Brand | Yubico |
---|---|
Series | YubiKey 5 NFC |
Item model number | Y-237 |
Hardware Platform | Mac |
Item Weight | 0.106 ounces |
Product Dimensions | 0.71 x 1.77 x 0.13 inches |
Item Dimensions LxWxH | 0.71 x 1.77 x 0.13 inches |
Color | Black |
Manufacturer | Yubico |
ASIN | B07HBD71HL |
Country of Origin | USA |
Is Discontinued By Manufacturer | No |
Date First Available | September 17, 2018 |
Other Sellers on Amazon
& FREE Shipping
80% positive over last 12 months
-
-
-
-
-
-
5 VIDEOS
-
-
Yubico - YubiKey 5 NFC - Two Factor Authentication USB and NFC Security Key, Fits USB-A Ports and Works with Supported NFC Mobile Devices - Protect Your Online Accounts with More Than a Password
- Free returns are available for the shipping address you chose. You can return the item for any reason in new and unused condition: no shipping charges
- Learn more about free returns.
- Go to your orders and start the return
- Select the return method
- Ship it!
Enhance your purchase
Color | Black |
Brand | Yubico |
Hardware Interface | USB 2.0 |
About this item
- Make sure this fits by entering your model number.
- SECURITY KEY: Protect your online accounts against unauthorized access by using 2 factor authentication with the Yubico YubiKey 5 NFC security key. It's the world's most protective USB and NFC security key that works with more online services/apps than any other.
- FIDO: The YubiKey 5 NFC is FIDO certified and works with Google Chrome and any FIDO-compliant application on Windows, Mac OS or Linux. Secure your login and protect your Gmail, Facebook, Dropbox, Outlook, LastPass accounts and more.
- FITS USB-A PORTS: Once registered, each service will request you to insert the YubiKey PC security key into a USB-A port and tap to gain access. NFC-ENABLED: Also get touch-based authentication for NFC supported Android and iOS devices and applications. Just tap & go!
- DURABLE AND SECURE: Extremely secure and durable, YubiKeys are tamper resistant, water resistant, and crush resistant. The YubiKey 5 NFC USB is designed to protect your online accounts from phishing and account takeovers. Proudly made in the USA.
- MULTI-PROTOCOL SUPPORT: The YubiKey USB authenticator includes NFC and has multi-protocol support including FIDO2, FIDO U2F, Yubico OTP, OATH-TOTP, OATH-HOTP, Smart card (PIV), OpenPGP, and Challenge-Response capability to give you strong hardware-based authentication.
Featured items you may like
- Amazon Basics Small Hard Shell Carrying Case for My Passport Essential External Hard DriveAmazon's Choicein Computer Hard Drive Bags & Cases
- Amazon Basics USB Type-C to USB 3.1 Gen1 Female Adapter - BlackAmazon's Choicein USB-to-USB Adapters
Product Description
|
|
|
|
---|---|---|---|
DurableWater and crush resistant - made from reinforced fiberglass material. |
Mobile FriendlyTap-and-go authentication for NFC-enabled Android and Windows 10 devices and applications. |
PortableEasily fits on your keychain and requires no battery or network connectivity. |
Simple, One-Touch OperationOnce registered, simply insert and tap your key to authenticate. |

![]() |
![]() |
![]() |
![]() |
![]() |
|
---|---|---|---|---|---|
YubiKey 5 NFC | YubiKey 5 Nano | YubiKey 5C NFC | YubiKey 5C Nano | YubiKey 5Ci | |
USB Port Type | USB-A | USB-A | USB-C | USB-C | USB-C • Lightning |
Form Factor | Keychain | Keychain | Keychain | Keychain | Keychain |
Mobile Authentication via NFC | ✓ | ✓ | |||
Water and Crush Resistant | ✓ | ✓ | ✓ | ✓ | ✓ |
Works with Google Accounts | ✓ | ✓ | ✓ | ✓ | ✓ |
Works with Microsoft accounts | ✓ | ✓ | ✓ | ✓ | ✓ |
Works with LastPass | ✓ | ✓ | ✓ | ✓ | ✓ |
Works with 1Password, and Keeper | ✓ | ✓ | ✓ | ✓ | ✓ |
FIDO U2F / FIDO2 | ✓ | ✓ | ✓ | ✓ | ✓ |
TOTP / HOTP / PIV / PGP | ✓ | ✓ | ✓ | ✓ | ✓ |
Have a question?
Find answers in product info, Q&As, reviews
Your question might be answered by sellers, manufacturers, or customers who bought this product.
Please make sure that you are posting in the form of a question.
Please enter a question.
Product information
Technical Details
Additional Information
Customer Reviews |
4.7 out of 5 stars |
---|---|
Best Sellers Rank | #37 in USB Gadgets |
Warranty & Support
Feedback
Customer reviews
Customer Reviews, including Product Star Ratings help customers to learn more about the product and decide whether it is the right product for them.
To calculate the overall star rating and percentage breakdown by star, we don’t use a simple average. Instead, our system considers things like how recent a review is and if the reviewer bought the item on Amazon. It also analyzed reviews to verify trustworthiness.
Learn more how customers reviews work on Amazon
Reviewed in the United States on September 27, 2019
Top reviews from the United States
There was a problem filtering reviews right now. Please try again later.
1) The product does not come with a manual. Instead, it points you to Yubico's Getting Started site which is not a helpful site. Trying to find further documentation using Yubico's support site is an exercise in frustration.
2) Getting the YubiKey 5 setup with 1Password is confusing, even for a tech-head like myself.
3) The YubiKey 5 does not work with 1Password. I can enable 2FA on my 1Password account using the YubiKey 5 and I can use it to unlock my account when using 1Password on a computer. However, I cannot unlock 1Password on my phone using the YubiKey because 1Password has not written the necessary code to allow 1Password to use the YubiKey 5's NFC feature. Since the YubiKey 5 obviously cannot be plugged into an iPhone, 1Password becomes completely unusable on iPhones.
4) Yubico advertises that the YubiKey 5 works seamlessly with password managers such as 1Password, but this could not be further from the truth. Enabling 2FA on my 1Password account using a YubiKey requires that I also use the Yubico Authenticator app. Rather than simply inserting my YubiKey into the computer and logging in, I am required to first insert the YubiKey, then open the Yubico Authenticator app, find the login I need a code for, copy that code to my clipboard, navigate over to 1Password, paste the code, and only then can I finally unlock the application. This is not a seamless process.
In order to improve, the YubiKey 5 needs to dramatically improve the quality of their setup documentation and support website. Yubico also needs to provide a much more honest description of the process involved in using the YubiKey 5 with password managers such as 1Password.
Until changes are made to the YubiKey 5, I definitely cannot recommend the product to anyone who uses 1Password.
In short, I think it's a really neat device, which can help improve your digital security, if you're willing to invest the time/energy to research it. I bet your identity is worth more than $45.
Pros:
* Very versatile, lots of features
* Cutting edge security, WebAuthn is now a web standard (March 2019)
* Backed by significant tech players
* NFC wireless connectivity
* Should work with most Android devices
* Durable build
Cons:
* Documentation is limited and scattershot, you will need to teach yourself
* More expensive than some alernatives
* Limited FIDO2/WebAuthn support right now (April 2019)
* Limited iOS/iPhone support right now
* Many overlapping, confusing tools available
* Only some functionality exposed in GUI tools, there is much, much more on command line and via APIs
* No firmware upgrades
* Can't backup or copy a YubiKey
* Closed source, proprietary design -- no possibility of independent audits
The documentation is admittedly scattershot, so here is a summary of what I've learned. Think of the YubiKey 5 NFC as having three separate, built-in apps: 1) FIDO, 2) CCID, 3) OTP. Each of these apps has multiple functions.
--1) FIDO app--
* FIDO2: The newest standard, supported by most web browsers now, expect to see more websites transitioning to FIDO2/WebAuthn logins in the coming years. DropBox and Google are two notable websites that support it today.
* U2F: The old pre-FIDO2 approach, partially supported by some browsers and websites.
--2) CCID app--
* OATH: Install the Yubico Authenticator to configure this. Similar to Authy, Google Authenticator, etc. TOTP provides time-based one-time passwords, HOTP provides counter-based one-time passwords. More secure replacement for the SMS- and email-based 6-digit login codes you may be receiving now, if you have 2FA enabled on your accounts.
* PIV smartcard: Can be configured for logging into some computers.
* OpenPGP: Useful for email encryption, signature verification, SSH logins.
--3) OTP app--
* You get two configurable slots, they can be: Yubico OTP, challenge-response, static password, or OATH-HOTP.
To summarize, you get FIDO2, U2F, OATH, PIV, and OpenPGP apps out of the box, plus you can choose how to configure two *additional* slots to suit your needs. One of them is pre-configured with Yubico OTP, which requires internet access and registration with Yubico.
The most useful feature to the average user will be the FIDO app, although currently (April 2019) there is almost nowhere to use it. Buying this today is like being on the bleeding edge, although Yubico contributed to the FIDO2 standards. WebAuthn means websites don't store passwords anymore (not even encrypted), and phishing becomes far more difficult, as your authenticator device is only associated with a single website. The idea is to use devices like the YubiKey, an optional PIN, as well as biometric data (fingerprints, iris scans, etc) to identify the user, instead of relying on a shared password. The YubiKey can store "unlimited" FIDO credentials.
The second most useful feature is the OATH app. To use this, you must install the Yubico Authenticator app on your computer or mobile device. When you insert the YubiKey, you will see the list of one-time passwords. However, there is a limit of only 32 slots. NOTE: OATH-HOTP uses a counter and will eventually roll over, so it has limited uses, but TOTP is time-based and should work indefinitely.
Equally useful is the static password option, which you can enable in an OTP slot. This lets the YubiKey "type" in a password on your computer, in many situations where other authentication isn't possible. For example, you can type your own easy-to-remember password, and then add the YubiKey static password at the end. This should work universally on devices supporting USB input.
The other options are more specific and for the advanced or power user with some IT background. Configuring OpenPGP properly is not trivial, nor is it likely to be used by the average person. However, if you are in IT or need the added security, you can add your encryption, signing, and even authentication keys to the YubiKey (once stored, they cannot be retrieved). I've successfully logged into SSH servers and committed to GitHub using this technique -- it works perfectly. You will need GPG or similar installed to configure this.
If you don't know what PIV smart cards are, you likely won't have a use for them, however you can configure Linux and Mac boxes to take advantage of this for logging in, as well as on Windows domains. I imagine this is more useful in large organizations.
The downsides are not inconsiderable. You are essentially trusting a closed, proprietary device, but it has been proven time and again that "security through obscurity" doesn't work. If there's a critical bug in the design, you are stuck with it, as there is no way to upgrade the firmware. You cannot retrieve secret data from the YubiKey, but this means you can't make a backup or copy once it has been configured. You need to duplicate the key *during* configuration, or save a record of all the secret data. Keep that in mind.
A final note is that the YubiKey has both USB and NFC connectivity. If your smartphone supports NFC, you can simply hold the YubiKey against it to authenticate. If you can't use NFC or don't want it, you can disable it with the YubiKey Manager. You can selectively disable USB and NFC for each app. NOTE: you can buy a cheap USB OTG adapter and still use your YubiKey with your smartphone, to an extent.
If you are serious about 2 factor authentication, then this is a great product!
Most large companies such as Microsoft and Google will support this key natively within their account security settings. You can only count on support growing in the future. The odds are high that iOS 13 will introduce native support for FIDO2 authentication within Safari over NFC... and Yubico has a lightning version in the works currently.
That being said I’m puzzled at the one-star reviews. It shouldn’t take hours or even days to plug in a device to your USB port, and paying for LastPass Premium has absolutely nothing to do with this product as one reviewer had mentioned.
Update: iOS now supports YubiKey and other security keys such as Google Titan. Purchasing this particular model will allow you to authenticate via NFC (tapping the key against the back of your phone). If this doesn't sound appealing to you there does exist another model which plugs into the lightning port of your iOS device. You can enable this now on most major social networks (Twitter, Facebook, etc). If you're unsure of where to start, try security settings for the account that you're interested in adding extra protection to. We're probably still a year or two off from this becoming what I'd call mainstream... but it does seem like the future if you're interested in test driving something new!
Top reviews from other countries

El primer punto a tener en cuenta es que a pesar de que no es necesario técnicamente, la compra de otra llave idéntica es casi obligatoria. Cuando compramos una llave física para almacenar las contraseñas y los algoritmos, tenemos mucha seguridad en ellas, pero si se nos pierden, nos rompen o sufren un acciente, todas las contraseñas han desaparecido para siempre. Si cometes el error de tener una sola copia, tendrás un gran problema, de ahí la compra de un par siempre. Teniendo en cuenta esto, si solo tienes el dinero para comprar una, no recomiendo que la compres. Si necesitas esa seguridad realmente, reune primero dinero para un par, y luego adelante.
El segundo punto a destacar es la NO compatibilidad con el inicio de sesión inteligente de Windows 10. El producto NO es compatible con Windows Hello, ni con el inicio de sesión mediante targeta inteligente, ni con el cifrado BitLocker nativo de Windows, a pesar de que existen proyectos antiguos que tratan de solucionar el problema con el inicio de sesión, y otros que tratan de dar solución al de BitLocker
Las páginas mas famosas como Google, son compatibles con el uso de estas llaves para iniciar sesión, pero si lo único que quieres salvaguardar es la cuenta de Google, sigo sin recomendar la compra.
El objetivo de estas llaves, no es otro que aquellas personas que disponen de información sensible, bien sea empresarial, gubernamental o de otros ámbitos.
Otro error típico es pensar que con esta llave se acaban las contraseñas. Lo único que se acaba son los sustos si una de tus contraseñas es filtrada en alguna filtración masiva de edatos, siempre y cuando en esa página dispongas de la opción de usar esta llave como segundo factor de autenticación, cosa muy poco probable.
Lo mas coerente sería por ejemplo, usarla en sitios como Bitwarden, o algún otro gestor de contraseñas que soporte dicha característica.
El uso con los dispositivos iOS es imposible. Si tienes un iPhone, no vas a poder usar el NFC, y no podrás usar la llave para absolutamente nada. Desconozco si con Android se puede, pero creo que sí.
Fisicamente, se nota robusta, pero no lo suficiente para mi gusto. si la conectas a un USB y por accidente presionas el conector, es posible que rompa. El botón que incluye en el medio del dispositivo, es un botón táctil sin ningún tipo de detección de huellas. Dicho botón puede tocarse ligeramente para que el Yubiko use el primer slot, o mantenerlo pulsado uno o 2 segundos para usar el segundo slot.
Además dispone de un pequeño agujero mediante el cual hacerlo formar parte de un llavero.
Y para terminar, no puedo aconsejar la compra del producto si tienes iOS como sistema operativo, ni si tu objetivo es usarlo como una Smart card, ni para compatibilidad nativa con Windows, ni para comprar una sola unidad. si tu caso no está entre estos, entonces sí la recomiendo. Yo he tenido que devolverla.
Espero haber sido de ayuda. Si es el caso, te animo a que lo indiques pulsando en el botón "útil" justo abajo.

WINDOWS 10 LOGIN - You can add several Yubikeys which is nice. You still have to type in your Windows username and password, if an enrolled Yubikey is not present in one of your USB ports, Windows 10 won't log you in (which is cool). However, it only works with local accounts, not domain accounts or Microsoft ID. So if you login to your laptop or PC with your Microsoft Account (email address) then you'll have to convert your account to local (which is actually really easy and it just means your wallpaper and stuff won't sync to other Windows 10 machines). Secondly, you'll need to install the Yubico Login Configuration tool to set this up.
AMAZON SHOPPING/PRIME - You can add several Yubikeys which is great but you can't just login by having the key plugged into a USB port and touching the button. You still put in your credentials and then use the MFA code from the Yubico MFA app (which lists the codes associated with your key). So basically, I ditched the Microsoft Authenticator app, the Google Auth App and another one I was using, installed the Yubico auth app and enrolled MFA again for my critical apps and services.
PAYPAL - You can only add one MFA method at a time and have Mobile SMS as a backup. So you have a choice, risk a single Yubikey and if you loose it, you're stuck. Or, use a weak mobile secondary text message service as a recovery option! - Bit pointless in my opinion!
LINKEDIN - You can only have one MFA method - Again, single Yubikey and it's not a case of plugging it in/tapping it on your phone via NFC. You still have to enter your creds, unless auto-saved/populated by the app or device or browser and then copy the MFA code from the Yubico MFA app (desktop or mobile).
FACEBOOK - The most accommodating and best experience, second only to Windows 10. You can several keys and it's just a touch to login. You must have an MFA auth app setup as a backup which can be anything, but as I was using the Yubico MFA app I just used that for FB too. You're not force to use a weaker mobile SMS as a backup/recovery option and you're not asked for creds all the time.
RECOMMENDATION - Use in conjunction with a great credential manager like LastPass or KeePass - Thank me later!
I hope that all makes sense, in summary it does add security but that comes with complexity. The amount of security you get depends on what website, app or service you are looking to integrate this with. I think these are over priced to be honest, you would get much better value from having LastPass + LastPass MFA app, having a different robo-generated password for each thing you use and ditching mobile recovery options and all other MFA apps, plus you can't miss-place a password keeper solution.
IMPROVEMENTS NEEDED;
1) Prompt, yes/no, allow/deny in the Yubico MFA app(s).
2) Better integration and awareness with common third parties.
3) Further simplification, although easy for me, my mum would give this 5 minutes of effort and throw it in the bin.

>> This turned out to be a problem with Google Chrome running on a dual display Windows 10 system. <<
Yubico is working with Google and Microsoft to improve security, but they don't do a very good job of explaining how their security keys are best used. Maybe it's a language thing, or maybe they know so much about this stuff that they can't explain things in a simplistic manner. Who knows. I'm sure we'll get there in the end, but I can't recommend this product at the moment. Check back in 6 months and I'll let you know if I've changed my mind.
* Update: I've studied countless articles and YouTube videos, so I'm now more educated than I was. However, I've only upped my rating by one star. Some might consider that a 100% improvement I suppose.

Auf dem Smartphone werde ich ständig nach einem Passwort gefragt, welches ich nicht setzten kann. So kann ich nichts Anlegen. Damit fällt ein großer Anwendungsbereich weg.
Für Windows 10 muss eine ältere Version des YubiKey Managers installiert werden. Diese verlangt nach einer .Net Version, welche Windows wiederum nicht installieren will.
Eine Katastrophe auf ganzer Linie. Rausgeworfenes Geld. Hätte ich es mal gleich innerhalb der 14 Tage zurückgeschickt.

c'est pourquoi utiliser une clé "physique" pour se connecter semblait une bonne idée, j'ai fait quelque recherches, et j'ai vu que yubico avait fait ses preuves dans ce domaine, je me suis donc procuré cette clé.
au début tout a bien marché, je l'ai fait reconnaître par mon compte Dropbox et ma page Facebook. j'ai fait quelques essais sans problème, vous vous connectez normalement à vos comptes (ici Facebook et/ou Dropbox) vous entrez l'identifiant et le mot de passe et le service vous demande d'insérez la clé puis d'appuyer sur le petit disque (ce n'est pas un capteur d'empreintes mais un capteur capacitif) et si tout se passe comme prévu vous êtes connecté.
ensuite j’éjecte proprement la clé via l'option d'ejection de windows 10 et quelques heures plus tard, j'essaie de nouveau. et là NI Facebook, NI Dropbox ne reconnaisse matériellement la clé, il disent qu'il s'agit d'une clé différente de celle enregistrée le matin alors que windows 10 la voit toujours correctement et dis que le périphérique marche.
je teste la clé avec les utilitaires yubico (tout est en anglais et vous n'avez aucune notice), il la reconnaisse parfaitement et ne détecte aucun problèmes, je re-tente donc ma chance, (toujours après une ejection "propre") et là rien à faire la clé est reconnue comme une clé différente de celle enregistrée. heureusement pour moi, je n'avais pas désactiver les autres options de connections (avec authentification par SMS).
sur Dropbox j'ai pu désactiver la clé (je me reconnecte donc comme avant) par contre sur Facebook impossible de supprimer la clé des méthodes de connection, à chaque fois je suis obligé de faire "autre méthode" et d'utiliser un code SMS.
j'ai eu du nez de ne pas l'utiliser comme moyen de me logger dans windows, sinon j'était bon pour une réinstallation totale de mon système avec perte de données.
bref un concept sympa mais qui laisse a désirer matériellement parlant. à 55 euros en moyenne la clé (et encore yubico vous conseille d'en avoir 2 ou trois au cas ou vous auriez un problème de reconnaissance) c'est pas encore ça, la mienne n'as pas tenue une demie-journée alors que je respecte les procédures à la lettre et que je ne fait que des ejections "propres" j'imagine un(e) débutant qui l'enlève et la réinsère sans prévenir (et qui sans sers sur tout ses comptes), du coup retour amazon.