The One Assumption Worth Checking First
Two YubiKeys almost always means one primary and one spare — that part's right. The part worth checking is what "spare" means in practice. Yubico's own guidance on this is blunt: a spare key that isn't registered to your accounts is of no help to you if you lose the primary. A second key sitting in a drawer, never enrolled anywhere, isn't a backup — it's just a second unused device that happens to be identical to the one you lost.
The correct model: both keys get registered to every account, at the same time, during initial setup — not "register the primary now, add the spare later." Later is exactly the moment that tends not to arrive before the primary goes missing.
What a YubiKey Actually Does
A YubiKey isn't one authentication method — it's several, bundled into one USB device, and which one gets used depends on what the account you're registering it with supports:
| Protocol | Where it's used |
|---|---|
| FIDO2 / WebAuthn | Passwordless sign-in and passkeys (Google, Microsoft, GitHub, most modern "security key" 2FA prompts). Touch required; a PIN is required for resident/discoverable credentials. |
| FIDO U2F | Older-style second-factor prompts, the predecessor to WebAuthn, still widely supported as a fallback. |
| OTP (Yubico OTP / HOTP) | One-touch one-time-password generation, used by some enterprise VPNs and Yubico's own services. |
| TOTP | Standard 30-second rotating codes, stored on the key and read through the Yubico Authenticator app instead of a phone app. |
| PIV (smart card) | Certificate-based login — Windows Hello for Business, SSH key storage, code signing. |
| OpenPGP | GPG key storage for encryption/signing, including signed git commits. |
For "day-to-day account logins," the two that matter are FIDO2/WebAuthn and, where a site hasn't caught up yet, U2F. PIV and OpenPGP are flagged as natural next steps at the end.
Tooling: Yubico Authenticator and ykman
- Yubico Authenticator — the GUI app. Shows TOTP codes, manages the FIDO2 PIN, basic device info.
ykman— the command-line tool underneath it. Same capability, plus scriptable inspection — useful here specifically to confirm your two keys actually match before relying on both equally.
ykman list ykman info
Run ykman info with one key plugged in at a time and compare firmware versions. Keys bought at different times can be different hardware revisions with different FIDO2 feature sets — worth knowing now, not the day you need the spare.
Step 1: Set a PIN on Both Keys
FIDO2 resident credentials ("passkeys") require a PIN on the key itself, separate from any account password:
ykman fido access change-pin
or in Yubico Authenticator: the key icon → FIDO PINs → Set PIN.
Step 2: Register Both Keys, in the Same Sitting, to Every Account
This is the step the "spare in a drawer" approach skips — and it's the entire point of owning two keys.
- Go to the account's security/2FA settings and choose Add security key (wording varies).
- Insert the primary key, touch when prompted, label it literally —
YubiKey Primary. - Immediately, in the same session, repeat for the spare, labeled
YubiKey Spare. - Confirm the account's security page lists two distinct keys, not one.
| Account | Notes |
|---|---|
| Primary email | Highest priority — almost every other account's password-reset flow routes through email. |
| Password manager | Your recovery codes for everything else likely live here, so it cannot become a single point of failure itself. |
| Microsoft account / Windows Hello | Covers both the cloud account and, separately, Windows sign-in. |
| GitHub / GitLab | Supports WebAuthn 2FA and, separately, PIV/OpenPGP-based signed commits and SSH. |
| Any VPN / work SSO | Often the most painful account to recover if you're locked out remotely. |
Step 3: Store the Two Keys Somewhere Genuinely Different
Registering both keys everywhere solves "lost one key." It does nothing for "lost the bag with both keys in it," a real failure mode if both live on the same keychain. Yubico's recommendation: keep the spare "somewhere safe but accessible" — a home safe, fireproof box, safe-deposit box, or a trusted person — specifically not wherever the primary already lives day to day.
Step 4: Recovery Codes Are a Third Layer
Most services generate one-time recovery codes when 2FA is first enabled. Save these as the true last resort — for when the primary is lost and the spare isn't reachable (traveling without it, say). They don't replace registering both physical keys; they're what's left if neither key is available at all.
Windows-Specific Setup
Settings -> Accounts -> Sign-in options -> Security key -> Manage
This registers a key for signing into the PC itself — a separate registration from any web account's 2FA. Register both keys here too, on any machine where losing sign-in access would be a real problem. Under Windows Hello for Business, this often uses the PIV/smart-card side of the key rather than pure FIDO2.
Get the Full Write-Up
The complete guide includes the full protocol table, the account-by-account registration checklist, the ykman command reference, testing guidance for verifying the spare actually works, and where this points next (hardware-backed SSH keys, signed git commits).