Note that, in Windows, YubiKey Manager must be run as an administrator in order to open Applications > FIDO2.įIDO2 PINs can be up to 63 alphanumeric characters (in other words, letters and numbers). See below section Handling an Unknown FIDO2 PIN for more details. However, changing its PIN from a known value to a new value (using YubiKey Manager, Windows Settings, etc.) does not have this consequence.

Resetting a YubiKey's FIDO2 function can effectively unregister the key from accounts it has been paired with using WebAuthn. It is also possible to set/change a YubiKey's FIDO2 PIN via Settings in Windows 10 under Accounts > Sign-in options > Security Key, and one may also be set when registering with certain services that use WebAuthn (e.g. personal Microsoft accounts), so disabling the function on the YubiKey will cause it to not work or not be recognized by those services.Ī FIDO2 PIN can be set on a YubiKey with Yubico’s open source tool YubiKey Manager by navigating to Applications > FIDO2 and clicking Set PIN.

Note that FIDO2 is required for certain services (e.g.

If you prefer not to be prompted for a PIN, try disabling the YubiKey's FIDO2 function, and see if that eliminates the PIN prompt, while still allowing you to sign in.

If a service provider does not specify a setting for User Verification, most modern browsers will default setting it to Preferred (as per the WebAuthn spec), which may result in a PIN prompt.

This setting is controlled by each service provider.

PIN prompts are a result of a WebAuthn setting known as User Verification.

FIDO2 is made up of two components - WebAuthn on the service provider end, and CTAP2 on the YubiKey end.

For additional information on PIV and OpenPGP, please see the resources below.

Shown below is an example of what a prompt to create a FIDO2 PIN on a YubiKey might look like in the Windows operating system.įrom this point forward, this article will focus on FIDO2 PINs. If you are using a Security Key Series key, FIDO2 is the only PIN you will be prompted for, as the Security Key Series keys do not support PIV and OpenPGP.If you are being prompted for a PIN (including setting one up), and you're not sure which PIN it is, most likely it is your YubiKey's FIDO2 PIN.The PIV and OpenPGP PINs are set to 123456 by default, but there is no FIDO2 PIN set from the factory.A YubiKey can have up to three PINs - one for its FIDO2 function, one for PIV (smart card), and one for OpenPGP.

Fido u2f fido2