Yubico

Overview

Yubico makes the YubiKey, the reference hardware security key and a co-author of the FIDO2 and WebAuthn standards that underpin phishing-resistant authentication. It is not an identity provider; it is the strongest authenticator you plug into one. When an organization gets serious about stopping credential phishing, the YubiKey is usually the answer.

What it is good at

Phishing resistance is the whole point. Because FIDO2 credentials are bound to the origin, they cannot be relayed by a fake login page or replayed, which defeats the attacks that beat passwords and OTP. A single key supports many protocols (FIDO2/WebAuthn, U2F, smart card/PIV, OATH, OpenPGP), works across every major IdP and operating system, and needs no battery or network. YubiEnterprise handles distribution and lifecycle at scale, and hardware keys are the recommended factor for executives and other high-value targets.

Where it falls short

It is hardware, so it carries hardware logistics: buying, shipping, registering, and replacing lost keys, which is awkward for pure consumer or bring-your-own-device scenarios where synced passkeys fit better. You need at least two keys per user for backup, adding cost. And it solves authentication only, so you still run an IdP for SSO, policy, and lifecycle.

Pricing

Transparent per-key hardware pricing across the YubiKey 5 and security key lines, with YubiEnterprise subscription for distribution and as-a-service delivery. Predictable and modest relative to the breach risk it removes.

Best for, and who should look elsewhere

Buy YubiKeys for workforce phishing-resistance, privileged users, and high-value targets, alongside your IdP (Okta, Entra, and others). For large consumer bases where mailing hardware is impractical, lead with device-bound or synced passkeys and reserve hardware keys for admins.

Bottom line

The gold-standard authenticator for phishing-resistant MFA. Pair it with your IdP rather than expecting it to be one.