YubiKey Alternatives Worth Considering

You already own one YubiKey, or you've priced one out and balked at paying €69 twice for a backup. You don't have to buy Yubico again — several other vendors sell FIDO2 keys that cost less, ship with open-source firmware, or bundle in a password manager. Here's what each one actually gets you, and what it quietly gives up.

TL;DR

Google Titan (~$30–35) is the cheapest mainstream pick, but it only speaks FIDO2/U2F — no OpenPGP, PIV, or SSH support like YubiKey has.
Nitrokey 3 (~$59) is the open-source firmware option and matches YubiKey's SSH/OpenPGP support, at roughly the same price.
Feitian ePass (~$25–35) is the cheapest way to buy 2–3 backup keys, with the same protocol tradeoff as Titan.
OnlyKey adds on-device password storage to a FIDO2/U2F/TOTP key — useful only if you don't already run a password manager.
None of these beat YubiKey on protocol breadth; they beat it on price, openness, or one specific feature.

KEY-STAT: 3 — the number of protocols (OpenPGP, PIV/Smart Card, SSH) that most YubiKey alternatives drop to hit a lower price. Check this list before you buy a cheaper key for the wrong reason.

What to check before switching away from YubiKey

Not every "YubiKey alternative" list mentioned in search results is actually comparable — several roundups mix in enterprise identity platforms like Microsoft Entra ID or Cisco Duo, which are software subscriptions for companies managing thousands of employee logins, not a physical key you buy once for yourself. Ignore those; this guide only covers hardware keys you can hold.

Before comparing prices, check three things against your own use case:

Protocol support. FIDO2/WebAuthn and U2F cover most consumer logins (Google, Microsoft, GitHub, password managers). OpenPGP, PIV/Smart Card, and OATH-TOTP are needed for SSH key auth, email signing, or enterprise smart-card login — YubiKey supports all of these; most budget alternatives support only FIDO2/U2F.
Connector type. USB-A, USB-C, and NFC availability varies model to model, same as the YubiKey 5 Series lineup.
Whether you need it to match your primary key. If your bank or employer requires a specific protocol, buying a backup key that doesn't support it defeats the point of having one.

Note

If you followed our YubiKey setup guide and registered SSH access via PIV or OpenPGP, a FIDO2-only backup key (Titan, most Feitian models, Thetis Pro) cannot serve as your SSH backup — only Nitrokey 3 or another YubiKey can.

Comparison table: YubiKey vs the alternatives

Key	Price (approx.)	Connectors	FIDO2/U2F	OpenPGP/PIV/SSH	Open-source firmware	Best for
YubiKey 5C NFC (baseline)	~€69	USB-C, NFC	Yes	Yes	No	Full protocol coverage
Google Titan	~$30–35	USB-A/C, NFC	Yes	No	No	Cheapest Google-ecosystem pick
Nitrokey 3	~$59	USB-C, NFC	Yes	Yes	Yes	Open-source, SSH/OpenPGP parity
Feitian ePass	~$25–35	USB-A/C, NFC	Yes	No	No	Cheap backup keys, bought in pairs
OnlyKey	~$50	USB-C	Yes	Partial (TOTP)	No	Key + on-device password storage
Thetis Pro	~$33	USB-A/C, NFC	Yes	No	No	Budget all-connector backup

Pricing is approximate and varies by region and reseller — check each vendor's own store before buying, the same way we cross-checked Yubico's official pricing rather than reprinting a stale spec sheet.

Google Titan Security Key

Titan is the obvious "cheaper YubiKey" answer, and for a narrow use case it's the right one: if every account you're protecting is Google, Microsoft, GitHub, or another FIDO2/WebAuthn-only service, Titan does the job for less money.

The catch is the protocol list, not the hardware. Titan doesn't support OpenPGP, PIV/Smart Card, or SSH key auth the way YubiKey does — so if you set up SSH login with your YubiKey, Titan can't be your backup for that specific use.

Tip

Titan is a genuinely good first key for a non-technical family member who only needs Google/Microsoft account protection — it's cheaper and there's nothing extra to configure.

Nitrokey 3 — the open-source pick

Nitrokey publishes its firmware and hardware documentation openly, which matters if you're the kind of reader who already runs Vaultwarden self-hosted rather than trusting a closed-source vault — the same instinct applies to what's running inside your security key.

Functionally, Nitrokey 3 is the closest match to YubiKey on this list: FIDO2/U2F plus OpenPGP and SSH support, so it can genuinely act as a backup for a YubiKey-protected SSH setup, not just your web logins. The tradeoff is price — at roughly the same cost as a YubiKey, the only thing you're buying is the open-source firmware, not a discount.

Feitian ePass — the budget bulk option

Feitian's ePass line is the cheapest way to end up with multiple keys in different bags, cars, or a safe-deposit box as backups. At roughly $25–35 depending on the exact model, buying two Feitian keys can cost less than one extra YubiKey.

Same limitation as Titan: FIDO2/U2F only. Treat Feitian keys as disposable backups for web-account 2FA, not as a stand-in for a protocol-heavy primary key.

OnlyKey — key plus password manager

OnlyKey folds FIDO2/U2F/TOTP support and on-device encrypted password storage into one USB-C key with a physical PIN pad, so a compromised computer never sees your master password typed on its keyboard.

That's a meaningful feature only if you don't already run a password manager. If you're already on Bitwarden or self-hosted Vaultwarden, OnlyKey's password-storage half is redundant — you'd be paying for a feature you won't use, and a dedicated password manager's browser integration and cross-device sync is more convenient day to day than typing on a physical PIN pad.

Thetis Pro and other budget all-rounders

Thetis Pro (~$33) packs USB-A, USB-C, and NFC into a single body, which makes it a reasonable one-size-fits-most backup if you're not sure what ports your other devices use. Like Titan and Feitian, it's FIDO2/U2F only — a convenience pick, not a protocol-matching backup.

Warning

Don't buy a FIDO2-only backup key as your only backup if your primary YubiKey is protecting SSH, email signing, or a smart-card login. Test that the backup actually authenticates the non-FIDO2 service before you rely on it — discovering the gap during an actual lockout is the expensive way to learn this.

Which one should you actually buy?

You only log into Google, Microsoft, or GitHub-style FIDO2 accounts: Google Titan — cheapest mainstream option, no functionality left on the table for that use case.
You use SSH key auth or OpenPGP and want a real backup, not just a cheaper one: Nitrokey 3 — the only alternative here that matches YubiKey's protocol coverage.
You want 2–3 cheap backup keys to scatter across bags and locations: Feitian ePass or Thetis Pro.
You want a key that also stores passwords and don't already use a password manager: OnlyKey.
You need OpenPGP, PIV, or SSH support and want the widest ecosystem support: stick with YubiKey — none of these alternatives beat it on protocol breadth, only on price or one specific feature.

Frequently asked questions

Is there a cheaper alternative to YubiKey?

Yes — Google Titan (~$30–35) and Feitian ePass (~$25–35) both cost less than YubiKey, but neither supports OpenPGP, PIV, or SSH key authentication the way YubiKey does. They're a good fit only if every account you're protecting uses FIDO2/U2F or WebAuthn.

Is Google Titan as good as YubiKey?

For FIDO2/WebAuthn logins (Google, Microsoft, GitHub, most password managers), yes. Titan doesn't match YubiKey's broader protocol support for SSH, OpenPGP, or Smart Card/PIV use cases.

Can I use a non-YubiKey security key with Bitwarden or Vaultwarden?

Yes — Bitwarden and self-hosted Vaultwarden support any FIDO2/WebAuthn key as a login method, including Titan, Nitrokey, Feitian, and Thetis Pro. This is separate from OnlyKey's own on-device password storage feature.

Do open-source security keys like Nitrokey actually work with SSH?

Yes — Nitrokey 3 supports OpenPGP and SSH key authentication, the same way YubiKey does, making it the one alternative on this list that can genuinely back up a YubiKey-protected SSH setup rather than only covering web-account 2FA.