Two-Factor Authentication

YubiKey 5 NFC Setup Guide

A physical security key that makes phishing attacks nearly impossible.

Visit YubiKey 5 NFC →
Why we recommend this

Unlike codes from an app, a YubiKey verifies the exact website you're logging into, which means it cannot be tricked by fake login pages. For families who want the strongest possible protection on their most critical accounts, this is the gold standard.

Price
$50 (buy 2)
Platform
All
Best For
Maximum security, preventing phishing
Difficulty
Moderate

Setup Guide

1

Buy two YubiKeys

Always buy a pair — one as your primary key, one as backup stored in a safe place. Order directly from yubico.com and never from third-party resellers.

Step 2 — YubiKey 5 NFC unboxed next to a laptop USB port
3

Register with Google Account

Go to myaccount.google.com > Security > 2-Step Verification > Add security key, plug in your YubiKey, and follow the prompts, touching the gold circle when it flashes.

Step 3 — Google Account security key registration flow
4

Register with Microsoft Account

Go to account.microsoft.com > Security > Advanced Security Options > Add a new way to sign in, and choose security key.

Step 4 — Microsoft Account add security key screen
5

Register with your password manager

Both 1Password and Bitwarden support YubiKey. Go to their Security settings and add it as a 2FA method.

Step 5 — Password manager security settings adding a YubiKey
6

Register your backup key

Repeat the registration steps with your second YubiKey, then store the backup in a fireproof safe or safety deposit box.

7

Enable NFC tap on iPhone

Tap the YubiKey to the top of your iPhone to use it via NFC, and install the Yubico Authenticator app for accounts that need it.

8

Test login

Sign out of Google, sign back in, and when prompted, touch the gold circle on your YubiKey. It should complete instantly.


Do's and Don'ts

Do

  • Always buy and register 2 keys
  • Store backup key somewhere secure and physical
  • Register both keys on every important account
  • Keep YubiKey on your physical keychain for daily carry
  • Register with Google, Microsoft, and your password manager first

Don't

  • Don't buy from unofficial resellers — counterfeits exist
  • Don't lose both keys at once
  • Don't register only one key
  • Don't store both keys in the same location

Pro Tips

Pro Tips

  • YubiKey cannot be phished — it verifies the exact website domain, so fake login pages cannot steal your code.
  • The NFC feature works with iPhone 7+ and most Android phones.
  • For iPhone NFC: tap the YubiKey to the top center of the phone.
  • If you travel, keep your primary key on your keyring and your backup key at home.

Frequently Asked Questions

What is FIDO2/WebAuthn?
The technical standard that makes YubiKey phishing-resistant — it verifies you're on the real website before authenticating.
What if I lose my YubiKey?
Use your backup key to remove the lost key from your accounts.
Will it work with all websites?
Most major services support it, including Google, Microsoft, GitHub, Dropbox, Bitwarden, and 1Password.
Do I need it if I already use Authy?
Authy is great for most people. YubiKey is for higher-security needs or anyone who wants the strongest protection available.
Can I use it on my phone?
Yes — via NFC tap or with a USB-C adapter.

Resources

Something wrong? Just reach out.

Dire situation, confused, not sure where to start — send us a note. No consulting pitch, no sales call. We read every message and point you in the right direction.

Real people, real responses No pitch, no upsell Free, always
Send us a note →