Yubico Authenticator - Secure credential management

About Yubico Authenticator

Yubico Authenticator is a cross-platform authenticator app developed by Yubico AB for generating and managing two-factor authentication credentials with a YubiKey. Unlike standard TOTP apps that store secrets on the phone, the Yubico Authenticator app keeps OATH credentials inside the secure element of the YubiKey.

Available on Windows, macOS, Linux, iOS, iPadOS, and Android, the app works over USB, Lightning, and NFC.

Core store features:

Generate OATH TOTP / HOTP codes for any service compatible with Google Authenticator

Add accounts by scanning a QR code or manual entry

Store secrets on the YubiKey, not on the device

Manage FIDO2 passkeys and FIDO2 PIN

Load and manage PIV certificates, including Smart Card on iOS

Configure Yubico OTP slots, static passwords, challenge-response

Toggle YubiKey apps, rename keys, switch between connected keys

Optional password protection for the OATH section

How to Use Yubico Authenticator：

The Yubico Authenticator app is built around “connect key → view code”. It does not keep accounts in the cloud.

Setup guide:

Enable 2FA on the service and choose authenticator app.

A QR code appears on the service page.

Open Yubico Authenticator on desktop or mobile.

Go to Accounts → Add account → Scan QR code.

Plug in the YubiKey over USB/Lightning, or tap over NFC on supported phones.

Save the credential to the YubiKey.

Copy the generated code back into the service to confirm.

Daily use:

Desktop: insert YubiKey → code shows next to the account

iOS/Android NFC: pull down or tap the key → code appears

Optional Require touch: the YubiKey must be touched before the code displays

OATH password: enable it in app settings to lock stored credentials

Tip for store copy: the Yubico Authenticator app can be reinstalled on any device — the accounts come from the key, not the app.

Yubico Authenticator FAQ

Do I need a YubiKey?

Yes for OATH codes. The Yubico Authenticator app requires a YubiKey 5 Series (or compatible YubiKey) because the secret is stored on the hardware.

Where are my codes stored?

In the YubiKey secure element. The app itself does not extract or sync the secrets.

What if I lose my phone?

Download Yubico Authenticator on the new device and connect your YubiKey — credentials are unchanged.

Can I set a FIDO2 PIN in the mobile app?

Desktop and Android can manage FIDO2; the iOS app has limited FIDO2 PIN setup. Passkeys and fingerprints are managed per platform.

Which YubiKeys support biometrics?

Fingerprint management is available in Yubico Authenticator for Desktop / Android with YubiKey Bio Series keys.

Why Yubico Authenticator Is Safer？

The biggest difference vs other authenticator apps is the hardware root of trust.

Hardware-backed security — credentials cannot be extracted from the YubiKey

Portable across devices — one key works on Windows, macOS, Linux, iOS, Android

No lockout on phone upgrade — reinstall the app, plug in the key

Self-service enrollment — no IT reset needed when switching phones

Touch / NFC confirmation — code only appears when the key is present

The Yubico Authenticator app is best described as:

“The authenticator app that stores your 2FA secrets on a YubiKey instead of your phone.”