Sign in with a YubiKey you tap
Hold a security key against the back of the phone to authenticate. The private key stays on the token and never touches the device — so unlike a phone-bound key, it works from any phone you tap it against.
How it works
The app talks to the token's PIV applet over NFC. Your key sits in PIV slot 9A; the app reads its public half once when you enrol the token, then asks for a tap whenever a signature is needed. The token computes the signature internally and returns only the result.
Because the key belongs to the token rather than the handset, this is the one credential in the app worth backing up. Restore onto a new phone, tap the same token, and it works immediately.
The PIN
PIV protects signing with a PIN, and the app asks for it before a connection begins rather than mid-handshake. It is held in memory for that connection and never stored — a PIN whose entire value is that it is not on the phone should not be written to the phone.
Three wrong attempts block the token permanently, recoverable only with its PUK. The app decodes the card's retry counter and tells you how many attempts remain, rather than reporting a generic failure.
What you need
- An NFC-capable Android phone.
- A YubiKey 5 NFC, or another PIV-capable token with NFC.
- A P-256 key already in PIV slot 9A.
The app reads keys but does not create them. Generating one over NFC requires the token's management key, which is a far more dangerous operation to get wrong, and ykman already does it well. Setup instructions.
In testing. This has been built and unit-tested against the PIV specification, but not yet confirmed against a physical token in our own testing. Please report anything that does not work.
Why NFC rather than USB
USB-C tokens work on Android too, but NFC is a tap rather than an unplug-and-replug cycle, and it does not occupy the port you may be charging from. The app uses reader mode, so a tap never restarts the app or interrupts a session in progress.