Short answer: Yes. A single security key can protect an effectively unlimited number of accounts, because most sites do not store anything on the key at all — the credential is derived on demand and kept server-side. The exception is passwordless sign-in, which stores a resident credential on the key, and there you do hit a limit: typically 25 to 100 slots depending on the model. For ordinary 2FA use, one key covers everything you own.
Why people assume there is a limit
A security key is a small physical object with a tiny amount of storage. It seems obvious that it must fill up.
It usually does not, because of a design decision in the FIDO standards. There are two ways a credential can exist:
Non-resident credentials (the common case). When you register the key as a second factor, the site stores an encrypted credential blob. The key holds a single master secret and derives the site-specific private key on demand from that blob. Nothing is written to the key. Register it on a thousand sites and the key’s storage is unchanged.
Resident credentials, also called discoverable credentials (passwordless). For passwordless sign-in, the key must be able to say “here is who I am” before you type anything. That requires storing the credential on the device itself, and storage is finite.
The distinction maps neatly onto how you use it: as a second factor, unlimited; as a passwordless login, limited.
The practical numbers
- Second-factor (U2F/non-resident) registrations — no meaningful limit for any normal user.
- Resident credentials on a YubiKey 5 — 25 on older firmware, 100 on newer.
- Other FIDO2 keys — commonly 25 to 50.
- TOTP secrets (if your key stores authenticator codes, a separate feature) — typically 32 on a YubiKey 5.
Even 25 passwordless credentials covers the accounts most people would ever want passwordless. And you can mix: passwordless on your handful of critical accounts, second-factor mode everywhere else.
Background on the mechanics: WebAuthn and FIDO2 and what is a hardware security key.
Is putting everything on one key risky?
The instinct — “all my eggs in one basket” — deserves a proper answer.
Theft is less dangerous than it sounds. A stolen key is not a stolen account. As a second factor, the thief still needs your password. For passwordless credentials, they need the key’s PIN or your fingerprint, and keys lock out after a small number of wrong PIN attempts. A key found on the street is close to useless.
Loss is the real risk — and it is solved by owning a second key, registered on the same accounts, stored somewhere else. This is why every guide, including which security key should you buy, says buy two.
Concentration is also a benefit. One object you can physically account for beats codes scattered across apps, screenshots and notes. You know where it is in a way you do not know where your secrets are.
How to organise it
A setup that works well in practice:
- Two identical keys, both registered on every account. Primary on your keyring, backup in a safe or a drawer at home.
- Passwordless (resident credentials) on your top few — email, password manager, cloud, registrar. That is where the convenience is worth a storage slot.
- Second-factor mode everywhere else — unlimited, so add it liberally.
- A PIN set on each key, so a stolen key cannot be used alone.
- Backup codes saved offline as a third layer — where to store them.
- SMS removed from every account you have secured, since the weakest enabled method is your real security level.
When one key is not enough
Reasons to own more than two:
- Different connectors. A USB-C key plus a USB-A key covers old and new machines.
- Work and personal separation. Some organisations require a key they issue and control.
- Geographic separation. A third key at a family member’s house or in a bank box, for the fire-and-theft scenario.
- Shared responsibility. A business might keep an administrator key in a safe as a break-glass credential.
Frequently asked questions
How do I know if a site uses resident or non-resident credentials?
If it asks for your username and password first and then the key, it is second-factor mode (non-resident). If it lets you sign in with only the key, that is a resident credential using a storage slot.
Can I delete resident credentials to free space?
Yes. Yubico’s Authenticator and similar management tools let you view and delete stored credentials. Remove the account from the site first so you do not lock yourself out.
What happens when the key is full?
New passwordless registrations fail with an error. Second-factor registrations continue to work regardless — so it is rarely a hard stop.
Do I need to register both keys on every account?
Yes, at the same time ideally. Registering the backup later means going through every account again, which people put off and then never do.
Can two keys be used interchangeably?
Yes. Each is registered independently; either satisfies the site. They do not need to be the same brand or model.
What if a service only allows one key?
A few do. In that case make sure you have backup codes saved, and consider whether a synced passkey is the better option there.
The bottom line
One key genuinely does cover all your accounts for second-factor use, and 25 to 100 for passwordless — more than enough. The number to worry about is not how many accounts fit on a key, but how many keys you own. Buy two, register both everywhere, store them apart, and the “single point of failure” objection disappears entirely.
Choosing hardware? Start with which security key should you buy.