Aditya Sharma

Lost YubiKey: What to Do in the First Hour and the First Week

On this page, 9 sections

If you lose a YubiKey, there is no central place to switch it off. Each account that you registered it with holds its own record of the key, so you sign in another way and remove the key from each account, one by one.

The order that matters: first reach your most important account with a backup method, then remove the lost key there, then add a replacement. Everything else can follow over the week.

I read the Google, Bitwarden and Yubico documentation on 11 October 2026 for this post. I did not test a recovery flow, and where a page failed to load I say so.

What the vendors say about a lost key

I could not load Yubico’s support article on lost keys on 11 October 2026 (the page returned a server error), so I do not quote it. What I can say from how the keys work is in the next sections: a FIDO key holds no account list, so every service you registered it with has to be dealt with one at a time.

That matches the design. Yubico also published a post on lost-key practices describing why it decided to decommission its central revocation service, YubiRevoke, on 1 October 2014 (the post announced the plan; I did not check later whether it happened on that date).

The post is old and is about the OTP side of the product, so I read it as history. The reason is still useful: a central revoke button is itself an attack target.

The practical meaning is simple. My read: the sites that trust the key are the ones that have to forget it.

The first hour

  1. Check what was on it. A YubiKey on its own is not a login. As a second factor, a finder still needs your password. For passkeys, the docs I read require a FIDO2 PIN to register one, but I did not find what protects a key that has no PIN, so treat a PIN-less key as exposed.
  2. Sign in to your most important account from a device you trust. For most people that is the email account, because it resets everything else.
  3. Use another second step. Google’s help page lists what works: verification codes, a different security key you added, or a registered computer where you chose not to add a verification code.
  4. Remove the lost key from that account. Google’s page shows a trash bin icon next to each key under security keys. Click it and confirm.
  5. Add a replacement. Google suggests getting an extra key to keep somewhere safe, which is the reason to own two.

What a finder can and cannot do

Yubico’s documentation for FIDO2 says you must set a FIDO2 PIN before registering a key for passwordless sign-in. It says you get eight attempts at the current PIN during a change or registration attempt. After three wrong attempts in a row, the key must be removed and reinserted. After eight, the FIDO2 application is blocked and must be reset.

That is a real brake on guessing. What I did not find in the pages I read is a plain statement of what a thief can do with a key that has no PIN. So the safe version of this advice is: set a PIN on every key before you need to. It costs a minute.

I also did not find, in these pages, a definitive description of what a reset removes. Do not assume a reset is a fix for anything other than the blocked state it is meant for.

If you have no other second step

This is the bad branch, and Google documents it. If you do not have another second step or forgot your password, the page says 2-Step Verification requires an extra step and it can take up to 3 to 5 business days for Google to verify it is you. You start from Google’s account recovery flow and answer questions to confirm the account is yours.

That is the strongest argument for the setup I recommend: a second key, plus backup codes stored offline. I wrote about the thing people ask next, whether one key can cover many accounts, in using the same YubiKey for multiple accounts. One key works for many sites, which also means one loss touches all of them.

Bitwarden: the one that can lock you out

If your YubiKey protects a password manager, the stakes change. Bitwarden’s YubiKey pages carry the same warning in a box: losing access to your two-step login device can permanently lock you out of your vault, unless you keep your recovery code safe or have another two-step method enabled.

Bitwarden’s recovery code page says the code lets you disconnect all two-step methods and regain access. It adds three details worth knowing:

  • Save the code immediately after turning on any two-step method. A printed copy in a safe place is a good option, since it avoids digital theft and accidental deletion.
  • After you use a recovery code, a new one is generated, and you have to save the new one.
  • Adding a method or changing your master password does not change the recovery code.

The US recovery page is vault.bitwarden.com/#/recover-2fa/ and the EU one is vault.bitwarden.eu/#/recover-2fa/. If you are enrolled in account recovery with an organization, an owner or admin can reset your two-step login without your code.

Bitwarden’s YubiKey OTP method accepts up to five keys, so a second and third key is a supported configuration, not a workaround. Setup is in Bitwarden and YubiKey setup.

The first week

  • Go through your accounts and remove the lost key from each. Start with email, then your password manager, then domain and hosting, then payments and code hosting, then everything else.
  • If the key held passkeys, the sites hold a record of that credential. Remove those too. You cannot browse the lost key’s list, so you work from your own account list.
  • Reprint your recovery codes after you regain access. A used code is replaced.
  • Ask whether the key was stolen or lost in a place where it could be tied to you. If your name is on it or it hung on a labelled keyring, treat that as a reason to change the passwords too.

If you want the threat side of this, can a YubiKey be hacked covers what an attacker with a physical key can realistically do.

Questions people ask

What happens if my YubiKey is stolen?

Same steps as a lost key, with more urgency on changing passwords. The docs I read say a PIN gates FIDO2 passkeys, so set one in advance.

Can I remotely disable a YubiKey?

I did not find a documented remote disable. Yubico says the policy depends on each service, and it announced in 2014 that it would decommission its own central revocation service, YubiRevoke.

How do I get into Bitwarden if I lost my only YubiKey?

Use your recovery code at the recovery page for your server region, or ask your organization admin if you are enrolled in account recovery.

Do this today

Register a second key on your email account and your password manager, set a FIDO2 PIN on both keys, and print your Bitwarden recovery code. Put the second key and the code somewhere other than your keyring.

Resources

Tell me where I am wrong

Your email is not published and I do not add it to any list. Corrections with a source are the ones I act on fastest.

More in Cyber Security

Every piece in Cyber Security

  1. Is Chrome’s Password Manager Safe? What Google’s Own Pages Say Chrome encrypts and breach-checks saved passwords, but Google's own security blog names a gap with malware on Windows. What the pages say and what… Cyber Security 6 min
  2. Move Chrome Passwords to Bitwarden: Export, Import and Clean Up Export Chrome passwords as a CSV, import them once into Bitwarden, verify the count, then turn off Chrome saving and delete the CSV. Steps… Cyber Security 6 min
  3. Titan Security Key vs YubiKey: What Differs on the Spec Pages Both are FIDO security keys. I compared what Google and Yubico publish: protocols, connectors, passkey support and where the Titan's page goes quiet. Cyber Security 6 min
  4. How to Block AI Crawlers in WordPress (robots.txt Is Not a Lock) One robots.txt group per AI crawler token, a tested WordPress snippet, what each vendor documents, and why a physical robots.txt file can make your… AI 9 min
  5. Which YubiKey Should I Buy? Models, Prices and Firmware Compared A buying guide from Yubico's own pages: Security Key at $29 or YubiKey 5 at $58, which connector, why two keys, and why firmware… Cyber Security 6 min
  6. Bitwarden Chrome Extension Setup: Install, Autofill, Defaults How to install the Bitwarden Chrome extension, make it the default, turn off Chrome's own saver and autofill your first login, from Bitwarden's help… Cyber Security 6 min