How to Set Up a YubiKey for Email: Gmail, Outlook, Proton and Fastmail

A security key such as a YubiKey is the best lock you can put on your email. It is a small USB or NFC device that you touch to sign in, and it simply will not work on a fake login page. This guide shows you how to add one to Gmail, Outlook, Proton and Fastmail, when to use it as a passkey, and how to set up a spare so you never lock yourself out.

I first wrote this page about using a YubiKey with Proton Pass. People kept asking how the same key works with their other accounts, so I have turned it into a full guide. Proton Pass is still covered in detail below. I checked every step against each provider’s own help pages in November 2026, but menus do move, so if a button has a slightly different name on your screen, look for the nearest match.

What a Security Key Does

When you sign in, the website asks your key to prove who you are. The key only answers if the request comes from the real web address it was registered with. A look-alike page, however convincing, gets nothing, because the address does not match. You do not type a code, so there is no code to steal.

That is why a key beats the other second steps. All of them are far better than a password alone, but they can be got round in ways a key cannot:

Email is worth this extra step because it is the key to everything else. Whoever controls your inbox can reset the passwords on your bank, shopping and social accounts. I go into this more in It’s not if your email gets hacked, it’s when.

Second Step or Passkey?

A security key can sign you in two ways, and the words providers use for them overlap, which confuses a lot of people.

• As a second step (also called two-factor or two-step verification): you type your password, then touch the key. Nothing is saved on the key itself.
• As a passkey: the key holds a passkey for that account. You enter the key’s PIN, touch it and you are in, without typing a password. Each passkey uses one of the key’s storage slots.

Choosing a Key

For email you only need FIDO2, which every model below supports. Pick the connector that fits the devices you use most.

• USB-C with NFC is the safest choice today. It plugs into most laptops, iPads and Android phones, and taps on an iPhone.
• Buy two of the same model, so either one works everywhere the other does.
• Buy from Yubico or an authorised reseller, not a marketplace seller you don’t know. Prices change, so check there.
• Newer keys hold more passkeys. Keys with Yubico’s 5.7 firmware (sold since mid 2024) hold up to 100 passkeys. Older ones hold 25. Firmware can’t be upgraded, so that number is fixed for the life of the key. As a second step, a key has no limit at all.

Other brands such as Google Titan, Feitian and Token2 work in exactly the same way, because the standard is open. I use YubiKeys, so that is what I describe here.

Step 1: Set a PIN on Your Key

A PIN stops someone who finds your key from using it as a passkey. You only need to do this once per key, not once per account.

1. Plug in the key. On Windows, open Settings then Accounts then Sign-in options then Security key then Manage. On a Mac, or for a few more options, install the free Yubico Authenticator app and open Passkeys.
2. Choose to set a PIN and type one you will remember. It can be letters as well as numbers, at least four characters (six or more is better).
3. Do the same on your spare key. Using the same PIN on both is fine and easier to remember.

If you skip this, most websites will ask you to create a PIN the first time you save a passkey to the key, so you won’t miss it.

Step 2: Add Your Key to Gmail

Google lets you save a passkey on the key, so you can sign in without your password. You can also add it as a second step only.

1. On a computer, go to myaccount.google.com/security and sign in.
2. Under How you sign in to Google, choose Passkeys and security keys. Google may ask for your password again.
3. Select Create a passkey. When your browser offers to save it on this computer or phone, choose Use another device (sometimes shown as Security key or USB security key).
4. Insert your key, type its PIN and touch it when it flashes.
5. The key now shows in the list. Repeat steps 3 and 4 with your spare key.
6. Back on the security page, open 2-Step Verification, select Backup codes and print or write down the codes.

Step 3: Add Your Key to Outlook.com

These steps are for a personal Microsoft account, the kind you use with Outlook.com, Hotmail or Live.com. Work and school accounts are just below.

1. Go to account.microsoft.com/security and sign in.
2. Choose Manage how I sign in (on some accounts this is called Advanced security options or Sign-in methods).
3. Select Add a new way to sign in or verify, then Face, fingerprint, PIN or security key.
4. When Windows or your browser asks where to save the passkey, choose Security key (or Use another device), then USB or NFC.
5. Insert the key, type its PIN and touch it.
6. Give it a name you will recognise, such as “Keyring key”. Then repeat with your spare.

Microsoft 365 work and school accounts

1. Go to mysignins.microsoft.com/security-info.
2. Select Add sign-in method, then Passkey or Security key.
3. Follow the prompts to insert the key, enter its PIN and touch it. Add your spare the same way.

Step 4: Add Your Key to Proton Mail and Proton Pass

Proton uses your key as a second step after your password. One key protects every Proton service on that account: Mail, Pass, Drive, Calendar and VPN. Because Proton Pass signs in through the same account, adding a key here is the single best thing you can do to protect your password vault.

1. Sign in at account.proton.me, open Settings then All settings, then Account and password.
2. Under Two-factor authentication, turn on the Security key switch. Proton may ask for your password, and for your authenticator code if you already use one.
3. Insert the key and select Continue. Leave Allow platform keys unticked so you register the physical key.
4. Touch the key when your browser asks.
5. Give it a name, such as “Blue YubiKey, desk drawer”, and select Continue.
6. Repeat for your spare key. Then download your recovery codes when Proton offers them and keep them offline.

Next time you sign in, Proton asks for your password and then your key. If you have an authenticator app set up too, you can pick it instead from a tab on the same screen.

Using your key with Proton Pass on a phone

Proton’s guide says a key can be used in place of the code when you sign in to Proton Pass on a phone, either plugged in over USB or tapped over NFC. If Pass doesn’t pick the key up straight away, choose Use a different device, pick the type of key and tap or plug it in.

Step 5: Add Your Key to Fastmail

Fastmail lets you use a key either way: as a second step after your password, or as a passkey to sign in without one.

As a second step

1. Sign in on the web and open Settings then Privacy & Security.
2. If you haven’t already, add a recovery phone number. Fastmail needs one before it turns on two-step verification.
3. In Password & two-step verification, select Manage two-step verification, then Add verification device and choose a security key.
4. Insert the key, touch it and give it a name. Add your spare the same way.
5. Save the recovery code Fastmail gives you somewhere offline.

As a passkey

1. In Settings then Privacy & Security, find Passkeys and select Create a passkey.
2. When your browser asks where to save it, choose Security key or Use another device.
3. Enter the key’s PIN, touch it and give the passkey a name. Repeat for your spare.

Using Your Key on a Phone

Many people add a passkey on their phone as well, so they can sign in by face or fingerprint every day and keep the hardware keys for new devices and emergencies. That works well, as long as the phone is yours and locked.

Your Backup Plan

Losing access to your email is a bigger risk for most people than being hacked, so this part matters as much as the set-up.

• Register both keys on every account. A spare that was never added is no use.
• Keep the spare somewhere else. Not on the same keyring: in a drawer at home, or with someone you trust.
• Print or write down your recovery codes and keep them with your important papers. Don’t keep the only copy in the email account they unlock.
• Decide on a fallback. An authenticator app is weaker than a key, but it is a way back in. I keep one on my main accounts. If you are at high risk, you may prefer keys and codes only.
• Test the spare. Sign out, sign back in with the spare key, and make sure it works on each account.
• Keep a list of which accounts each key is on. When you add a new account, add both keys.

If You Lose a Key

1. Sign in to each account with your spare key, or your fallback.
2. Open the same security settings you used above and remove the lost key. Your provider shows them by the names you gave them, which is why good names help.
3. Buy a replacement, set its PIN and add it to every account, so you are back to two keys.

Without a spare or fallback, you will need a recovery code, or the provider’s account recovery process. That can take several days. With Proton, a password reset can also leave your older encrypted email unreadable unless you saved a recovery phrase or file. Someone who finds your key still needs your password, or the key’s PIN, to use it.

If It Didn’t Work

Frequently Asked Questions

Does Proton Pass support YubiKey?

Yes. Proton accepts FIDO2 and U2F keys, including YubiKeys, as a second step on your Proton account, and that covers signing in to Proton Pass on the web, computer apps and phone apps.

Can I use one YubiKey for all my email accounts?

Yes. One key can be added to Gmail, Outlook, Proton, Fastmail and hundreds of other sites. As a second step there is no limit. As a passkey, the limit is the key’s storage: 100 on newer YubiKeys, 25 on older ones.

Do I need a YubiKey 5, or will the cheaper Security Key do?

For email, the Security Key series does everything you need. The YubiKey 5 only adds features most people never use, such as storing authenticator codes or smart card certificates.

What happens if someone steals my key?

They still need your password, or the key’s PIN if it holds passkeys. Sign in with your spare and remove the stolen key from each account.

Can I use Face ID or Windows Hello instead of a physical key?

Yes. These are passkeys or platform keys stored on your device, and they are just as hard to phish. The difference is that they stay on that device, while a hardware key works on any computer you plug it into. I use both.

Does a security key stop every kind of attack?

No. It stops stolen passwords and fake login pages, which are behind most email break-ins. It can’t help if malware takes over a computer that is already signed in, or if someone talks your provider’s support team into resetting the account. Keep your devices up to date and your recovery details current.

The Bottom Line

A security key takes about ten minutes per account and closes off the most common way email gets broken into. Buy two, set a PIN, add both to every email account you care about, and put the recovery codes somewhere safe. If you are choosing a new provider with strong security, see my Proton Mail review and my Fastmail review.

Disclosure: This article contains affiliate links for Proton, Fastmail and Amazon. If you sign up or buy through them, I may earn a commission at no extra cost to you. As an Amazon Associate I earn from qualifying purchases. I have no affiliate arrangement with Google or Microsoft. I only recommend services I personally use and trust.

Note: checked and updated 1 November 2026. Sources: Proton: set up 2FA with a security key, Proton: FIDO2 on mobile, Google: sign in with a passkey, Google: use a security key for 2-Step Verification, Microsoft: signing in with a passkey, Microsoft: register a passkey on a security key (work accounts), Fastmail: introducing passkeys, Yubico: 5.7 firmware.