Security Key Reset & Recovery: FIDO2 PIN Guide

Resetting a hardware security key is not the same as removing it from an online account. A FIDO2 reset can erase the key’s PIN, passkeys and other FIDO credentials, while the affected services may continue listing the old authenticator until it is removed from each account. This guide explains how to respond to a forgotten PIN, lost, stolen or damaged key without turning a recoverable problem into an account lockout.

Last reviewed: October 1, 2026. Security-key behavior varies by model, firmware, operating system and relying party. Confirm the instructions for the exact authenticator and service before changing or resetting it. This independent guide is educational and does not replace official support or an organization’s incident-response procedure.

Quick answer: do not reset a security key until you have identified every affected account and tested another way into each one. Register a replacement first, verify it in a new sign-in, remove the old key from every service and only then reset or retire the physical device. If the key is missing, revoke its account registrations immediately; you cannot remotely erase a key that you do not possess.

Security-key reset and account recovery are different operations

A security key participates in authentication, but two separate systems remember that relationship. The authenticator stores or derives credential material, while the website stores the public credential and information needed to recognize the registered key. Changing one side does not automatically clean up the other.

Action	Where it happens	What it changes
Change the FIDO2 PIN	On the physical authenticator	Changes local user verification while retaining credentials when the operation succeeds normally.
Delete one discoverable credential	In a compatible authenticator-management tool	Removes a selected passkey from the key; it does not necessarily remove the corresponding entry from the website.
Remove a security key from an account	In the service’s security settings	Revokes that account’s registration without wiping unrelated credentials from the physical key.
Reset the FIDO2 application	On the physical key	Removes the FIDO2 PIN and FIDO credentials handled by that application. The operation is destructive and cannot restore access.
Recover an online account	Through the service provider	Uses a backup key, code, trusted device or identity process to regain account access.

This distinction matters after a loss. Resetting a recovered key does not tell an exchange, email provider or password manager that the previous registration should disappear. Conversely, deleting the key from one account does not erase credentials for other services from the authenticator.

Understand the PIN before troubleshooting

A FIDO2 PIN is a local secret used by a compatible authenticator to verify its user for operations that require user verification. It is not normally transmitted to the website and it is not the password for the exchange, email account or password manager.

It is also different from the computer login PIN, phone screen lock and hardware-wallet PIN. A person may use the same physical computer to enter several unrelated PINs, but each protects a different system. Reusing one short value across them creates unnecessary exposure and makes incident diagnosis confusing.

Account password: verified by the online service or its authentication system.
Device PIN: unlocks a phone, computer or operating-system profile.
FIDO2 security-key PIN: performs local verification for supported FIDO operations.
Hardware-wallet PIN: protects access to a wallet device and is unrelated to WebAuthn login.

Do not enter a security-key PIN into an ordinary website text field, support chat or direct message. A legitimate flow normally presents a trusted browser or operating-system prompt associated with the authenticator.

What happens when the FIDO2 PIN is forgotten or blocked?

Do not guess repeatedly. Authenticators limit unsuccessful PIN attempts, and the exact behavior depends on the device and protocol implementation. A blocked PIN can prevent operations that require user verification. Reset may eventually be required, but reset is not a method for recovering the old PIN or preserving the affected credentials.

Before doing anything destructive, disconnect the key, stop testing random values and check the manufacturer’s documentation for the exact model. If the current PIN is known, a supported management application may allow it to be changed without deleting credentials. If it is forgotten, the recovery path usually depends on other authenticators or account-level recovery rather than extracting the old PIN.

Why a FIDO2 reset is a last resort

A reset returns the FIDO2 application to an unconfigured state. For supported YubiKey models, Yubico documents that reset removes the FIDO2 PIN and existing credentials; its authenticator documentation also warns that passkeys, fingerprints and non-passkey FIDO2 credentials can be removed depending on the model. The process cannot be undone.

The physical key may be usable again after reset, but it becomes a new authenticator from the perspective of account enrollment. Existing websites will not magically accept it. Each service must be accessed through another authorized method, the obsolete registration removed and a new credential created.

Critical rule: never use reset as the first troubleshooting step. First prove that every critical account can be accessed and its authentication settings can be changed without the key being erased.

Pre-reset inventory: identify what the key protects

A security key may hold discoverable passkeys that a management application can list. It may also have non-discoverable registrations that cannot be reconstructed as a convenient inventory from the device alone. Therefore, an account list maintained before an incident is more reliable than plugging in the key and expecting every registration to appear.

For a cryptocurrency user, review the complete security chain:

primary and recovery email accounts;
centralized exchanges and crypto-card accounts;
password manager and passkey provider;
Apple, Google or Microsoft platform accounts;
cloud storage containing statements or recovery documents;
domain registrar, hosting and analytics accounts;
banking, tax software and identity-verification portals;
work accounts if the same key was authorized by an employer.

Record service names, the label assigned to the key, another working sign-in method and the last successful test. Do not place passwords, PINs, backup codes or wallet seed phrases in this inventory.

Safe workflow before resetting a key

Use a trusted device and verified address. Open each service from a saved bookmark or independently verified application, not from a message claiming that the key has expired.
Test the backup authenticator. Complete a fresh sign-in with a separately stored key, passkey or approved recovery method.
Register the replacement. Add the new key before removing the old registration whenever the service permits multiple authenticators.
Test in a separate session. A key appearing in settings is not enough. Sign out or use a private browser window and complete a real authentication.
Remove the old registration. Delete the obsolete key from the service and review recent security activity.
Repeat for every account. Include email and password-manager dependencies, not only the cryptocurrency exchange.
Reset only after verification. Follow instructions for the exact model, connector and management application.
Re-enroll deliberately. Set a new PIN, register the reset key as needed and update the inventory with new labels and test dates.

Lost security key: revoke first, replace second

A lost key cannot be remotely reset. The immediate control is account-side revocation. Sign in with a backup key, trusted passkey, backup code or another official recovery method and remove the missing authenticator from every registered service.

Treat a clearly stolen key more urgently than one misplaced in a controlled room. Possession alone may not be sufficient where a PIN or local verification is required, but the owner should not rely on that barrier. Review recent sessions, recovery changes, new devices, API credentials and withdrawal settings.

Secure the primary email and password manager.
Revoke the missing key from high-value accounts.
Add and test a new backup before ending the session.
Review exchange withdrawal addresses, API keys and device history.
Save timestamps and security notices if theft is suspected.
Update the key inventory so the missing device is not trusted later.

Changing an account password does not necessarily revoke a registered FIDO credential. Remove the key explicitly in the authentication settings or through official support.

Damaged or unreliable key: avoid repeated emergency use

An intermittent connector, cracked housing or unreliable NFC response is a replacement signal. Do not wait until the key fails during urgent account recovery. While it still works, register a new primary and verify the existing backup.

Test another supported port or device only to distinguish a key failure from an adapter, browser or operating-system problem. Do not repair a security key by opening it, heating it or modifying its contacts. Physical modification can destroy the authenticator and may expose it to tampering.

After replacement, revoke the damaged key from accounts before disposal. If it can still communicate, follow manufacturer guidance for reset. If it cannot, physically retain or dispose of it according to the organization’s security policy after all registrations have been revoked.

Credential cleanup versus complete reset

If the goal is to free passkey capacity, remove an obsolete credential or reorganize accounts, a complete reset may be excessive. Some modern authenticators and management tools can display and delete individual discoverable credentials after PIN verification.

Individual deletion is still permanent. Confirm another access method and remove the corresponding account-side registration where appropriate. Non-discoverable credentials may not appear in the same list, so an empty passkey screen does not prove that the key has never been registered elsewhere.

Situation	Preferred action	Avoid
Current PIN is known	Use the supported change-PIN function.	Resetting merely to choose a new PIN.
One passkey is no longer needed	Verify backup access, delete that credential and clean up the service registration.	Erasing every FIDO credential.
Key is lost or stolen	Revoke it from every service and register a replacement.	Waiting for a remote wipe that cannot occur.
PIN is forgotten	Recover accounts through tested alternatives, replace registrations and then follow reset guidance.	Repeated guessing or assuming reset preserves credentials.
Key will be transferred or retired	Remove registrations, verify replacements and perform the documented reset before release.	Giving a previously registered key to another person without cleanup.

Crypto-account recovery order

Recovery order matters because accounts depend on one another. Begin with the identity and communication services that can authorize other resets, then proceed to financial services.

Primary email: secure sessions, forwarding rules, recovery addresses and authentication methods.
Password manager: confirm access from a trusted device and protect its recovery material.
Platform account: review the Apple, Google or Microsoft account that may control passkey synchronization or device recovery.
Crypto exchanges: replace the key, review devices, withdrawals, allowlists and API permissions.
Tax and banking services: update authenticators and verify that statements or identity records were not exposed.
Administrative accounts: secure domain, hosting and business systems that could impersonate the owner.

A hardware security key protects authentication, not blockchain transactions. If a wallet seed phrase, private key or malicious approval is involved, use the appropriate wallet incident plan rather than treating FIDO reset as a remedy.

Safe retirement and disposal checklist

List every known account registration.
Add and test replacement authenticators.
Remove the retiring key from each service.
Review recent sign-ins and recovery changes.
Delete individual credentials only after backup access is proven.
Perform the manufacturer-documented FIDO2 reset when supported.
Confirm that the key no longer exposes managed credentials.
Remove identifying labels before disposal or transfer.
Update the inventory and record the retirement date.

Common reset and recovery mistakes

Resetting the key before testing another sign-in method.
Assuming a factory reset removes the registration from every website.
Changing the account password but leaving a lost security key registered.
Checking only the exchange and forgetting its recovery email.
Keeping the primary and backup keys in the same bag.
Deleting a passkey without knowing which account it belongs to.
Entering a FIDO PIN into a website or sharing it with “support.”
Reusing the hardware-wallet PIN as the security-key PIN.
Disposing of a damaged key before revoking its registrations.
Assuming a reset can recover forgotten credentials or transaction access.

Frequently asked questions

Does resetting a security key remove it from my accounts?

No. Reset removes credentials from the authenticator, but services can continue displaying the old registration until it is removed from their security settings. Access each account with another method and revoke the obsolete key.

Can I recover a forgotten FIDO2 PIN?

The old PIN is not normally recoverable from the key. If it cannot be changed because it is unknown, first establish alternative access to every account. A documented reset may clear the PIN, but it also removes FIDO credentials and requires re-enrollment.

Will reset delete every type of data on a multi-protocol key?

Not necessarily. Some keys contain separate FIDO2, OATH, PIV or OTP applications, and reset scope differs by model. Some biometric or multi-protocol devices have special behavior. Follow documentation for the exact device instead of assuming that “factory reset” has one universal meaning.

Can someone use my lost key without its PIN?

That depends on the registered authentication flow. Some operations require local user verification, while others may require only user presence after another factor. Revoke a missing key promptly rather than treating the PIN as a sufficient long-term defense.

Should I reset a key before selling or giving it away?

Yes, but only after removing its registrations and proving that replacement methods work. Use the manufacturer-supported reset process and remember that organizational policies may prohibit transferring authenticators.

Is a reset security key the same as a new key?

It can be enrolled again, but compatibility, firmware state and physical history remain those of the existing device. A reset does not repair damage or establish that a previously uncontrolled key has not been tampered with.

Final recovery checklist

Stop guessing a forgotten PIN.
Identify all critical registrations.
Test a separate recovery method for every account.
Register and verify a replacement key.
Revoke lost, damaged or retiring keys account by account.
Review sessions, recovery methods, API keys and withdrawal controls.
Reset only a key that is physically available and safe to erase.
Re-enroll the reset key as a new authenticator if it will be reused.
Store the backup separately and update the inventory.

Key takeaway: the safe sequence is replacement, testing, revocation and only then reset. A destructive FIDO2 reset can prepare a key for reuse, but it cannot recover a forgotten PIN, remotely erase a lost device or automatically clean up registrations held by online services.

Security Key Reset and Recovery: FIDO2 PIN Lockouts, Lost Keys and Safe Replacement