YubiKey PIN: What It Is and How to Configure It with Yubico Authenticator
⚠️ YubiKey Manager GUI is no longer officially supported
Yubico discontinued the YubiKey Manager graphical interface in 2025. The recommended official alternative is Yubico Authenticator. This guide has been updated with the correct instructions for the current app.
The YubiKey PIN is the code that protects access to credentials stored on your security key. It is not your account password — it is the password for the key itself. Without it, some services won't let you authenticate even if you have the YubiKey in your hand.
What is a YubiKey PIN?
When you register your YubiKey with a service like Gmail or Bitwarden, the key stores a credential inside its memory. The FIDO2 PIN protects access to those credentials — it acts as a second layer of security on top of the key itself.
The system asks for it in two situations: when you register the key for the first time with a service that requires it, and when the service requires additional verification before authenticating you.
Most YubiKeys don't come with a factory PIN
This surprises many people: most security keys, including most YubiKeys, are sold without any PIN configured. A single touch is enough to authenticate — no PIN, no fingerprint, nothing else. Only Yubico's Enhanced PIN line requires a PIN from the factory; the rest of the lineup, including the standard YubiKey 5 NFC, is sold without one.
This has a direct consequence: whoever has the key in their hand is, in the service's eyes, the legitimate owner. FIDO2 distinguishes between two levels of verification — "user presence" (just touching the key is enough) and "user verification" (you need to prove who you are, with a PIN or fingerprint). Both levels carry the same certification stamp, but only the second makes your key a true authentication factor, not just "something you have".
What happens if you don't configure it?
It depends on the service. Many work without a PIN — you simply insert the key, touch the golden contact and you're done. But some services — especially corporate environments and certain password managers — require it. If you try to register the key without a PIN configured, the process fails.
ℹ️ Better to configure it from the start
Don't wait for a service to require it. Configuring the PIN before registering the key anywhere is the recommended practice — and it takes less than a minute.
How to configure the PIN step by step
The PIN is configured from Yubico Authenticator, Yubico's official app for managing the key from your computer.
Available at yubico.com/products/yubico-authenticator. Compatible with Windows, macOS and Linux.
Yubico Authenticator detects the key automatically and displays the model in the left panel.
In the right panel you'll see the MANAGE section with the Set PIN option — FIDO PIN protection.
Choose a PIN you'll remember. It can include letters and numbers. Write it down somewhere safe — in your password manager or on paper kept in a physical location.
⚠️ Attempt limit — critical
If you enter the PIN incorrectly 8 times in a row, the FIDO2 module locks permanently. There is no recovery possible without a Factory reset, which erases all registered credentials. Save the PIN from the start.
Why sometimes they don't ask for your PIN even though you've set it?
Configuring the PIN doesn't guarantee that a service will ask for it. The decision is not yours — it's the website's own choice. When you log in, the service sends a parameter called userVerification with one of three possible values: with "discouraged" the PIN is not requested even if you have one; with "preferred" (the most common case) it's only asked if you've configured one; only "required" makes it truly mandatory.
In practice, this means that if you haven't configured any PIN, not even the "preferred" value will ask for it. And even if you have a PIN, a service with "discouraged" won't request it either. There is a way to bypass this — we explain it just below.
alwaysUV: how to force your PIN to always be requested
If you want your YubiKey to require a PIN always, regardless of what each service decides, there's an option called alwaysUV (user verification always on). When enabled, the key asks for a PIN in all cases — even if the service sends "discouraged".
🔑 Enable alwaysUV from the terminal
On a standard YubiKey 5 you need to enable it manually with the ykman command-line tool:
ykman fido info — checks the current status
ykman fido config toggle-always-uv — enables or disables the option
On the Bio series and Yubico's Enhanced PIN line, alwaysUV comes enabled from the factory. Note that on older Windows versions (10 22H2 and early versions of 11) this combination could cause the screen to keep alternating between asking for a touch and asking for a PIN — a problem already resolved since Windows 11 23H3.
YOU MIGHT BE INTERESTED
The first thing you should do when you receive a YubiKey
What PIN should you choose?
The FIDO2 PIN can be between 4 and 63 characters. It can include letters, numbers and special characters — it's not just numeric like a bank card PIN.
Choose something you can remember but that isn't obvious. Don't use the same PIN as your email password or a simple sequence like 1234. An 8-12 character PIN with letters and numbers is secure enough for daily use.
What if you forget your PIN?
If you exceed the attempt limit or simply can't remember the PIN, the only solution is to do a Factory reset from Yubico Authenticator — Home → Factory reset. This restores the key to factory settings and erases all registered FIDO2 credentials.
After the reset you'll need to re-register the key with all the services where you had it configured. That's why it's so important to save the PIN from the beginning.
⚠️ Without a saved PIN, reset is inevitable
A Factory reset isn't the end of the world — the key still works afterward — but you'll have to repeat the registration process with each service. Save your PIN in your password manager right now.
FIDO2 PIN vs other YubiKey PINs
The YubiKey has several independent modules, each with its own PIN. For the basic user only the FIDO2 one matters — the others are for advanced or corporate uses.
| Module | What it's for | Do you need it? |
|---|---|---|
| FIDO2 | Passkeys, authentication on Gmail, GitHub, Bitwarden, etc. | ✅ Yes — basic user |
| PIV | Digital certificates, smart card, corporate access | ⚠️ Professional use only |
| OTP | One-time password when touching the golden contact | ❌ Rare in daily use |
Frequently asked questions
Is the YubiKey PIN the same as my password?
No. They are completely different things. Your password protects access to your account with a service. The YubiKey PIN protects access to credentials stored inside the key. You can change one without affecting the other.
How many attempts do I have before it locks?
8 consecutive failed attempts lock the FIDO2 module permanently. There is no way to unlock it without doing a Factory reset, which erases all registered credentials. A correct attempt resets the counter to zero.
Can I change the PIN after configuring it?
Yes. In Yubico Authenticator → Passkeys → Set PIN you can change the PIN anytime. You'll need to enter the current PIN to be able to change it.
Do all YubiKey models have FIDO2 PIN?
Yes, all models compatible with FIDO2 — YubiKey 5 NFC, YubiKey 5C NFC, Security Key NFC and Security Key C NFC — support FIDO2 PIN. Older models with U2F only do not support it.
Why won't a service ask for my PIN if I already have it configured?
Because the decision to require it depends on the service itself, not your key. If the service sends the "discouraged" value, it won't ask for a PIN even if you have one — unless you enable alwaysUV on your YubiKey to force it always.
YOU MIGHT BE INTERESTED
What is 2FA and how to protect your accounts with YubiKey?
