Yubikey user guide
Welcome! This page covers information about your new YubiKey Security Key! It outlines what the YubiKey is, what it is used for, why you should use it, and it includes step-by-step instructions on how to set-up and use it with your Google account.
What is a YubiKey?
A YubiKey is a phishing-resistant, physical security key used in Multi-Factor Authentication for websites and other devices.
But what does that actually mean?
It means that this small device will prevent people from accessing your online accounts even if they know your email/username and password. The Yubikey adds a fast, simple step when logging into your account that is impossible for someone to virtually steal as it is a physical item that you have. They are also water and crush-resistant, last a really long time, and can be used on all of your accounts!
You received one of two options pictured left.
Why would I need this in my job or personal life?
Passwords used to be ideal for keeping accounts secure. Today, they are only one part of your personal security. A password can be cracked easily and quickly, especially if you are not using strong passwords. Your YubiKey, or other 2-factor authentication method, slows down and often completely blocks someone from accessing your account without your permission or knowledge.
Want to see how long it would take someone to crack your password? Check out Security.org’s How Secure Is My Password tool and find out!
What websites can I use my YubiKey for?
You can use the same Yubikey for multiple websites, the same way you can use the same phone/app to provide two-factor authentication for multiple websites. Although not every website currently supports physical security keys, you can check the security settings of individual accounts/websites to check if they support physical security keys.
Some of the websites that currently support YubiKeys are: Google Accounts, Microsoft, Duo Security, LastPass, Instagram, Facebook, Twitter, Apple Cloud, Yahoo, Youtube, ID.me, Reddit, Twitch, Epic Games, Nintendo, Electronic Arts (EA), Microsoft Edge Browser, Dropbox, Kickstarter, Blogger, AOL, Login.gov, GoDaddy, Shopify, Opera, GitLab, GitHub, FineFriends, Binance, Keeper Unlimited & Family, Linux, and many more.
A full list of websites including instructional set-up videos can be found here.
How do I set up my YubiKey?
YubiKeys are quick and easy to set up. This example will focus on Google accounts, but you can find instructions to set up your other accounts by visiting the YubiKey Setup Page, choosing your YubiKey type, and following along.
You can follow along with the YubiKey instructional video for Google accounts. Scroll down to “Setup Instructions” for the step-by-step video.
To begin, have your YubiKey Security Key, laptop or desktop computer, and your Google Account available.
1) Log into your Google Account and click your picture in the top right corner, then choose
Manage your Google Account.
2) In the top left corner of the next page, choose the Security option.
3) Under How you sign in to Google, choose 2-Step Verification.
4) A Welcome page will pop up first. Choose Get started.
5) Show more options will give you two additional options for 2-factor authentication. Choose Security Key then Next.
6) A pop-up will appear to confirm that you want to set up a security key for your specific email, then another to allow Google to see your YubiKey. Choose OK on both screens.
7) You will be instructed to Touch your security key. The part of your key that you touch depends on the YubiKey you received.
- YubiKey 5C: If your YubiKey has two gold bars on either side, you will place your fingers on both bars at the same time. You do not need to squeeze.
-YubiKey 5 NFC: If your YubiKey has a solid gold circle and “y” in the center, you will place your finger on the gold circle.
8) Once you have successfully registered your YubiKey, you will be asked to name the key. You can choose a simple name such as “Primary Key.” Be sure to keep it vague enough where you know which key it is referring to, but others cannot easily guess which physical key it is.
9) Set-up additional verification steps. There will be a section for you to add more second steps to verify your identity in the event that you do not have your YubiKey or misplace it. These include adding a phone number to get text notifications, using the app on your phone to confirm your identity, or using an authenticator app. Choose an additional verification method and follow the instructions on the screen. Learn more about Google’s 2-Step Verification for more information covering the different types of verification you can use for your account.
How do I use my YubiKey to log into my Google account?
Follow along with YubiKey’s instructional video.
1) Log in to your Google account with your email/username and password.
2) You will see a screen asking you to insert your security key into the USB port.
Plug your YubiKey into the USB port.
3) You will be instructed to Touch your security key. The part of your key that you touch depends on the YubiKey you received.
- YubiKey 5C: If your YubiKey has two gold bars on either side, you will place your fingers on both bars at the same time. You do not need to squeeze.
-YubiKey 5 NFC: If your YubiKey has a solid gold circle and “y” in the center, you will place your finger on the gold circle.
4) You’re in! Quick and easy!
What happens if my YubiKey is lost or stolen?
As soon as you notice that your YubiKey is missing, log into your account(s) using your alternative verification method set up earlier. Follow the previous instructions to get to your Security and 2-Step Verification settings.
1) Next to the security key you want to remove, select X.
2) You will receive a pop-up asking if you wish to Remove this security key?
Select Remove.
If you find your YubiKey later or wish to add a new key, it can be used again by following the original set-up instructions.