Bitwarden supports two-step login via YubiKey. Any YubiKey that supports OTP capabilities can be used. This includes all YubiKey 4 series devices as well as YubiKey NEO.
Due to platform limitations, YubiKeys cannot be used on all Bitwarden applications. You should enable another two-step login provider so that you can access your account when YubiKeys cannot be used.
- Web vault on a device with a USB port that can accept your YubiKey.
- Browser extensions on a device with a USB port that can accept your YubiKey.
- Desktop app on a device with a USB port that can accept your YubiKey.
- CLI on a device with a USB port that can accept your YubiKey.
- Android on a device with NFC capabilities or a USB port that can accept your YubiKey. Read more here.
- iOS on a device with NFC capabilities.
Enable Two-step Login with YubiKey
Two-step login can permanently lock you out of your account. It is very important that you write down and keep your two-step login recovery code in a safe place in the event that you lose access to your YubiKey.
- Log in to the web vault at https://vault.bitwarden.com
- Click Settings on the sidebar. Click Two-step Login in the sub-menu that opens under Settings.
- Select the YubiKey OTP Security Key option and then type in your master password to continue.
- Follow the instructions shown:
- Plug the YubiKey (NEO or 4 series) into your computer’s USB port.
- Select in the first empty Key input field.
- Touch the YubiKey’s button.
Repeat this process for each YubiKey you wish to add to your account. You can add up to three YubiKeys to your account.
- If you are using a YubiKey that has NFC capabilities (YubiKey NEO), check the One of my keys supports NFC checkbox. This option enables the use of your YubiKey on Android devices that support NFC.
- Click the Enable button. A green alert will appear at the top stating that two-step login has been enabled.
- Click the Close button and confirm that the YubiKey OTP Security Key option now shows as Enabled.
- IMPORTANT: Ensure that you have copied down your two-step login recovery code in case something goes wrong.
- Log out of the Bitwarden web vault.
- Log back into the Bitwarden web vault. You should now be prompted with a YubiKey two-step login option. Insert your YubiKey and touch it’s button to complete logging in.
Log out of and back in to any other Bitwarden applications that you are using to confirm that two-step login via YubiKey is properly working. You will eventually be logged out automatically. If the application (or device) your are using does not support YubiKey you will be presented with other two-step login options that you have configured (if any).
If you are having trouble getting the YubiKey NEO to work on your Android device, confirm the following:
- You have checked the One of my keys supports NFC checkbox from step 5 above.
- Your Android device supports NFC and is known to work properly with YubiKey NEO.
- You have NFC enabled on your Android device. Enable NFC by going to Android Settings → More and enable the NFC option.
If the YubiKey NEO can be used on your Android device you will be prompted with a YubiKey option while logging in to Bitwarden. Simply place the YubiKey NEO on the back of your Android device near the NFC receiver. If you do not know where your NFC receiver is located, you may need to move it around some, trying different areas. Once Bitwarden detects the YubiKey it will automatically validate and log you in.