Yubi Key Manager is a utility for configuring and inspecting hardware security keys, covering FIDO2 PINs, one-time password slots, PIV certificates, and the USB and NFC interfaces each key exposes, through a graphical window or a command line.
Yubi Key Manager is the administration tool for hardware security keys, used to configure what the device does before it is handed to an account, an application, or a colleague. It reads the key that is currently plugged in, shows its serial number and the applications it supports, then exposes each configurable area separately: the FIDO2 PIN, the two one-time password slots, PIV certificate slots, and the transport interfaces themselves. Settings are written directly to the device, so the same tool is used to provision a new key, adjust an existing one, or wipe a configuration before the hardware is reassigned to someone else.
Yubi Key Manager offers two front ends for the same underlying operations. A desktop window suits occasional tasks such as setting a PIN or checking which key is connected, while the command-line interface handles scripted provisioning across many keys, exports and imports certificates, and fits into automated enrolment. Both talk to the device through the standard interfaces, so no vendor account or network connection is involved. Administrators often prepare a batch of keys the same way and label them afterwards, the way teams that also standardise creative tools keep a consistent setup across a studio; even a drawing-focused application such as CLIPSTUDIOPAINT benefits when the machine it runs on is guarded by a hardware key.
The reason to keep Yubi Key Manager installed rather than configuring keys once and forgetting about them is that hardware keys change owners, purposes, and policies over time. A key bought for personal two-factor authentication can later be repurposed for smart card logon, a shared device needs its one-time password slots cleared before it is passed on, and a misplaced key must be reset so its credentials cannot be reused. Doing that work through a documented interface is safer than guessing at hidden commands, and disabling transports a key does not need reduces the attack surface without affecting the features that are actually in use. Because configuration is written to the device itself, settings travel with the hardware rather than living in a profile on one computer.
Key capabilities and highlights.
Connected keys are listed with their serial numbers, so a workstation with several devices attached can be checked before anything is changed. Selecting a key shows which applications it supports, which prevents attempts to configure features the hardware does not actually provide.
The FIDO2 PIN can be set, changed, and unblocked from the interface, and the FIDO applications can be reset when a key is reassigned. Because that PIN protects the WebAuthn credentials and passkeys stored in the device, managing it directly matters when a user forgets it.
Two programmable slots cover short and long touch actions, and each can be programmed with Yubico OTP, OATH-HOTP, a static password, or challenge-response. Slot settings can be cleared or reprogrammed, and NFC behaviour can be configured on keys that support contactless use.
PIV certificate slots can be populated with imported or generated keys and certificates, and the PIN, PUK, and management key can be changed. Touch policy settings control whether physical contact is required for each operation, which suits smart card logon and code signing.
USB and NFC transports can be switched on or off individually, and the applications exposed over each interface can be limited to the ones in use. Narrowing those options reduces the attack surface and avoids compatibility surprises when a key is used with different systems.
The same operations are available from a command line, which makes them scriptable. Enrolment scripts can set PINs, import certificates, and configure slots across a batch of keys, turning a repetitive manual process into a documented and repeatable one.
An already-configured key can be examined without changing anything, which answers practical questions such as which slots are programmed, which certificates are present, and which interfaces are enabled. That visibility is useful during audits and when inherited hardware is brought into service.
Configurations can be wiped so that a key can be handed to another person or repurposed for a different role. Resetting the FIDO applications, clearing OTP slots, and removing PIV credentials returns the device to a state that no longer carries the previous owner's access.
Browse historical releases and previous builds.
Common questions about Yubi Key Manager.
It configures and inspects hardware security keys: setting or changing FIDO2 PINs, programming the one-time password slots, managing PIV certificates and PIN codes, and choosing which USB and NFC interfaces the key presents to a computer.
It is built for YubiKeys and is used to manage their applications. Keys from other manufacturers that speak the same standards are generally configured through the browser or the operating system rather than through this tool.
Both are provided. A desktop window covers everyday tasks such as setting a PIN or checking a serial number, while the command-line interface adds scriptable operations for provisioning several keys in exactly the same way.
Yes. PINs for FIDO2 and for PIV can be changed, and the PUK and management key used by PIV can be updated as well. If a FIDO2 PIN is forgotten, the retry counter can be reset, which erases the credentials stored on that key.
No. The tool reads and writes settings on the key itself and does not maintain a vault of credentials. Once configuration is complete, the utility does not need to be running for the key to be used for authentication.
Yes. Each transport can be switched on or off, and the applications offered over each interface can be limited. Turning off what is not needed reduces the number of ways the key responds, which is a common hardening step.
No. The tool cannot retrieve credentials from an absent key. Resetting the FIDO applications or clearing slots returns a key to a clean state, so the practical response to a lost key is to remove it from your accounts and continue with a spare.
Yubi Key Manager is a utility for configuring and inspecting hardware security keys, covering FIDO2 PINs, one-time password slots, PIV certificates, and the USB and NFC interfaces each key exposes, through a graphical window or a command line.
Microsoft.Azure.ArtifactSigningClientTools is the Windows package that installs the Artifact Signing client plugin, letting SignTool sign code and artifacts through Azure without a local certificate.
Microsoft Safety Scanner is a free, portable on-demand scanning tool from Microsoft that finds and removes malware, spyware, and unwanted software from Windows PCs without installing anything.
1Password CLI is a command-line tool that reads secrets from a 1Password account and injects them into scripts, environment variables, and configuration files at runtime, so no plaintext credential has to be stored on disk.
Element is a Matrix-based secure messenger and collaboration app with end-to-end encryption, group calls, and file sharing. It targets individuals, teams, and public institutions that want to self-host their own messaging network instead of renting one.
Comments