To create a PIN for a physical security key in Windows 11, open Settings > Accounts > Sign-in options > Security Key > Manage. Insert the USB key or tap the NFC key, choose Add in the Security Key PIN section, enter the new PIN twice, select OK, and then select Close.
This PIN belongs to the security key itself. It is not the Windows Hello PIN used to unlock your computer, and changing one does not change the other.
As an Amazon Associate I earn from qualifying purchases.
What you need before creating the PIN
Have the physical FIDO2 security key available before opening its management page. A USB key must be connected to a compatible USB port. An NFC key must be tapped against an NFC reader on the computer or other device. Windows uses that physical key to verify that you are allowed to change its settings, so you generally cannot complete this task with only a password or the key’s account registration.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Personal Microsoft account: Windows can expose security-key management for a key registered to the account, subject to the account and Windows configuration.
- Work or school account: The organization must enable security-key use. The key normally must be FIDO2, Microsoft-compliant, and approved under the organization’s policy. If your employer or school restricts key registration, only its administrator or help desk can change that policy.
- Correct connection method: Use USB when the key has a USB connector, or NFC when the key is designed for contactless use and the device has an NFC reader.
- Time to verify the device: Keep the USB key plugged in, or keep the NFC key over the reader, until Windows completes verification. Moving it away too quickly can make the dialog appear unresponsive.
Security-key management labels can vary slightly with Windows release, account configuration, manufacturer firmware, and organizational policy. The route below is the documented Windows 11 path when the feature is available.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do I need to buy a security key?
No purchase is required if you already have a compatible, registered key. If you do not have one, a generic FIDO2 security key is the relevant type to look for; Microsoft says these devices are commonly available from computer-accessory retailers. Check whether the device uses USB, NFC, or both, whether your computer has the matching port or reader, and whether your employer or school approves that model before buying it. There is no universally best key or connection method established by Microsoft’s instructions.
How do I create a new security key PIN in Windows 11?
- Open Settings. Select the Start button, then choose Settings, or press
Windows + I. - Open sign-in settings. Select Accounts in the left navigation, then select Sign-in options.
- Open security-key management. Find Security Key and select Manage. Do not choose PIN (Windows Hello); that is a different credential.
- Verify the key. Insert the key into USB, or tap the NFC key on the device’s NFC reader. Keep it connected or in range while the management window is open.
- Start PIN creation. In the Security Key PIN area, select Add.
- Enter and confirm the PIN. Type the new PIN, type it again when prompted, and select OK. Follow any character, length, or security requirements shown by Windows or the key.
- Finish. Select Close. The PIN is now stored on that physical security key and can be requested during supported FIDO2 sign-ins.
If a PIN already exists, the same management area provides Change rather than the workflow for creating a first PIN. Return to Settings > Accounts > Sign-in options > Security Key > Manage, verify the key, and select Change when you need to replace the existing PIN.
What happens while Windows verifies the key?
The Manage page is operating on the authenticator that is physically present. With USB, Windows communicates through the connected key. With NFC, the key must remain close enough for the reader to complete the exchange. If you have several registered keys on a desk, only the one you insert or tap is being changed. A PIN created on one key is not copied to your other keys, even if all of them are registered to the same account.
Free tools Windows power users keep installed
One-click scans. No signup required.
After you select Add or Change, read the dialog before submitting. The key or an administrator can impose requirements that are not identical to another key’s requirements. If Windows rejects the value, use the exact format requested instead of assuming that a PIN accepted by another device will work here.
What “Add” and “Change” mean
| Control | Use it when | Result |
|---|---|---|
| Add | The key needs its first security-key PIN. | Creates a PIN on the physical key after you enter and confirm it. |
| Change | The key already has a PIN that you want to replace. | Updates the PIN stored on that key after Windows verifies the current key state. |
The controls operate on the key that you insert or tap. If you own several keys, repeat the process for each one; creating a PIN on one key does not create the same PIN on another. A backup key therefore needs its own registration and its own PIN-management step.
Is a security key PIN the same as my Windows PIN?
No. Windows 11 presents both credentials in nearby sign-in settings, but they serve different purposes and are stored in different places.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Credential | Where it is managed | What it protects | Where it is stored |
|---|---|---|---|
| Security key PIN | Settings > Accounts > Sign-in options > Security Key > Manage | Use of the registered FIDO2 security key during supported authentication. | On the physical security key. |
| Windows Hello PIN | Settings > Accounts > Sign-in options > PIN (Windows Hello) | Sign-in to the Windows device and, where configured, associated account access. | Protected by the device’s Windows Hello security system. |
Changing the Windows Hello PIN does not change, unlock, or reset the PIN on a physical security key. If the goal is to manage the key, always select Security Key and then Manage. Conversely, creating a key PIN does not replace the PIN you use at the Windows lock screen.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Why is Windows asking me to create a security key PIN?
A PIN prompt can appear during a browser or account sign-in even when you did not open Settings. Microsoft documents this behavior for Windows 11 versions 24H2 and 25H2 after the September 29, 2025 preview update or later updates.
During FIDO2 authentication, a website or identity provider can request User Verification = Preferred. That setting asks the authenticator to verify the user when it supports verification. Verification may use a PIN or a biometric method. If the security key does not yet have a PIN, Windows can ask you to create one as part of that sign-in flow.
Microsoft says rollout of this behavior completed after the November 11, 2025 security update or later. The prompt is therefore different from deliberately opening Manage in Settings, although completing it can establish the PIN needed for later authentications. If you prefer to manage the key outside the sign-in flow, cancel only if the service allows cancellation, then use the Settings procedure above. A prompt by itself does not mean that your Windows Hello PIN has changed.
USB key or NFC key: which setup applies?
| Key connection | What you do in Manage | Compatibility checks |
|---|---|---|
| USB | Plug the key into a compatible USB port and leave it connected while Windows verifies it. | Check the connector type, available port, and any organization-approved model list. |
| NFC | Tap the key against the computer’s NFC reader when Windows asks for verification. | The device must have an NFC reader, and the key must support NFC authentication. |
There is no universally best connection type. Choose the method your device supports and the method permitted by your work or school policy. A USB key can be unusable on a device without the right port or adapter; an NFC key cannot be tapped successfully where no NFC reader is present. If a key offers both methods, use the one that Windows and your organization support for that device.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat if “Security Key” is missing from Sign-in options?
Work or school account policy is blocking it
For organizational accounts, an administrator must enable security-key functionality. The key may also need to be an approved, Microsoft-compliant FIDO2 device. If Security Key does not appear, contact the organization’s help desk or administrator and ask whether security-key management is enabled for your account and whether your key model is approved. An administrator may need to change policy; repeatedly changing the Windows Hello PIN will not make the missing option appear.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The account or Windows configuration does not expose the feature
Personal and organizational account controls are not identical, and availability can vary by Windows release and account configuration. Install normal Windows updates, confirm that you are using the intended account, and check whether the option appears after connecting the key. Do not substitute PIN (Windows Hello); it manages the computer’s sign-in credential, not the key.
What if Windows does not recognize the key?
- Disconnect and reconnect a USB key, trying another compatible port if one is available.
- For NFC, confirm that the device actually has an NFC reader and hold the key over the reader until Windows responds.
- Check that the key is the intended FIDO2 device and that its manufacturer supports Windows management.
- For work or school use, verify with the administrator that the exact model is approved and compliant.
- If Windows does not show manufacturer-specific management instructions, consult the key manufacturer’s support documentation. Microsoft directs users to the manufacturer when those instructions are not listed in Windows.
A key that works for one account or device may still be blocked by a different organization’s policy. Separate connection problems from authorization problems before replacing hardware. If the same key works in another supported environment, the issue may be the reader, port, account configuration, or policy rather than a failed key.
What if I forgot the security key PIN?
Microsoft’s general Windows instructions explain how to add and change a key PIN, but they do not define one universal forgotten-PIN recovery sequence for every FIDO2 key. The recovery options can depend on the key manufacturer, firmware, account, and organization policy.
Use the management options shown on screen and follow the key manufacturer’s instructions. Do not expect Settings > Accounts > Sign-in options > PIN (Windows Hello) to reset the forgotten key PIN. If the key is managed by an employer or school, ask its help desk before trying destructive recovery steps. You may need another registered sign-in method or a replacement key, but the available path is specific to the service and device.
Windows may display a retry limit, lockout message, or additional verification requirement. The reviewed Microsoft guidance does not publish a universal PIN length or retry limit, so follow the values displayed for your key rather than relying on a number from another model.
PIN length, characters, and retry limits
There is no single PIN policy that applies to every security key. The accepted length, permitted characters, and number of failed attempts can be defined by the key’s firmware, manufacturer, Windows behavior, or an organization’s policy. Microsoft’s setup guidance does not provide universal numeric values.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Read the requirement shown in the PIN dialog carefully.
- If the dialog rejects an otherwise valid-looking PIN, use the exact format it requests.
- For a managed account, follow the organization’s instructions rather than assuming the personal-account policy applies.
- Do not repeatedly guess a forgotten PIN; use documented recovery or contact the responsible administrator.
What happens if a key is lost or no longer wanted?
Removing a security key from an account’s security information prevents that account from using the removed registration. It does not automatically erase credentials already stored on the physical key. If the key is lost, remove its registrations from every account that used it and make sure you have another way to sign in.
A factory reset is different. Resetting the key clears its data and credentials and is destructive. Use a reset only when you deliberately want to erase the device and have confirmed that you no longer need any account registrations on it. If the key is merely missing, remove its account registrations first and review other sign-in methods so you do not lock yourself out.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How many keys can an account have?
Microsoft’s work-or-school security-key guidance says an account may have up to 10 registered keys. That is a product limit stated by Microsoft, not a general security statistic, and account administrators may impose additional restrictions.
Registering a backup key can help when one key is lost, but each physical key has its own PIN and must be registered and managed separately. Keep track of which key is assigned to which account before changing or resetting one. If you reach an account’s registration limit, an administrator or account-security page may require you to remove an old registration before adding another.
A quick decision checklist
- Creating the first key PIN: Open Security Key > Manage, verify the key, and select Add.
- Replacing an existing key PIN: Return to the same page and select Change.
- Changing the PC sign-in PIN: Use PIN (Windows Hello) instead; it does not affect the physical key.
- Seeing a PIN request during sign-in: On supported Windows 11 updates, it may be caused by a FIDO2 request for preferred user verification.
- Missing Security Key option: Check account type, administrator policy, key approval, and Windows configuration.
- Forgotten key PIN: Follow the key-specific recovery instructions; do not promise that Windows Hello PIN reset will help.
- Lost key: Remove its account registrations, then consider a factory reset only when erasing the key is intentional.
Frequently Asked Questions
Can I create a security-key PIN without plugging in the key?
No. Windows asks you to insert the USB key or tap the NFC key so it can verify and modify that physical authenticator. Keep it connected or within NFC range until the operation finishes.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does adding a PIN register the key to my account?
Adding a PIN manages the PIN on the key. Registration and PIN creation are related but separate account actions. Follow your account’s security-key registration process, and remember that every physical key must be registered and managed separately.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why do I see Add on one key and Change on another?
Add indicates that the key does not yet have a security-key PIN. Change indicates that a PIN already exists on that physical key. The controls describe the key you inserted or tapped, not every key registered to your account.
Can I use the same PIN on several security keys?
Each key stores its own PIN. You may choose values according to each key’s displayed requirements, but Windows does not copy a PIN from one key to another; repeat the management process for each device.
Will a Windows update force me to create a key PIN?
On Windows 11 24H2 and 25H2, Microsoft documented a prompt after the September 29, 2025 preview update or later updates when a FIDO2 service requests preferred user verification and the key has no PIN. Rollout completed after the November 11, 2025 security update or later. This is separate from changing the Windows Hello PIN.
Recommended Free Tools
What should I ask my employer if Security Key is missing?
Ask whether security-key functionality is enabled for your account, whether the exact FIDO2 model is Microsoft-compliant and approved, and whether any policy limits registration. The help desk or administrator may need to enable the feature.
Is there a standard number of PIN digits or failed attempts?
Microsoft does not publish one universal length, character rule, or retry limit for all security keys. Follow the requirement displayed by Windows, the key firmware, or your organization, and avoid guessing a forgotten PIN repeatedly.
Does removing a lost key from my account erase it?
No. Removing the registration stops that account from using the key but does not clear credentials stored on the device. A factory reset erases the key and is destructive, so use it only when you intentionally want to wipe the device.
The Bottom Line
Use Settings > Accounts > Sign-in options > Security Key > Manage, verify the physical USB or NFC key, and choose Add for a first PIN or Change for an existing one. The key PIN is separate from Windows Hello. If the option is missing, the key is rejected, or a sign-in unexpectedly asks for a PIN, check the account policy, Windows version, connection method, and manufacturer instructions before resetting or replacing the key.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
