Using Chrome to Enroll Fingerprints

Set a PIN and enroll the first fingerprint using the Chrome browser on a macOS, Linux or Chrome OS device. To enroll more fingerprints use the Chrome settings as described in Enrolling Additional Fingerprints.

Note

A YubiKey Bio is a FIDO2 hardware authenticator. Both Windows and Mac have built-in FIDO2 authenticators - i.e., software authenticators that in this case are also platform authenticators. The prompts in both Windows and Mac might assume you will be using their own authenticators. Therefore it is quite easy to register their authenticators with a site or service by mistake, without realizing that you are not registering your YubiKey. Read the prompts carefully to avoid this. And remember that the PIN is associated with the authenticator, not the site or service.

Although there are two FIDO applications on the YubiKey Bio, namely FIDO2 and U2F, it is the FIDO2 PIN that is required as fallback for both. The PIN is not associated with any site. When the fingerprint does not work and the key falls back to the PIN, it is the key that needs the PIN for authentication to all sites, including U2F sites (even though U2F has no concept of PIN). With fallback to PIN, it is easy if the user is authenticating to a WebAuthn/FIDO2 site, because the browser/client app can prompt for the PIN. Otherwise the user must unblock biometrics by using either:

For information on the YubiKey Bio’s sensor and tips on working with fingerprints see Tips. For detailed information on FIDO2 PINs and their requirements, see Understanding YubiKey PINs.

Enrolling the First Fingerprint

Step 1:

Use an up-to-date Chrome browser to open the yubi.co/bio website. Insert your YubiKey Bio into your computer.

Step 2:

Scroll down to the green button, Enroll using Chrome, and click it. The Use your security key with Yubico.com popup appears, taking you through the PIN setup (if no PIN is set) and later the fingerprint enrollment:

_images/insert-key-ff.png
Step 3:

If the amber LED flashes slowly, it means that either no fingerprint is enrolled or biometrics is blocked. If you have reason to believe biometrics is blocked, go to the appropriate link on the YubiKey Bio start page or to Troubleshooting and Tools. Otherwise, touch the key:

_images/PIN-required-ff.png
Step 4:

If no PIN is set, set one by entering at least 4 digits, then confirming this PIN by re-entering it. If the YubiKey Bio already has a PIN set you are prompted to enter it.

Step 5:

When prompted, touch the fingerprint sensor and the bezel. You are prompted to touch the sensor several times, as set out below. Change the angle of finger to sensor slightly each time.

Continue lifting and re-applying the same finger until the gray circle is entirely blue, the fingerprint icon is replaced by a tick mark, and the message in the popup reads “Your fingerprint was captured.”

_images/fingerprint-captured-ff.png
Step 7:

Click Next. The Touch your security key again to complete the request popup appears:

_images/touch-again.png
Step 8:

Touch the bezel and sensor one last time. The final popup announces that enrollment was successful. The YubiKey Bio now has a template for that fingerprint.

Enrolling Additional Fingerprints

If the YubiKey Bio already has fingerprint(s) enrolled on it, repeating the procedure for the first fingerprint does not work for subsequent fingerprints. Instead follow these steps.

Note

You can also use this method for setting a PIN for a new YubiKey Bio and enrolling all fingerprints.

Step 1:Either paste chrome://settings/securityKeys into the Chrome address field or click on the three vertical dots to the right of the URL field to navigate to Settings->Security->Advanced->Manage security keys.
Step 2:Click Fingerprints and follow the instructions in the popup.

To get in touch with Yubico Support, click here.