Aditya Sharma

Bitwarden YubiKey Setup: FIDO2 (Free) or OTP (Premium) Explained

On this page, 12 sections

There are two ways to use a YubiKey with Bitwarden. FIDO2 WebAuthn is free for all Bitwarden users, and Bitwarden recommends it if your key supports it. YubiKey OTP needs a Premium plan, which listed at $19.80 per year, billed annually, when I read the pricing page on 11 October 2026.

If you own a YubiKey 5, use FIDO2. OTP is the fallback for keys that do not do FIDO2, or for a setup where you specifically want it.

This post follows Bitwarden’s own help pages, read on 11 October 2026. I did not run the setup in a live account for this write-up, so the steps are the documented ones.

Before you start: the recovery code

Bitwarden’s pages open both setups with the same warning. Losing access to your two-step login device can permanently lock you out of your vault, unless you keep your recovery code safe or have another two-step method enabled.

Get the code from the Two-step login screen immediately after enabling any method. Bitwarden suggests a printed copy in a safe place. I wrote about what happens next if you misplace the key in what to do if you lose a YubiKey.

Which method to pick

  • Passkey (FIDO2 WebAuthn): free for all users. Works with FIDO2 certified credentials, including YubiKeys, SoloKeys, Nitrokeys and Windows Hello. macOS Touch ID is not currently supported.
  • YubiKey OTP: Premium, including members of paid organizations. Works with YubiKey 4 and 5 series, NEO and NFC models. Up to five keys on an account.

Bitwarden’s OTP page says most modern YubiKeys, including 5 series, support FIDO2 WebAuthn, and that you can check what your key supports using the Yubico Authenticator desktop app. If it does, they recommend FIDO2.

Set up FIDO2 WebAuthn, free

  1. Log in to the Bitwarden web app.
  2. Go to Settings, then Security, then Two-step login.
  3. Find the Passkey option and select Manage. Enter your master password.
  4. Give the key a friendly name.
  5. Plug the key into a USB port and select Read Key. If it has a button, touch it.
  6. Save, then confirm Passkey shows as enabled.
  7. Go back and get your recovery code if you have not.

Bitwarden says all new FIDO keys are registered as WebAuthn keys. If you have an older key marked “Migrated from FIDO” in the manage view, it is a U2F key. Bitwarden says to remove and re-register it, and that it would begin phasing out support for those in 2025.

Set up YubiKey OTP, Premium

  1. Log in to the Bitwarden web app.
  2. Go to Account Settings, then Security, then Two-step login.
  3. Next to YubiKey OTP Security Key, select Manage and enter your master password.
  4. Plug the YubiKey into your computer’s USB port.
  5. Select the first empty YubiKey input field in the dialog.
  6. Touch the key’s button.
  7. Optional: if you will use the key with an NFC-enabled phone, check “One of my keys supports NFC”.
  8. Select Save. A green Enabled message appears.
  9. Close, and confirm the YubiKey OTP option shows a green checkbox.

Repeat to add up to five keys. Adding a second key is the whole point of the five-key limit: keep one in a drawer.

Test before you log out

Bitwarden’s advice is to keep your active web vault tab open while you test, in case something was misconfigured. Once it works, log out of all your Bitwarden apps so each requires the second step on its next login.

The “Remember me” box recognises your device for 30 days, so you will not be asked for the second step on that device during that time. You are also not asked for it to unlock a vault you are already logged in to; the unlock behaviour follows the vault timeout settings.

Phones and NFC

For an NFC-enabled phone, hold the key against the back of the device when prompted. For a non-NFC key on a phone with OTP, the docs say to plug it in, tap Cancel on the NFC prompt, tap the text field and press the key’s button to insert the code.

If NFC misbehaves, Bitwarden’s troubleshooting list says to open the key in Yubico Authenticator and check that the NFC options are enabled under Toggle applications. On Android, it also lists checking that you ticked the NFC box during setup, that NFC is on, and that your keyboard layout is QWERTY.

A phishing note for self-hosters

Bitwarden’s FIDO2 page includes a warning for people on a self-hosted server. An attacker who obtains your email address and master password could embed the Bitwarden passkey prompt on a malicious website, trick you into completing it, and replay the response. The guidance is to always verify you are on the correct Bitwarden domain before entering credentials or touching a passkey prompt.

Self-hosting OTP also needs two environment variables in global.override.env for the Yubico OTP API: a client ID and a key from Yubico.

Use one YubiKey on more than one account

Nothing stops you from using the same physical key for Bitwarden, Google and GitHub. Each service stores its own record. I covered the trade-offs in using the same YubiKey for multiple accounts, and the Google side in Bitwarden vs Google Password Manager.

If you are still choosing hardware, Titan Security Key vs YubiKey compares the spec pages. If you are unsure what a passkey adds, start with YubiKey vs passkey.

What two-step login does and does not cover

Two-step login protects the login to your Bitwarden account. Bitwarden’s page says you are not required to complete the second step to unlock a vault once you are logged in, and points to its vault timeout options for the difference between logging out and locking.

I did not read the vault timeout page for this post, so check it before you rely on the key being asked for at every unlock. The practical reading is that the key is asked for at login, not necessarily each time the vault locks.

Bitwarden’s text also assumes the YubiKey is your highest-priority enabled method. If you enable several methods, the one with the highest priority is the one prompted first, so check the order if you see an unexpected prompt.

Questions people ask

Does Bitwarden support YubiKey for free?

Yes, through FIDO2 WebAuthn, which Bitwarden lists as free for all users. The separate YubiKey OTP method requires Premium.

How many YubiKeys can I add to Bitwarden?

For the OTP method, up to five. For FIDO2 WebAuthn keys, Bitwarden’s two-step login page says up to 5 on a standard account and up to 10 on Premium (read 11 October 2026).

Do I need the YubiKey every time I log in?

Only when Bitwarden asks for the second step. Ticking “Remember me” skips it on that device for 30 days. You do not need it to unlock a vault you are already logged in to.

Do this today

Open Bitwarden, go to Settings, Security, Two-step login, and see what is enabled. If it is nothing, add a passkey with your key, then print your recovery code before you do anything else.

Resources

Tell me where I am wrong

Your email is not published and I do not add it to any list. Corrections with a source are the ones I act on fastest.

More in Cyber Security

Every piece in Cyber Security

  1. YubiKey 4 vs YubiKey 5 vs NEO: Which Key Still Makes Sense? Yubico's own pages: the YubiKey 5 lists FIDO2, the NEO and 4 Nano list FIDO U2F only. What that means for passkeys and whether… Cyber Security 6 min
  2. Cloudflare Scrape Shield: What It Does and What It Doesn’t Cloudflare's docs list two Scrape Shield features, email obfuscation and hotlink protection. Neither blocks scraping. What each does, tested on a live site. Cyber Security 8 min
  3. How Many Passkeys Can a YubiKey Hold? 25 or 100 by Firmware Yubico's firmware matrix says 100 passkeys on firmware 5.7 and later, 25 on 5.0 to 5.5. What counts, how to check your key, and… Cyber Security 6 min
  4. Bitwarden vs Google Password Manager: What the Docs Actually Say I read both vendors' documentation: how each encrypts your vault, who holds the key, what is free and what Bitwarden Premium costs. Here is… Cyber Security 6 min
  5. Vaultwarden vs Bitwarden Self-Hosted: Which Server to Run Vaultwarden is unofficial and light. Bitwarden's own server is official, now with Lite. What each project documents, its audits, and who should run which. Cyber Security 9 min
  6. Verify the GPTBot IP Address: Real Crawler or Fake User Agent A user agent proves nothing. Check the IP against OpenAI's published JSON, and Googlebot with reverse plus forward DNS. Scripts included, each one run. AI 9 min