YubiKey 5C NFC

23 Oct 2026

The YubiKey 5C NFC is a hardware security key from Yubico. It proves it's you when you sign in, by a touch on the key: plugged into USB-C, or tapped against a phone over NFC. A password can be phished. A key can't, because it checks the website's address before it answers. It is the most popular model of the YubiKey 5 Series, and the one that fits a modern Mac, a USB-C laptop and an iPhone.

Overview

• What it is: a multi-protocol security key for passkeys, 2-factor logins, one-time codes, smart-card certificates and PGP.
• Connections: USB-C and NFC. No battery, no Bluetooth, no app needed for most logins.
• Firmware: version 5.8 on keys sold now, with room for 100 passkeys and 64 authenticator codes.
• Price: €69.02 including VAT at Yubico's German store on 23rd October 2026. Free shipping in the EU from €100 excluding VAT, so 2 keys ship free.
• Made in: Sweden.

Specifications

What it does, in practice

• Passkeys and security keys (FIDO2): the strongest use. Register the key on Google, Microsoft, Apple, 1Password, Bitwarden, GitHub, AWS and 100s of other services. Sign-in then needs the key and a touch, sometimes a PIN. This is the phishing-proof part.
• Authenticator codes (TOTP): the key stores the secrets of 6-digit codes, and the free Yubico Authenticator app reads them on desktop or phone. The secrets never sit on the phone, but the codes themselves can still be phished.
• Smart card (PIV): certificates for Mac login, SSH or enterprise sign-in.
• OpenPGP: signing and encrypting email or Git commits, with the private key stored on the YubiKey.

How it adds a layer of safety, in simple terms

A password is a secret you know. Anyone who learns it, from a fake login page, a data leak or malware, can use it from anywhere in the world. Codes by SMS or an authenticator app help, but a fake page can ask for the code too and pass it on in real time.

The YubiKey is something you have, and it works differently:

1. The secret never leaves the key. When you register it on a site, the key creates a key pair for that site. The private half stays locked in the key's chip. Nobody can copy it, not even you.
2. The key checks who is asking. At sign-in, the site sends a challenge. The browser tells the key which website it really is. The key only answers for the exact site it was registered with, so a look-alike phishing site gets nothing.
3. A human has to touch it. The key signs the challenge only after a physical touch, and a PIN if you set one. Malware on the computer can't press the button.

The result: to get into an account protected this way, an attacker needs the physical key in their hand, and usually your PIN too. Stealing a password from the other side of the world is no longer enough.

What it doesn't do: it protects the login. Once you are signed in, the session (a cookie in the browser, or a token) is what keeps you in. Malware that steals a live session, or an API key in a file, gets around the key. The key raises the bar at the door, not inside the house.

Using it with AI agents

AI agents such as Claude Code or a browser agent act on your machine with your access: they run commands, push code, open websites and call APIs. That is the point of them, and also the risk. An agent can be tricked by a prompt injection in a web page or a file, or simply make a mistake, and it does it at machine speed.

A YubiKey helps in 3 ways.

1. A human approval the agent can't fake

Anything set up to need a touch on the key becomes an action only a person can approve. The agent can prepare the commit, the deployment or the transfer, but it stops at the touch. This is a physical human-in-the-loop that no prompt can talk its way past, because there is no prompt: there is a finger on a sensor.

Good candidates:

• SSH: a key stored on the YubiKey (ed25519-sk) needs a touch for every connection, so an agent can't log into your servers on its own.
• Git commit signing: each signed commit needs a touch, so a commit signed by you was approved by you.
• sudo and admin rights: with Yubico's pam-u2f module, admin actions on a Mac or Linux machine need the key.
• Password manager unlock: KeePassXC can require a touch on the key at every unlock, so an agent with access to your machine can't open the vault by itself. 24 Oct 2026 Correction: this line first said 1Password and Bitwarden can too. They use the key as a second factor when you sign in to the account on a new device, not each time you unlock the vault.

# SSH key that lives on the YubiKey: needs a touch, and the PIN, at every use
ssh-keygen -t ed25519-sk -O resident -O verify-required -C "yubikey-5c-nfc"

# Sign Git commits with that key
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519_sk.pub
git config --global commit.gpgsign true

If the built-in ssh-keygen refuses the -sk key type on macOS, use OpenSSH from Homebrew.

24 Oct 2026 The other way to sign commits is a GPG key on the YubiKey's OpenPGP applet, and it has a trap: its touch policy is off by default. Once gpg-agent has cached your PIN, any process on the machine, an agent included, can sign silently while the key is plugged in. Turn touch on for the signing slot, so every signature needs a tap:

ykman openpgp keys set-touch sig on   # Admin PIN required
ykman openpgp info                    # Touch policies: Signature key: On

The full GPG setup is in the cheatsheet section further down.

2. Lock the accounts that hand out the keys

Agents shouldn't sign in as you. They should run on API keys and tokens with limited rights. But those tokens are created in accounts: Anthropic, OpenAI, GitHub, AWS, Google, the password manager. Whoever controls those accounts can create new tokens, raise the limits or read the billing.

Put the YubiKey on exactly those accounts. Then a leaked password, or an agent tricked into opening a fake login page, can't take over the account that issues every other credential. Passkeys are phishing-proof, so an agent that lands on a look-alike site can't hand over a login it doesn't have.

3. A clear line between what the agent can and can't do

The key turns a vague policy into a physical boundary:

The limits

• It doesn't police the agent's own tokens. An API key in a .env file works without the YubiKey. Keep those tokens narrow, short-lived where possible, and out of reach of untrusted content. OIDC is the standard that replaces such keys with short-lived tokens, see OIDC in Simple Terms.
• It doesn't protect open sessions. A browser where you are already signed in is open to anything that can drive that browser. Use a separate browser profile for agents, with only the logins they need.
• It only works where it's required. If a service also accepts SMS or a password as a fallback, an attacker uses the fallback. Remove weaker methods once both keys are registered.

Yubico is also building for this: its product page lists preview support for hardware-backed signatures and "AI-based workflows" on firmware 5.8, so a key could one day sign an agent's actions directly.

Firmware: why 5.7 and later matter

The firmware is fixed at the factory and can't be updated. A key keeps the features and the flaws it shipped with.

• 5.7 (2024): raised the capacity from 25 to 100 passkeys and from 32 to 64 OATH codes, and added Ed25519.
• EUCLEAK (September 2024): Yubico's advisory YSA-2024-03 covers a flaw in an Infineon crypto library in YubiKey 5 and Security Key firmware before 5.7.0. Yubico rates it moderate: an attacker needs the physical key, knowledge of the target accounts and specialised equipment. The only fix is a newer key.
• 5.8 (current): adds CTAP 2.3 features, PRF for digital wallets and encrypted credential storage, and previews for payment confirmation and signing.

Check the firmware of a key bought second-hand or from old stock in Yubico Authenticator. Anything below 5.7 is worth replacing.

Set it up right

• Buy 2 keys and register both everywhere. One on the key ring, one at home. A single key is a single point of failure, and losing it can lock you out.
• Apple Account: Apple's Security Keys feature needs at least 2 FIDO-certified keys, from iOS 16.3 and macOS Ventura 13.2.
• Set a FIDO2 PIN at first use, in Yubico Authenticator.
• Keep recovery codes for every account you protect, stored offline.
• Prefer passkeys over TOTP where a service offers both.

Cheatsheet: hardening the setup

24 Oct 2026 From the Opsek YubiKeys cheatsheet on GitHub, a practical guide by the security firm Opsek. Its tips, condensed, with what applies to a Mac.

The 8 applications on the key

The YubiKey runs several independent applications. Only some of them stop phishing:

Setup checklist, on every key

1. Check the key is genuine at yubico.com/genuine.
2. Set the FIDO2 PIN in Yubico Authenticator, on the Passkeys tab. Opsek uses the same PIN on all keys, so the backup works without thinking.
3. Make the PIN mandatory for every FIDO use, on firmware 5.7 and later: ykman fido config toggle-always-uv.
4. Register both keys on every account, then sign in once with each to test it.
5. Name the keys on each account (for example "5C NFC main" and "5C NFC backup"), so you know which one to remove if 1 is lost.
6. Check what supports security keys with Opsek's SafeCheck.

2 warnings:

• No PIN asked at registration means the setup is incomplete: either no FIDO2 PIN is set, or the service registered a weaker method than a security key or passkey.
• Don't store the same passkeys in a password manager. Opsek's rule: the password manager holds passwords, the YubiKey is the only place the passkey lives. A passkey synced to a cloud vault is only as strong as that vault.

On a Mac: use Terminal.app for ykman

Run ykman from Apple's own Terminal.app. Opsek finds that third-party terminals (iTerm2, Warp, Alacritty, Kitty, Hyper, the VS Code terminal) can stop ykman from seeing the key, make it hang, or swallow PIN prompts. When a command misbehaves, try Terminal.app before anything else.

The tools: Yubico Authenticator for the PIN and the applications, and YubiKey Manager for the ykman command line (brew install ykman).

GPG keys on the YubiKey

The OpenPGP applet holds a GPG key that never leaves the key: for signing commits, encrypting files and SSH.

• Change the default PINs first. A new OpenPGP applet ships with User PIN 123456 and Admin PIN 12345678. Change both before you load a key: ykman openpgp access change-pin and ykman openpgp access change-admin-pin.
• Generate the key on the card, in gpg --card-edit (admin, then key-attr, then generate), with ECC Curve25519 for all 3 slots: ed25519 for signing and authentication, cv25519 for encryption.
• Use pinentry-mac for the PIN popup (brew install gnupg pinentry-mac), and never put pinentry-mode loopback in ~/.gnupg/gpg.conf on a Mac: on GnuPG 2.4 and later it freezes PIN entry inside gpg --card-edit.
• Turn on touch for the slots you use. The policy options:

• 2 keys means 2 signing keys. Each YubiKey holds its own GPG key with its own ID. Git signs with the one in user.signingkey, so switch that setting when you switch keys, and add both public keys to GitHub.

Encrypt files that only open with the key

The encryption slot can lock files to the key:

ykman openpgp keys set-touch enc on                       # every decryption needs a tap
gpg --encrypt --recipient <KEY1_ENC_ID>! --recipient <KEY2_ENC_ID>! secret.txt
gpg --decrypt secret.txt.gpg                              # PIN popup, then touch

Encrypting needs only the public key, so no PIN or touch. Decrypting needs the PIN and a tap, and without the tap it fails. The private key can't be copied, so losing the key means losing the data: always add the 2nd key as a 2nd recipient.

KeePassXC with challenge-response

KeePassXC can require the YubiKey, on top of the master password, at every unlock:

1. In Yubico Authenticator, enable the OTP application.
2. Program Slot 2 as Challenge-Response (HMAC-SHA1) with Require touch. Slot 1 usually holds the factory Yubico OTP, so leave it alone.
3. Use the same secret on every key. The secret can't be read back out of a key, so the only way to have a backup is to program all keys with it at setup. Then delete every copy of the secret.
4. Create the database as KDBX 4.0, with ChaCha20 (256-bit) and Argon2id, add the master password, then Add additional protection, Add Challenge-Response, Slot 2.
5. Test the unlock with each key. Lose every key with that secret, and the database is gone for good.

If the GPG PIN prompt freezes

The usual cause on a Mac: pinentry-mode loopback in ~/.gnupg/gpg.conf, or a leftover GPG Suite install fighting Homebrew's gpg. The fix:

1. Check which gpg points to Homebrew (/opt/homebrew/bin/gpg), not /usr/local/MacGPG2. Uninstall GPG Suite if it is there.
2. Comment out pinentry-mode loopback in gpg.conf and allow-loopback-pinentry in gpg-agent.conf.
3. Make sure gpg-agent.conf has exactly 1 pinentry-program line, pointing to pinentry-mac.
4. Restart: gpgconf --kill scdaemon; gpgconf --kill gpg-agent, then unplug and replug the key.

The drduh guide: GPG keys with an offline backup

25 Oct 2026 drduh/YubiKey-Guide is the community reference for GnuPG and SSH on a YubiKey: about 12,700 stars on GitHub, MIT licence, updated the day I read it. It is long (2,300 lines) and written for Linux. What follows is what it adds to the Opsek cheatsheet, and where the 2 disagree.

The big difference: where the key is born

Opsek generates the GPG key on the card. drduh generates it on an offline computer, makes an encrypted backup, then moves the key to the YubiKey. Both are valid. They protect against different things:

My take: for signing commits and SSH only, on-card is simpler and loses nothing worth keeping. For encrypting files you need in 10 years, drduh's backup is the safer bet.

How drduh structures the keys

The expiry is the point: a lost YubiKey stops working on its own after 2 years. To keep going, you renew the subkeys (same keys, new date, simpler) or rotate them (new keys: old files need re-encrypting). Both need the offline Certify key. OpenPGP has no forward secrecy, so neither protects files already encrypted to a stolen key.

The setup, condensed

1. Buy a model with OpenPGP. The Security Key series and the YubiKey Bio don't have it. Check the key at yubico.com/genuine.
2. Prepare 2 USB drives or microSD cards for the encrypted backup, kept in 2 places.
3. Use a clean environment. drduh ranks 7, from a borrowed computer (worst) to an air-gapped Raspberry Pi (best). The practical baseline is Debian Live booted from USB, with the internal disk and the Wi-Fi card disconnected. Apple Silicon Macs don't boot Debian Live, so on a Mac-only desk that means a Raspberry Pi or an old Intel PC.
4. Create the Certify passphrase from capitals and digits only, 24 characters in groups of 4, so it's easy to write by hand. drduh's generator:

LC_ALL=C tr -dc "A-Z3-9" < /dev/urandom | tr -d "IOUS5" | head -c 24 | fold -w 4 | paste -sd - -

1. Create the Certify key, then the 3 subkeys. drduh recommends RSA 4096, with Ed25519 for the authentication subkey when an SSH server refuses RSA. Opsek uses Curve25519 for all 3. Both work on firmware 5.2.3 and later. Curve25519 is faster on the card; RSA 4096 works with older software.
2. Back up the Certify key, the subkeys and the public key to the encrypted drives. The Certify key file alone is enough for a full recovery.
3. Change the PINs and set the retries (see below), then move the subkeys to the YubiKey with keytocard. GnuPG deletes them from the computer and keeps a stub that points to the card.
4. Repeat step 7 for the backup YubiKey from the backup, then wipe the working copy.

PINs: what locks, what destroys

• Raise the retries if a lockout worries you more than guessing: ykman openpgp access set-retries 5 5 5.
• Turn on KDF first. With kdf-setup in gpg --card-edit, the computer sends a hash of the PIN to the card, not the PIN itself. It must be done before you change the PINs or load keys. Old GnuPG versions and mobile apps can't use it.
• Don't put your name or email in the card's Login field. Anyone holding the key can read the card's data without a PIN. drduh sets a random label instead.

2 YubiKeys with the same key

With drduh's method both keys carry the same subkeys, so GitHub, servers and encrypted files see 1 identity. The catch: GnuPG's stub remembers the serial number of the last card it saw, and asks for that card by name ("Please insert the card with serial number..."). To switch to the other key:

gpg-connect-agent "scd serialno" "learn --force" /bye

With drduh's method, this replaces switching user.signingkey between 2 key IDs, as the on-card setup needs.

Touch, and a correction

drduh agrees with Opsek: by default, nothing needs a touch once the User PIN is cached. Set touch on all 3 slots:

ykman openpgp keys set-touch sig on    # signing
ykman openpgp keys set-touch dec on    # decryption
ykman openpgp keys set-touch aut on    # SSH

25 Oct 2026 Correction to the file-encryption block earlier in this note: since YubiKey Manager 5.1, the encryption slot is called dec. The old name enc still works as an alias, but Yubico's source says it goes away in ykman 6. drduh suggests cached for email clients, so a batch of messages needs 1 touch.

Smaller tips worth keeping

• Loopback isn't always wrong. drduh's setup commands pass --pinentry-mode loopback on the command line, on the offline machine, to script the steps. Opsek's warning is about the permanent setting in ~/.gnupg/gpg.conf on your daily Mac. Both are right.
• The cccccc string. A short touch types a Yubico OTP code by default. drduh turns the whole OTP application off with ykman config usb -d OTP. Don't, if you use KeePassXC: challenge-response lives in the same application. Delete only slot 1 instead: ykman otp delete 1.
• Unexpected PIN prompts during SSH: add disable-application piv to ~/.gnupg/scdaemon.conf, so GnuPG stops talking to the PIV applet.
• Signing fails after 2 years: "Unusable secret key" usually means the subkeys expired. Renew them from the Certify key.
• Lost the public key: it can be rebuilt from the YubiKey (Nick Sherlock's method).
• Wipe and start again: ykman openpgp reset clears the OpenPGP applet only. Passkeys and the other applications stay.

Do you need GPG at all?

drduh lists the alternative itself: for SSH alone, a FIDO2 key (ed25519-sk, as in the agents section of this note) needs no GnuPG at all, and Git can sign commits with that same SSH key. GPG earns its complexity when you also want file and email encryption, or 1 identity on several keys with a recovery path. That is where drduh's guide is the one to follow.

Pros and cons

Pros:

• Phishing-proof sign-in for every service that supports passkeys or security keys.
• USB-C and NFC in one key: Mac, PC and iPhone with no adapter.
• Everything in one device: passkeys, TOTP, PIV and OpenPGP.
• Tough: IP68, crush resistant, no battery. It lives on a key ring.
• Large capacity on firmware 5.7 and later: 100 passkeys, 64 codes.

Cons:

• Firmware can't be updated. A flaw means a new key.
• You need 2, so the real price is about €138.
• Account-by-account setup. Each service needs its own registration, on both keys.
• Closed firmware. Nitrokey is the open-source alternative.
• More than most people need: if passkeys are all you use, the Security Key Series does the job for half the price.

Alternatives

Prices from Yubico's German store, 23rd October 2026:

Outside Yubico, Nitrokey 3 offers open-source firmware that can be updated, and Token2 sells cheaper FIDO2 keys from Switzerland.

Buying

• Yubico direct: YubiKey 5C NFC, €69.02, 45-day returns.
• Official German resellers listed by Yubico: BerryBase, OMG.de and Alternate.
• Avoid marketplace sellers you can't verify: a security key is only as trustworthy as its supply chain.

Verdict

The YubiKey 5C NFC is the default hardware key for anyone on Mac, USB-C and iPhone. Buy 2, register both on the accounts that matter most (Apple, Google, Microsoft, the password manager, email), and use passkeys wherever a service offers them. If you only ever need passkeys, the €34.51 Security Key C NFC is the cheaper way to the same protection.

Further Reading

YubiKey 5C NFC | Yubico

Product page, price, full specifications and compatible services

https://www.yubico.com/de/product/yubikey-5-series/yubikey-5c-nfc/

5.8 Firmware Specifics | YubiKey Technical Manual

What firmware 5.8 adds

https://docs.yubico.com/hardware/yubikey/yk-tech-manual/yk5-firmware-5.8.html

About Security Keys for Apple Account

Apple Support: requirements and setup

https://support.apple.com/en-us/102637

Opsek/Yubikeys-cheatsheet

How to use YubiKeys properly: setup, signed commits, file encryption, KeePassXC

https://github.com/Opsek/Yubikeys-cheatsheet

drduh/YubiKey-Guide

Community guide to using YubiKey for GnuPG and SSH: offline keys, backups, subkeys, hardening

https://github.com/drduh/YubiKey-Guide

• Set up your YubiKey, Yubico
• SafeCheck, Opsek: which apps and platforms support security keys
• Works with YubiKey catalogue, the services that support it
• Security advisory YSA-2024-03 (EUCLEAK), Yubico