, Lightning | For older iPhones with a Lightning port. |
I'd pick the YubiKey 5C NFC. NFC lets you tap it against an Android phone or an iPhone, and the extra protocols cover cases the cheaper key cannot. Kraken, for one, accepts a passkey for sign-in, but the only hardware key its funding two-factor accepts is a YubiKey running Yubico OTP, which the Security Key series does not support.
The plain YubiKey 5C has no NFC. It costs more than the 5C NFC and cannot tap a phone, so skip it unless you want a key that lives in a laptop port.
How to set up a YubiKey, account by account
Register both keys on each account before you move on. Keep the second key somewhere safe away from home, so you can still get in when the first one is lost.
- 1For Google, open your Google Account, go to Security & sign-in, then 2-Step Verification, and add a security key. Google accepts any FIDO1 or FIDO2 key. Its help page warns you may need to wait 7 days before a newly added key works at sign-in, so do not delete your other methods on day one.
- 2For your Apple Account, open Settings on an iPhone, tap your name, then Sign-in & Security, Two-Factor Authentication, and Security Keys. On a Mac, the same path is in System Settings. Apple requires at least two keys and iOS 16.3 or macOS Ventura 13.2 or later on every signed-in device.
- 3For Bitwarden, go to Settings in the web vault, then Security, Two-step login, and choose Manage next to Passkey. Name the key, insert it, select Read Key, touch it, and save. Bitwarden offers this free on every plan, with up to 5 keys on a free account.
- 4On Kraken, add the key as a passkey for sign-in two-factor and your Master Key. If you want a hardware key on funding too, it has to be a YubiKey that supports Yubico OTP, such as the 5 Series.
- 5For everything else, look in each account's security settings for "security key", "passkey", or "WebAuthn", then save the backup codes each service gives you, on paper, with your second key.
Using a YubiKey on iPhone, Android, and Mac
On a laptop, plug the key in when the site asks and touch the metal contact on the key. On a phone, hold an NFC model against the top or back of the phone when the prompt appears. Yubico lists tap-and-go support on NFC-enabled Android and iOS devices for the 5C NFC.
If an account only offers six-digit codes, the free Yubico Authenticator app can store those codes on the key itself instead of on your phone. It runs on Windows, macOS, Linux, iOS, and Android, and the secret never leaves the key. This works on the YubiKey 5 Series, since the Security Key series has no TOTP support.
Don't lock yourself out
- Register two keys on every account, not only on Apple, which requires it.
- Keep printed backup codes for Google, Bitwarden, and each exchange in the same place as the spare key.
- Remove SMS as a fallback once both keys work. Every method you leave turned on is a way in, so an account is only as strong as its weakest one.
- Do not register the key on an account and then delete your only other method in the same session. Test a fresh sign-in first.
- Apple warns that losing every trusted device and every key can lock you out of your Apple Account permanently.
What a YubiKey does and does not protect for a bitcoiner
Exchange and email logins are a common way bitcoiners get robbed. Your email resets every other password, and an exchange account holds coins and your identity documents. A key that defeats phishing and SIM swaps closes two common ways into both. My SIM swap guide covers the carrier side of that attack.
A YubiKey does nothing for coins in self-custody. Those are protected by your seed phrase and a hardware wallet. The best use of a YubiKey is guarding the accounts you need until your bitcoin is off the exchange, and the email address that would let someone pretend to be you afterward.
YubiKey alternatives
Google sells its own Titan Security Key on the Google Store in USB-C and USB-A versions, both with NFC. Google's sign-in accepts any FIDO1 or FIDO2 key, so a Titan or a YubiKey does the same job there.
Nitrokey 3 is the pick if you want open-source firmware. Nitrokey publishes the code and ships signed firmware updates, and the key supports FIDO2, OpenPGP, and TOTP and HOTP codes.
A passkey stored on your phone or computer is the free option. It is FIDO2 and phishing-resistant too, but it lives on a device that can be stolen, synced, or compromised. A physical key keeps the credential on a chip that does nothing until you touch it.
Frequently asked questions
How do I set up a YubiKey with Google?
Go to your Google Account, then Security & sign-in, then 2-Step Verification, and add a security key. Insert or tap the key and touch it when asked. Add a second key the same way, and keep your other sign-in method for at least 7 days, since Google says a new key may take that long to work at sign-in.
Is the YubiKey 5C NFC worth it over the Security Key?
If you only need passkeys and two-factor sign-in on major sites, the $29 Security Key C NFC does the job. The $58 YubiKey 5C NFC adds Yubico OTP, stored TOTP codes, smart card, and OpenPGP. That matters for Kraken funding two-factor and for any account that only offers six-digit codes.
Does a YubiKey work with an iPhone?
Yes. An NFC model works by tapping it against the iPhone, and a USB-C model plugs into a USB-C iPhone. Apple lets you protect your Apple Account with security keys on iOS 16.3 or later, and requires at least two keys.
What happens if I lose my YubiKey?
Sign in with your second key or a backup code, remove the lost key from every account, and register a replacement. If you had only one key and no backup codes, you are at the mercy of each service's account recovery process, which is why you buy two.
Can I use a YubiKey with Bitwarden for free?
Yes. Bitwarden says two-step login with a FIDO2 security key is free for all users, with up to 5 keys on a free account and up to 10 on Premium.