YubiKey vs Passkey: Why You Are Comparing the Wrong Things

On this page, 9 sections

A passkey is a login credential. A YubiKey is a piece of hardware that can store passkeys, along with several other kinds of credential. So “YubiKey vs passkey” is a slightly broken question, like asking whether you should use a password or a USB stick.

The comparison that does matter is where your passkeys live. They can sit on a hardware key you carry, or they can sync through a password manager or your Google account. Those two choices fail in different ways, and that is the real decision.

I read the vendor documentation for each side on 11 October 2026 and kept to what it says. I did not run hardware tests for this post.

What a passkey is, in the vendors’ own words

Yubico’s documentation defines passkeys as credentials that let you sign in without a password using the FIDO2 standard. The website or service creates them, and the docs call that service the relying party.

Nothing in that definition says where the credential has to be stored. That is why the same word shows up in three different products, which is where most of the confusion comes from.

Bitwarden, for example, lists three separate passkey features on one help page:

• Saving and autofilling passkeys for other sites from your vault.
• Using a passkey to log in to and unlock your Bitwarden account.
• Using a passkey as the second step to protect your Bitwarden account.

Same word, three jobs. A YubiKey can hold passkeys too, but the Bitwarden features above describe your vault, not the key.

Where a passkey can live

On a YubiKey

Yubico’s guide says passkeys can be stored on FIDO2-certified YubiKeys, and that Yubico Authenticator is the tool for viewing and deleting them. It also says non-passkey FIDO2 credentials can be stored on a key but are not discoverable, so they do not appear on the Passkeys page.

Before you can register a key for passwordless sign-in, you must create a FIDO2 PIN. The docs say you get a total of eight attempts to enter the correct current PIN during a change or registration attempt. After three wrong attempts in a row you must remove and reinsert the key. After eight, the FIDO2 application is blocked and has to be reset.

I did not find a passkey capacity number in the pages I read, so I am not going to quote one. Check the product brief for your model before you plan to store dozens.

In your Google account

Google’s help page for Chrome says that when you are signed in, passwords can be saved to your Google Account and used across devices. The Chrome setting is worded “Offer to save passwords and passkeys”.

Google also publishes how it encrypts them. By default, the page says, this type of encryption means you trust Google to hold the key. With on-device encryption turned on, you lock the data with a key you take with you, so only you can see it. The same page warns that if you lose that key, you could lose your passwords and passkeys too.

In a password manager

Bitwarden’s page states that you can save and autofill passkeys for other services from your vault. A password manager passkey is a synced passkey: it exists wherever your vault is unlocked, so it survives losing a phone.

What a YubiKey does that a passkey does not

A passkey is one protocol. A YubiKey 5 is a bundle. Yubico’s product page for the 5 Series lists multi-protocol support: FIDO2, U2F, smart card, OTP and OpenPGP 3, in USB-A, USB-C, NFC and Lightning versions. The page’s headline claim is based on firmware 5.8 at the time I read it.

That matters if you want the key for something other than websites. Bitwarden, for one, offers a separate YubiKey OTP two-step method for Premium users, on top of the free FIDO2 method.

If the only thing you will ever do is sign in to websites with a passkey, the extra protocols are unused capacity. If you also want a second factor for older systems, the extra protocols are the reason to buy the key.

How each setup fails

This is the part most comparison posts skip, so here is how I read it from the docs.

Hardware key failure

You lose the key, or it dies, or you forget the PIN eight times. A hardware-bound passkey does not come back by itself. You get back in by using whatever second way into the account you registered earlier, which means you needed one before you lost the key. I wrote a separate walkthrough on what to do when you lose a YubiKey.

Synced passkey failure

The weak point moves from the object to the account that holds the vault. For a Google-held passkey, that is your Google account and the trust you place in Google as the key holder, unless you turn on on-device encryption. For a password manager, it is your master password plus any two-step method protecting the vault.

Neither is a flaw. They are different places for a single point of failure. The reason people pair them is that the hardware key can guard the vault that holds the synced passkeys. I made the case in YubiKey vs password managers, and the short version is that they are layers, not rivals.

Gotchas the docs call out

• Google says that if you create a passkey on your security key, you bypass the second authentication step, because the passkey already proves you hold the device. You can change that default in your account settings if you prefer to always use your password.
• Google says a FIDO2 key added to your account before May 2023 may first need to be removed before you can create a passkey on it.
• Any FIDO1 or FIDO2 security key works as a second step for Google 2-Step Verification, but only a FIDO2 key can hold a passkey.
• Bitwarden says some authenticators, notably Windows Hello, will not let you use one passkey for both login and two-step. It also says macOS Touch ID is not currently supported for two-step login.

Which one fits you

This is my read, not a vendor claim.

If you have one phone, one laptop and no tolerance for fiddling, a synced passkey in a password manager is the simplest. You lose less when a device dies.

If you protect a high-value account, such as your email, your domain registrar, your password manager or a payments dashboard, put a hardware key on that account as well. My read: a credential on a key is not sitting in an online vault.

If you can only buy one thing, I would buy two keys, not one. The second is your recovery path. I would not rely on a single hardware key as the only way into anything.

Questions people ask

Is a YubiKey a passkey?

No. A YubiKey is a device. It can store passkeys, if it is a FIDO2 model and you have set a PIN, and it can also do OTP, smart card and OpenPGP.

Can a passkey replace a YubiKey?

For signing in to websites, often yes, in my read. A synced passkey does a similar job for most sites. It does not replace the other protocols a YubiKey carries.

Do I need both?

You do not need to. Many people use a synced passkey for everyday sites and keep a hardware key for the three or four accounts where a takeover would be expensive.

Do this today

Plug in your YubiKey if you own one, open Yubico Authenticator and look at the Passkeys page. If you have never set a FIDO2 PIN, set one now. Then write down which accounts have a passkey on the key and which have only a password, so you know your real coverage.

If you are unsure whether one key can cover all of them, using the same YubiKey for multiple accounts answers that.

Resources

• Yubico Authenticator guide: Passkeys and FIDO2, read on 11 October 2026.
• YubiKey 5 Series overview, read on 11 October 2026.
• Google Account Help: Use a security key for 2-Step Verification, read on 11 October 2026.
• Google Account Help: Get started with on-device encryption, read on 11 October 2026.
• Bitwarden Help: Passkey two-step login, read on 11 October 2026.