Yubico Authenticator

Yubico Authenticator generates two-step verification codes for online accounts on mobile and desktop devices. It supports TOTP and HOTP, and users can add credentials by scanning QR codes from services they want to protect. Credentials are stored in a YubiKey secure element; Yubico says they cannot be extracted. Since the credentials stay on the portable YubiKey, the same codes can be used from the desktop and mobile apps. The mobile app supports tap-and-go authentication on NFC-enabled devices, and credentials can be added to a YubiKey with a touch or NFC tap. Yubico says users can unlock a YubiKey with Face ID or Touch ID. The app can display OATH codes and manage a YubiKey’s FIDO PIN or perform a factory reset. It is free and open-source software, listed as free, for Windows, macOS, Linux, iOS/iPadOS, and Android. Generating and displaying OATH credentials with the desktop app requires a YubiKey. Yubico provides a user guide in its product documentation.

Yubico Authenticator provides two-step codes across mobile and desktop, with credentials held on a YubiKey. Desktop OATH code use requires that key, and the listed capabilities do not include push approvals or encrypted backup.

It suits people who want two-step verification codes on mobile and desktop while keeping credentials on a YubiKey. Desktop users who need to generate and display OATH credentials must have a YubiKey.

Overview

Yubico Authenticator is a free companion app for generating two-step verification codes with a YubiKey. It is best suited to people who want their code credentials tied to a hardware key; users seeking app-only access or cloud recovery should look elsewhere.

It works with services that accept standard authenticator codes, including Google Authenticator-compatible services. Yubico cites Azure MFA TOTP for Office 365 as one example.

Key features

Codes anchored to a YubiKey

The app generates OATH codes using TOTP and HOTP, and accounts can be added by scanning a QR code from the service being protected. Credentials reside in the YubiKey secure element; Yubico says they cannot be extracted. That design keeps the key central to access, but also means losing or leaving it behind can interrupt code use. Desktop OATH code generation and display require a YubiKey.

Yubico says the same credentials work across its desktop and mobile apps by moving the key between devices. That is practical for someone carrying one key between phone and computer, but it is not multi-device sync or an encrypted backup. There are no push approvals, either, so this is for code-based verification rather than approval prompts.

Mobile and key controls

On NFC-enabled devices, the mobile app supports tap-and-go authentication, and credentials can be added to a YubiKey by touch or NFC tap. Yubico says Face ID or Touch ID can unlock the key. The app also manages a YubiKey’s FIDO PIN and can perform a factory reset, giving it a role beyond displaying codes.

Pricing

Yubico Authenticator: free. The free, open-source software has no free trial because it is free; its practical cost is the required YubiKey, which must store credentials and generate OATH codes. This suits existing YubiKey owners especially well. Anyone buying a key solely for authenticator codes should factor in that hardware purchase, and should not mistake the app’s free price for standalone code generation.

Platforms

Yubico Authenticator supports Windows, macOS, Linux, iOS/iPadOS and Android. That range makes it usable across desktop and mobile, while the portable key provides the bridge between them. Mobile NFC functions require an NFC-enabled device.

Who it's for

Choose it if you already use a YubiKey and prefer TOTP or HOTP credentials kept on its secure element, with access from Yubico’s mobile and desktop apps. It is a poor fit if you need codes without the hardware key, push-based approvals, cloud synchronization or encrypted backup.

Pros and cons

• Pros: Credentials stay in the YubiKey secure element, which Yubico says prevents extraction; one portable key can make codes available across mobile and desktop.
• Pros: QR-code setup, NFC access, biometric unlock claims and FIDO PIN management cover useful phone and key workflows.
• Cons: A YubiKey is required to store credentials and generate OATH codes, and desktop code display depends on it.
• Cons: There is no multi-device sync, encrypted backup or push approval, so it offers fewer recovery and approval routes than an app-based approach.

Alternatives

For a broader comparison, browse Authenticator apps or Security Keys.

• SafeNet MobilePASS+ is a paid option for Android, iOS, macOS and Windows.
• HID Approve is a paid consumer and workforce authentication option, offered through a mobile app or SDK deployment, with custom pricing.
• YubiKey 5 Series is a paid hardware-key alternative for people comparing YubiKey models; the 5C NFC and 5 NFC are each $58, paid once, while the 5C is $65.
• FEITIAN ePass FIDO-NFC Security Key costs $35, paid once and combines NFC, FIDO U2F/FIDO2 and HOTP/TOTP.
• FEITIAN Mobile Authenticator has quotation-based pricing and supports Android, iOS and Windows.
• Token2 PIN+ Release3.3 costs $24.70, paid once for the USB-A plan, which supports FIDO2.1/WebAuthn, U2F, PIV, OpenPGP and TOTP/HOTP, with up to 300 resident keys.
• Token2 T2F2-NFC-Slim is another paid option available for Android, iOS, Linux, macOS, web and Windows.
• Deepnet SafeKey is a paid option for web, Windows, macOS, iOS and Android.

Verdict

Yubico Authenticator is a strong fit for YubiKey owners who want OATH codes kept on the hardware they carry, with mobile and desktop access through that key. Its central trade-off is decisive: without the YubiKey, code generation is unavailable, and there is no sync, encrypted backup or push approval. Choose it for key-bound credentials; look elsewhere if flexibility or recovery without the key matters more.