Resetting a Yubikey

Tags MFA yubikey

Procedure for resetting individual YubiKey applications when a personal identification number (PIN) has been forgotten or when preparing the key for reassignment. Each application resets independently, and most resets erase all credentials stored under that application.

Detailed Information

IMPORTANT: Resetting a YubiKey application is destructive. It permanently erases all credentials stored under that application, including any non-UMS keys you have stored on the Yubikey. After resetting, every service registered with the affected application must be re-enrolled. Confirm that you have backup authentication methods or recovery codes available for those services before proceeding.

Each YubiKey application (FIDO2, Personal Identity Verification (PIV), OATH, OpenPGP) is reset independently. Resetting one application does not affect the others. All commands below use the YubiKey Manager command-line tool (ykman).

Before you begin

  • Identify which application is locked or needs to be reset. The FIDO2 PIN, PIV PIN, OATH password, and OpenPGP PIN are separate credentials with separate reset procedures.
  • List the services registered with that application so you know what to re-enroll afterward.
  • Confirm you have backup authentication methods (recovery codes, a backup security key, or another second-factor method) for each affected service.
  • Have the YubiKey physically available. Most reset commands require a fresh USB insertion and a physical touch to confirm.

Reset the FIDO2 application

Use this procedure when the FIDO2 PIN is forgotten or the FIDO2 application is locked after eight consecutive wrong PIN entries.

WARNING: A FIDO2 reset erases all passkeys, resident credentials, and Universal 2nd Factor (U2F) registrations on the YubiKey. Every site where this key was registered will need to be re-enrolled.
  1. Unplug the YubiKey from the computer.
  2. Plug the YubiKey back in. The reset command must run within approximately 5 seconds of insertion.
  3. Run the reset command: 
    ykman fido reset
  4. When prompted, touch the YubiKey to confirm.
  5. Set a new FIDO2 PIN: 
    ykman fido access change-pin
  6. Re-enroll the YubiKey with each affected service.

Reset the PIV application

Use this procedure when the PIV PIN and PIN Unblock Key (PUK) are both forgotten or the management key has been lost.

WARNING: A PIV reset erases all certificates and private keys stored in PIV slots, and restores the PIN, PUK, and management key to factory defaults. Any certificates issued to the key must be reissued or regenerated after the reset.

If only the PIV PIN is forgotten but the PUK is known, unblock the PIN without a full reset:

ykman piv access unblock-pin

To perform a full PIV reset:

  1. Run the reset command: 
    ykman piv reset
  2. Confirm the prompt to proceed. After reset, the PIN is 123456, the PUK is 12345678, and the management key is the documented default.
  3. Immediately change all three values: 
    ykman piv access change-pin
ykman piv access change-puk
ykman piv access change-management-key --generate --protect
  4. Regenerate or reimport any required PIV certificates.

Reset the OATH application

Use this procedure when the OATH password is forgotten.

WARNING: An OATH reset erases all stored Time-based One-Time Password (TOTP) and HMAC-based One-Time Password (HOTP) credentials. Each account whose TOTP secret was stored on the key must be re-enrolled using its original setup procedure or recovery codes.
  1. Run the reset command: 
    ykman oath reset
  2. Confirm the prompt to proceed.
  3. Optionally set a new OATH password: 
    ykman oath access change
  4. Re-add each TOTP or HOTP account.

Reset the OpenPGP application

Use this procedure when the OpenPGP user PIN and admin PIN are both forgotten, or when the OpenPGP application is locked after repeated failed PIN entries.

WARNING: An OpenPGP reset erases all stored OpenPGP keys (signing, encryption, and authentication subkeys) and restores both PINs to their defaults. Encrypted data that depended on the on-card encryption key will become inaccessible unless decrypted copies of the keys are held elsewhere.
  1. Run the reset command: 
    ykman openpgp reset
  2. Confirm the prompt to proceed. After reset, the user PIN is 123456 and the admin PIN is 12345678.
  3. Change both PINs immediately: 
    ykman openpgp access change-pin
ykman openpgp access change-admin-pin
  4. Reimport or regenerate OpenPGP keys as required.

Resetting the entire YubiKey configuration

There is no single command that resets every application at once. To return a YubiKey to a fully factory state, run the reset command for each application in turn, and reset any OTP slots that have been programmed:

ykman fido reset
ykman piv reset
ykman oath reset
ykman openpgp reset
ykman otp delete 1
ykman otp delete 2

After completing all resets, re-enable any applications that were disabled and reapply your standard configuration.

Common issues

Symptom What to check
FIDO2 reset fails with a timing or "not allowed" error The reset must run within approximately 5 seconds of plugging the key in. Unplug the key, plug it back in, and immediately rerun ykman fido reset.
FIDO2 reset prompts but no touch is detected Touch the metal contact on the YubiKey when it begins blinking. On YubiKey 5C Nano and similar small-form-factor models, the touch area is the entire visible surface.
ykman reports "No YubiKey detected" Confirm the key is fully inserted, try a different USB port, and verify that the YubiKey Manager service or daemon is running. On Linux, verify udev rules grant your user access to the device.
PIV reset is refused The PIV application only allows reset when both the PIN and the PUK are blocked (typically after exhausting all retries on both). If either still has retries available, reset is not permitted as a safety measure.
Multiple YubiKeys connected and the wrong one is reset Specify the target key by serial number with --device, for example ykman --device 12345678 fido reset.

Additional resources

Environment

  • YubiKey 5 Series
  • Security Key Series
  • YubiKey Manager (ykman) command-line tool
  • Windows, macOS, and Linux
Print Article