YubiKey vs Nitrokey: which security key to buy

If you want the most widely supported security key, buy a YubiKey 5. If you want open-source hardware and firmware from a European maker, buy a Nitrokey 3. For plain FIDO2 login and passkeys, both do the job equally well, so the decision comes down to openness, ecosystem, firmware updates and price. This comparison is an editorial assessment based on manufacturer documentation, published release notes and shop prices as of October 2026, not a laboratory test. For single reviews see our pages on the YubiKey 5 and the Nitrokey 3.

Side by side

	YubiKey 5 series	Nitrokey 3
Maker and origin	Yubico, Sweden and USA	Nitrokey, Germany (mainly Berlin)
FIDO2 / U2F	Yes	Yes
Passkey storage	Up to 100, according to Yubico (current firmware)	A few dozen on NFC models, up to 100 on the 3A Mini
Connectors	USB-A, USB-C, NFC, Lightning on one model, Nano versions	USB-A, USB-C, NFC on the NFC models
OpenPGP	Yes	Yes, three key pairs
PIV smart card	Yes	Yes, up to 24 key pairs
One-time passwords	Yes (Yubico OTP, TOTP, HOTP via Yubico tools)	TOTP and HOTP
Firmware	Closed, fixed at production (5.8 on current keys)	Open source (Rust), updatable
Hardware design	Closed	Open
Price (October 2026)	About 68 to 99 EUR depending on model and country	About 54 to 65 EUR

Yubico’s store lists six variants of the YubiKey 5 series between about 68 and 99 EUR, including the YubiKey 5 NFC, 5C NFC, 5C, the Nano versions and the 5Ci with Lightning, with prices shown including VAT and differing by country. Nitrokey’s shop lists the Nitrokey 3 from about 54 EUR, the 3A NFC at 60 EUR and the 3C NFC at 65 EUR.

What they have in common

Both keys do what you most likely buy a key for: phishing-resistant sign-in through FIDO2 and WebAuthn. The browser sends the real website address to the key, so a fake page gets nothing useful. Both can store passkeys on the key (discoverable credentials) and both can act as a second factor for services that only support U2F. Both offer NFC models for tapping on a phone, and both support PIV and OpenPGP, which matter for smart-card logins and email encryption with GnuPG. If your needs end at logging into accounts, you will not notice a difference in daily use. The principles are in our guides to hardware security keys and phishing-resistant MFA, and the protocol side is in FIDO2 and WebAuthn.

Where the YubiKey is stronger

Ecosystem and support. Yubico has been building keys for many years, and nearly every service, password manager and enterprise tool documents the YubiKey. When an IT department says “we support security keys”, it often means YubiKeys. That reduces friction and makes help easier to find.

Range. Yubico offers more form factors, including the Nano versions that stay in a laptop port and a Lightning model for older iPhones. A separate YubiKey Bio line exists for fingerprint-based keys.

Extra application tools. Yubico supplies its own management and authenticator software and an extensive documentation portal. The keys also store one-time-password credentials for services that still use them.

Passkey capacity. Current YubiKey 5 firmware stores more passkeys than the Nitrokey 3’s NFC models, according to the vendors’ documentation.

Where the Nitrokey is stronger

Openness. Nitrokey publishes hardware designs and firmware. The firmware is written in Rust and built on the Trussed framework, and a secure element (SE050) handles sensitive operations. You, or an auditor you trust, can read what runs on the key. With a YubiKey, you rely on Yubico’s published information and third-party research.

Firmware updates. Nitrokey 3 firmware can be updated, so a fix does not require a new device. YubiKey firmware cannot be changed after production, which is a security design choice by Yubico but means a flaw is solved only by replacement.

European production. For organisations with a European sourcing preference, Nitrokey’s German production is a clear point, whereas Yubico operates in Sweden and the USA.

Price. The Nitrokey 3 is cheaper than most YubiKey 5 models, at about 54 to 65 EUR.

Where each falls short

• YubiKey: closed firmware and hardware, firmware that cannot be updated, and a higher price. A good fit if you do not need to inspect the code.
• Nitrokey: a smaller passkey capacity on the NFC models, a more technical setup for OpenPGP and PIV, a narrower range of form factors and smaller stock. FIDO2 level 1 certification is reported for the Nitrokey 3A Mini, while level 2 is still a project funded by the NLnet Foundation according to Nitrokey.

Which should you buy?

If you are…	Pick
A private user who wants the simplest, best-documented key	YubiKey 5C NFC or 5 NFC
A privacy-minded user who values open code	Nitrokey 3
An organisation that prefers European suppliers	Nitrokey 3 (or look at Swiss options in our overview of the best hardware security keys)
A GnuPG user who wants updates and verifiable firmware	Nitrokey 3
Someone who needs a Lightning or Nano form factor	YubiKey 5Ci or Nano
Someone on a tight budget	A cheaper FIDO2 key; see the Token2 review

Three questions that decide it

1. Do you need to inspect the code? If you or your organisation want to read the firmware and hardware design, only the Nitrokey offers that. If you are content to rely on a vendor’s statements and outside research, a YubiKey is fine.
2. Which devices will you use it with? For a mix of recent laptops and phones both work. If you have an older iPhone with a Lightning port, the YubiKey 5Ci is the specific option. If you want a key that stays in a laptop port, look at the Nano versions.
3. Do you use OpenPGP or PIV every day? If you do, test the workflow with both keys before you commit, because setup details, driver support and tools differ. If you only log in to websites, skip the question.

How we assessed it

This comparison draws on both manufacturers’ documentation, firmware release notes, shop listings and public statements on certification. We did not run lab tests, time logins or attack either device, and we do not give star ratings. Where numbers differ between sources, we state the range. Prices were read in October 2026 and vary by country and VAT, so confirm them in the shops.

The rule that matters more than the brand

Neither key helps if you lose your only one. Register two keys with each important account, store one at home safely, and set up a backup method such as recovery codes. Our guide to account recovery explains how to plan this so a lost key does not become a lockout.

Verdict

The YubiKey is the safe, mainstream choice. The Nitrokey is the choice for people who want to see what runs on their key. Because both implement the same open standards for logins, you are not locked in: you can buy one, register it, and add the other later as the backup.