-
Enroll fingerprints on your YubiKey Bio and add compatible services
Home » Setup » Get started with YubiKey Bio Series
A few tips before you get started
Get ready to enroll fingerprints on your key and then add your YubiKey to your online accounts.
Have your key ready
Have your key ready to plug into your computer, preferably the same way you will plug it in later when you authenticate: i.e., either with or without an adapter.
Get your trusted device ready
Use a device that is not public and has an up to date operating system, this can be a computer running either Windows 10 (1903 or later) / Windows 11, or any of the following with the Chrome browser 93 or later: macOS (Catalina or later), Chrome OS 93 or later, Ubuntu 18.04 or later.
Do you have a spare key?
Yubico recommends that you add a backup YubiKey to any account to which you have added your primary YubiKey. This can be a YubiKey Bio Series key, or alternatively any YubiKey 5 Series or any Security Key by Yubico. Read more about backup (spare) YubiKeyhere.
Fingerprint enrollment
Enrolling fingerprints on your YubiKey Bio varies depending on whether you are running Windows or macOS or Linux or Chrome OS.
Windows 10 and Windows 11
Use Windows Sign-in options.
Click the button below to open the settings.Watch enrollment video >
macOS / Linux / Chrome OS
Use Chrome 90 or later.
To enroll your first fingerprint click the button below. For additional fingerprints see the enrollment videoWatch enrollment video >
Desktop Yubico Authenticator
Desktop Yubico Authenticator5.1 and later enables you to enroll and manage fingerprints on all supported operating systems. Use the Yubico Authenticator for Desktop on your Windows, Mac, or Linux computers. Note that on Windows 10, the Yubico Authenticator must be run in Administrator mode. Click the button below to download Desktop Yubico Authenticator
Watch enrollment video >
Compatible accounts and services
YubiKey Bio can be used with any account or service that supports FIDO2/WebAuthn or FIDO U2F. To find compatible accounts and services, use the Works with YubiKey snapshot below. For the full list of services compatible with all YubiKeys, see ourWorks with YubiKeypage or contact your service provider
Each YubiKey must be registered individually. For each service you set up,have your spare YubiKey ready and add it right after the first onebefore moving to the next.
The YubiKey setup process is determined by the service provider, sosetup instructions will vary slightly from service to service. In some cases, a service will require the use of Yubico Authenticator. If so, the tool below will prompt you.
Frequently asked questions
- Three short flashes of amber LED, the LED closest to the USB connector: The fingerprint was not successfully matched to an enrolled fingerprint template.
- Constant slow flashing of amber LED: The YubiKey Bio is either in biometric blocked state, see this question, alternatively no fingerprints have been enrolled on the YubiKey Bio. To enroll fingerprints see this section
- Rapidly flashing green LED, the LED closest to the fingerprint sensor: Biometric touch (fingerprint) required, touch the sensor pad and bezel ring with a finger which print you have enrolled. The key flashes about four (4) times asecond. For comparison, this is twice as fast as on a YubiKey 5 Series device requesting touch
- Slowly flashing green LED: No biometric touch required, touch the sensor pad and bezel ring with any finger. For comparison, this is the same frequency as on a YubiKey 5 Series, flashing about twice a second
You can enroll a total of 5 fingerprints. To manage existing, and enroll additional, fingerprints on:
- Windows 10 and Windows 11
- navigate to Setting/Accounts/Sign-in options/Security Key/Security Key Fingerprint, select Fingerprints and follow the instructions or;
- seethis part of the enrollment video
- Chrome or a Chromium-based browser on macOS, Linux, and Chrome OS:
- navigate to chrome://settings/securityKeys , select Fingerprints and follow the instructions or;
- seethis part of the enrollment video
- Desktop Yubico Authenticator
- navigate to Configuration/Fingerprints, select Add and follow the instructions or;
- seethis part of the enrollment video
After 3 unsuccessful attempts to authenticate using biometrics your YubiKey Bio will cease to prompt for the fingerprint and will fall back to PIN and regular touch, the primary authentication mechanism. The blocked biometrics state is indicated by a constant slow flashing of the amber LED, the one closer to the USB-contact.
To unblock biometrics, do the following:
- Enter the PIN for your security key.
- When the green LED flashes, touch the bezel ring on your key.
Note that if you are not in the biometrics blocked state, the browser will ask you to authenticate using biometrics.
Fingerprint authentication could stop working for a number of reasons:
- Wipe the sensor clean with a clean cloth and ensure your hands are moisturized. To learn more about how to clean the sensorread more here.
- If the key’s amber LED is flashing constantly, see the section above on “How do I unblock biometrics on my key?” for help
- If the key is still flashing amber, see sectionFingerprint enrollment, to find the correct menu to manage fingerprints and make sure you have fingerprints enrolled.
- If none of the above solutions resolve your issue,contact the Support team.
Reset is a security feature for wiping all your information off your key. This is recommended when you no longer plan to use the key or need to return it to whomever issued it to you. When the key is reset the following happens:
- All FIDO2 credentials (both discoverable and non-discoverable) are removed and accesswith this keyto accounts or services to which it has been added is no longer available.
- Accesswith this keyto the U2F sites where it was registered is no longer available.
- The PIN is removed.
- All stored fingerprints are removed.
- Yubico always recommends adding two keys to each of your online services and accounts; one primary and one secondary as backup in case the primary is lost. Adding a second key is done exactly the same way as adding your primary key. Yubico recommends that you add it at the same time as you add your primary key.
- If a key is lost, remove it from the associated account(s) and add a new YubiKey to the associated account(s) to ensure you have at least one backup key associated with the account.
- Your backup key can be any YubiKey with the FIDO2/WebAuthn or FIDO U2F protocol enabled, therefore it can be either a key from the YubiKey 5 Series, a Security Key Seriesby Yubico or a YubiKey Bio Series key. Note that because the PIN, and in the case of a YubiKey Bio Series key the fingerprint(s), are associated with the individual keys, it is necessary to set a PIN or enroll fingerprints on each backup security key individually.
For more information and guidance on backup keys, please seehttps://www.yubico.com/spare/
See which platforms are supported in the sectionGet your trusted device ready.
Mobile operating systems such as iOS and Android do not support CTAP2.1, the standard on which YubiKey Bio bases its implementation.
FAQs
Get started with YubiKey Bio Series? ›
While expensive, this little device performs multi-factor authentication (MFA) using your fingerprints, which makes it much harder for bad guys to take over your accounts. It's missing some advanced features found in other YubiKeys, but if you need biometrics, it's an excellent choice.
How do I use my YubiKey for the first time? ›- Plug in your YubiKey.
- Go to Yubico.com/setup and click your device.
- In the Compatible accounts and services section, browse the list of supported apps and services, and select the ones you want to secure with your device.
- Your selection will appear in a list next to the available apps.
While expensive, this little device performs multi-factor authentication (MFA) using your fingerprints, which makes it much harder for bad guys to take over your accounts. It's missing some advanced features found in other YubiKeys, but if you need biometrics, it's an excellent choice.
How to use YubiKey Bio with iPhone? ›On iPhone or iPad:
Tap your name, then tap Password & Security. Tap Add Security Keys, then follow the onscreen instructions to add your keys. At the prompt, plug in or tap your Security Key to the iPhone. Note that plugging in your YubiKey requires you to also physically touch the key.
The Security Key Series differs from a YubiKey 5 Series in that it comes only with the FIDO (FIDO2/FIDO U2F) protocol and the non-Enterprise Edition does not have a serial number. It is only available in USB-A + NFC and USB-C + NFC form factors.
Does a YubiKey need to be plugged in all the time? ›No, you only need to insert your yubikey when you are prompted to do so during login.
Do I still need a password with YubiKey? ›YubiKeys make passwordless possible
Passwordless can be achieved using legacy Smart Card protocols, or modern FIDO2 / Passkey authentication secured by PIN or biometric identification. The multi-protocol YubiKey offers total flexibility, and can store up to 100 passkey credentials.
YubiKey Bio is a FIDO token for strong, passwordless two-factor authentication with biometric function. It protects against phishing and MitM attacks.
What is the lifespan of a YubiKey? ›A Yubikey will essentially last forever, and if you stay clear of the insanity that is Passkeys its Webauthn element can support an infinite number of websites.
Does YubiKey Bio have NFC? ›The YubiKey Bio does not have NFC capabilities. The YubiKey Bio can be used with mobile, but it is reliant on mobile operating system support as well as on browser support for the FIDO protocols.
Which YubiKey is best for iPhone? ›
Choose the right security keys
Security Keys for Apple ID works with any FIDO® Certified security key. Some good examples include: YubiKey 5C NFC (works with most Mac and iPhone models) YubiKey 5Ci (works with most Mac and iPhone models)
So, what happens if you lose your YubiKey? In that case, you can still use your Authenticator app (phew!). While you can't create a backup YubiKey, you can always contact Yubico to get a replacement key.
Where to hold YubiKey on iPhone? ›iPhones. Hold your YubiKey along the top rear edge of the phone, as illustrated below.
Which YubiKey is best for home use? ›The Yubikey Security Key C NFC is our top pick for most people. It features excellent build quality, and its USB-C connector means it works on just about every new device. It also has NFC support, which lets it authenticate on mobile devices that lack a USB port.
Does YubiKey remember passwords? ›The YubiKey works with Password Safe to protect your passwords using two-factor authentication (2FA). Both a master password and a YubiKey are needed to enable access to your Password Safe file, which contains the usernames, websites, passwords and other information for all of your online accounts.
Is YubiKey more secure than 2FA? ›This is because hardware 2FA devices like Yubikey are specifically designed for this purpose and are generally considered to be more secure. Probably the biggest protection tools like the Yubikey offer are phishing protection. TOTP can be phished, Yubikey makes this much harder.
How do I know if my YubiKey is working? ›- Insert the YubiKey into the computer.
- Click the Yubico OTP button. The following screen, "Test your YubiKey with Yubico OTP" shows the cursor blinking in the Yubico OTP field.
- Tap the metal button or contact on the YubiKey. The OTP appears in the Yubico OTP field. ...
- Click Validate.
On a computer, insert the YubiKey into a USB-port and touch the YubiKey to verify you are human and not a remote hacker.
Do you tap or insert your YubiKey? ›You can simply insert the key into the port on your device, press the button on the hardware, and you should be granted access if you are an authorized user of the account or device. With an NFC-enabled device, you can tap the YubiKey against the phone to complete authentication.
Does YubiKey require an app? ›Some services require an authenticator app. Use the Yubico Authenticator app to securely store your credentials on a YubiKey opposed to your mobile phone, so that your secrets cannot be compromised.