Passkeys

Yes. FIDO2-certified YubiKeys can store hardware-bound passkeys for supporting services. Management and capacity depend on the model and firmware.

FIDO2 combines WebAuthn with CTAP2, uses public-key cryptography, and can enable phishing-resistant MFA and passwordless login.

A password is a shared secret that can be stolen or reused. A passkey uses a key pair: the private key remains with the authenticator.

A FIDO credential is bound to the registered relying party. A spoofed website on a different domain therefore cannot obtain the same cryptographic authentication.

A hardware-bound passkey remains on the authenticator and cannot be copied. A synced passkey can be made available between devices via a provider and has different recovery and risk characteristics.

Yubico recommends registering at least one backup YubiKey with accounts. Store it separately and securely and periodically check the recovery process.