Gregory J. Durnan, PhD, CEng, FIMarEST

Setting Up Two YubiKeys: A Primary and a True Working Spare
San Diego, CA, USA · gregory.durnan@gmail.com · durnan.org

The One Assumption Worth Checking First

Two YubiKeys almost always means one primary and one spare — that part's right. The part worth checking is what "spare" means in practice. Yubico's own guidance on this is blunt: a spare key that isn't registered to your accounts is of no help to you if you lose the primary. A second key sitting in a drawer, never enrolled anywhere, isn't a backup — it's just a second unused device that happens to be identical to the one you lost.

The correct model: both keys get registered to every account, at the same time, during initial setup — not "register the primary now, add the spare later." Later is exactly the moment that tends not to arrive before the primary goes missing.

What a YubiKey Actually Does

A YubiKey isn't one authentication method — it's several, bundled into one USB device, and which one gets used depends on what the account you're registering it with supports:

ProtocolWhere it's used
FIDO2 / WebAuthnPasswordless sign-in and passkeys (Google, Microsoft, GitHub, most modern "security key" 2FA prompts). Touch required; a PIN is required for resident/discoverable credentials.
FIDO U2FOlder-style second-factor prompts, the predecessor to WebAuthn, still widely supported as a fallback.
OTP (Yubico OTP / HOTP)One-touch one-time-password generation, used by some enterprise VPNs and Yubico's own services.
TOTPStandard 30-second rotating codes, stored on the key and read through the Yubico Authenticator app instead of a phone app.
PIV (smart card)Certificate-based login — Windows Hello for Business, SSH key storage, code signing.
OpenPGPGPG key storage for encryption/signing, including signed git commits.

For "day-to-day account logins," the two that matter are FIDO2/WebAuthn and, where a site hasn't caught up yet, U2F. PIV and OpenPGP are flagged as natural next steps at the end.

Tooling: Yubico Authenticator and ykman

ykman list
ykman info

Run ykman info with one key plugged in at a time and compare firmware versions. Keys bought at different times can be different hardware revisions with different FIDO2 feature sets — worth knowing now, not the day you need the spare.

Step 1: Set a PIN on Both Keys

FIDO2 resident credentials ("passkeys") require a PIN on the key itself, separate from any account password:

ykman fido access change-pin

or in Yubico Authenticator: the key icon → FIDO PINsSet PIN.

Warning: FIDO2 keys lock out and wipe their resident credentials after too many incorrect PIN attempts (typically 8, counting down). This is a hardware security feature and cannot be undone by anyone, including Yubico. Write the PIN down somewhere durable before you need it under pressure.

Step 2: Register Both Keys, in the Same Sitting, to Every Account

This is the step the "spare in a drawer" approach skips — and it's the entire point of owning two keys.

  1. Go to the account's security/2FA settings and choose Add security key (wording varies).
  2. Insert the primary key, touch when prompted, label it literally — YubiKey Primary.
  3. Immediately, in the same session, repeat for the spare, labeled YubiKey Spare.
  4. Confirm the account's security page lists two distinct keys, not one.
AccountNotes
Primary emailHighest priority — almost every other account's password-reset flow routes through email.
Password managerYour recovery codes for everything else likely live here, so it cannot become a single point of failure itself.
Microsoft account / Windows HelloCovers both the cloud account and, separately, Windows sign-in.
GitHub / GitLabSupports WebAuthn 2FA and, separately, PIV/OpenPGP-based signed commits and SSH.
Any VPN / work SSOOften the most painful account to recover if you're locked out remotely.

Step 3: Store the Two Keys Somewhere Genuinely Different

Registering both keys everywhere solves "lost one key." It does nothing for "lost the bag with both keys in it," a real failure mode if both live on the same keychain. Yubico's recommendation: keep the spare "somewhere safe but accessible" — a home safe, fireproof box, safe-deposit box, or a trusted person — specifically not wherever the primary already lives day to day.

Step 4: Recovery Codes Are a Third Layer

Most services generate one-time recovery codes when 2FA is first enabled. Save these as the true last resort — for when the primary is lost and the spare isn't reachable (traveling without it, say). They don't replace registering both physical keys; they're what's left if neither key is available at all.

Windows-Specific Setup

Settings -> Accounts -> Sign-in options -> Security key -> Manage

This registers a key for signing into the PC itself — a separate registration from any web account's 2FA. Register both keys here too, on any machine where losing sign-in access would be a real problem. Under Windows Hello for Business, this often uses the PIV/smart-card side of the key rather than pure FIDO2.

Get the Full Write-Up

The complete guide includes the full protocol table, the account-by-account registration checklist, the ykman command reference, testing guidance for verifying the spare actually works, and where this points next (hardware-backed SSH keys, signed git commits).