How Many Passkeys Can a YubiKey Hold? 25 or 100 by Firmware
On this page, 10 sections
A YubiKey 5 with firmware 5.7 or later can hold 100 passkeys (Yubico’s 5.7 page says as of 5.7.4). A YubiKey 5 with firmware 5.0 to 5.5 holds 25. Both numbers come from Yubico’s own firmware capability matrix, which I read on 11 October 2026.
That number counts discoverable credentials only, which is what a passkey on a security key is. Two-step login registrations are a different thing and do not use those slots, going by Yubico’s developer guide. The rest of this post explains the split and how to check your own key.
I did not read any key myself. Everything here is from Yubico’s documentation, and I say where I am inferring.
The 25 and the 100
Yubico’s firmware overview has a table headed FIDO2 Credential Storage with one value per firmware column:
| Firmware | FIDO2 credential storage |
|---|---|
| 5.8.x | 100 |
| 5.7.x | 100 |
| 5.5.x | 25 |
| 5.4.x | 25 |
| 5.3.x | 25 |
| 5.2.x | 25 |
| 5.0.x | 25 |
The YubiKey 5 Series table has no 5.6 column, so I am not stating a number for 5.6.x. Yubico’s 5.7 page also lists Supports 100 passkeys as an enhanced credential storage feature, with Yes in each of the YubiKey 5, FIPS, Enhanced PIN, Security Key and Bio columns of that table. The jump is a factor of 4.
The same 5.7 table lists 24 PIV certificates, 64 OATH credentials and 2 OTP seeds. Those are separate stores for other protocols. The 100 is only the FIDO2 one.
What counts toward the limit
Yubico’s WebAuthn developer guide defines a discoverable credential, also called a resident key, as one where the private key and its metadata sit in persistent memory on the authenticator. That is what lets a site log you in without asking for a username first, which is the passkey flow.
The same guide says credential management cannot display non-discoverable keys, including U2F-based credentials, because that information is not stored on the authenticator in any fashion. My inference from that: a key registered only as a second factor does not take a slot, and only passkeys do. Yubico does not put it in those words on that page, so treat the inference as mine.
Put differently: the number is about the key, not about the passkey. A site that offers you a passkey is asking to store one more discoverable credential on the key, whatever the site is.
Yubico’s developer guide describes the stored pieces as the private key and the user handle, with the relying party identified by a hash of its ID, so each registration adds one entry to the list the client can read back.
How to see what is on your key
Yubico’s guide says the client can read the number of existing discoverable credentials on the authenticator, the maximum number of remaining ones that can be created, and for each one the relying party and user. It says this works on firmware 5.2.3 and above.
On the command line, the ykman documentation lists these commands:
ykman fido info
ykman fido credentials list
ykman fido credentials delete CREDENTIAL_IDI confirmed those three commands appear in the ykman FIDO docs page on 11 October 2026. I did not run them, because I do not have a key. The docs’ own example passes a PIN with –pin; typing a PIN into a command line leaves it in your shell history, so leave the flag off and let ykman prompt.
The Yubico Authenticator is the graphical option. Yubico’s manual names it and ykman as the two ways to read the firmware version.
Check your firmware before you count on 100
Yubico’s firmware overview says a key’s firmware is set at the factory and cannot be updated. So the number of slots is a property of the key you bought, not of your software. Run the firmware check first. If it says 5.7 or later, you have the 100. If it says 5.5 or earlier, you have 25 for the life of the key.
Yubico’s store page lists firmware 5.8 on every current YubiKey 5 and Security Key model. A key from old stock may be older. The buying side is in which YubiKey should I buy.
A worked example
Suppose, as a made-up case, you have registered passkeys on 18 sites. On a 25 slot key that leaves 7 slots. On a 100 slot key it leaves 82. Same 18 sites, very different room. The figure is hypothetical and the arithmetic was done in Python. It assumes one discoverable credential per site, which is how I read Yubico’s description of a credential per relying party and user.
You cannot move a key from 25 to 100. Yubico’s firmware overview says firmware is set at the factory and cannot be updated, so the only way to a bigger number is a newer key.
If you are already near the limit on an older key, the practical step is to delete credentials for sites you no longer use, then buy a current key and register it as your main one.
Is 25 enough, is 100 enough
This is my reading, not a measured result. Most people will not have 25 sites that offer a passkey today. A heavy user could. If you use passkeys for work and personal accounts across many services, 100 is the comfortable number and 25 is the one to watch.
The same key can also hold other things in other stores, and Yubico lists those limits above. They do not eat into the 100.
When the key is full
I did not read a Yubico page that spells out the exact error a client shows when the key is full, so I am not describing one. The sensible plan is to check the remaining count with the client before you register a new passkey on a key you have used heavily, and delete credentials you no longer need with the ykman delete command above.
Passkeys and password managers
A passkey on a YubiKey is bound to that key. A passkey in a password manager is stored in the vault. They are different places, and the slot limit above applies only to the hardware key. For where the line sits in practice, YubiKey vs passkey covers the choice.
If you want to know whether one key can serve several accounts, read can you use the same YubiKey for multiple accounts.
What I could not check
I did not verify the number on a physical key. I did not find a Yubico page that gives a slot count for the 5.6.x firmware. I did not run the ykman commands. The ykman page shows the commands exist; I did not confirm their output format.
How this was checked
I read Yubico’s Firmware Overview and 5.7 firmware pages in the YubiKey Technical Manual, Yubico’s WebAuthn Developer Guide page on resident keys, and the ykman FIDO commands page, on 11 October 2026. No key was involved and nothing was run on a device.
Do this today
Find the firmware version of each key you own with the Yubico Authenticator or ykman, then run the credentials list command to see how many passkeys are on it. Write both numbers somewhere. If you are buying a new key, get one that shows 5.7 or later.
Resources
- Yubico YubiKey Technical Manual: Firmware Overview (read 11 October 2026)
- Yubico YubiKey Technical Manual: 5.7 – 5.6 Firmware Specifics (read 11 October 2026)
- Yubico WebAuthn Developer Guide: Resident Keys (read 11 October 2026)
- Yubico ykman: FIDO commands (read 11 October 2026)