OnlyKey review
Updated September 28, 2026 · ShieldCue Editorial Team · Facts checked September 26, 2026
We earn a commission when you sign up through links on this site. Partner status can affect where a brand appears in our rankings.
Our verdict
OnlyKey suits buyers who want a hardware key that handles passkeys, TOTP codes and password storage together, with open source firmware and a logging policy that keeps customer secrets off the vendor's side. The Duo costs €49.95 as a device, above Token2 and the Google Titan Security Key.
Key facts
- Best for
- Buyers who want passkeys, authenticator codes and password storage on the same device.
- Price
- €49.95 (Source, checked September 26, 2026)
- Protocols
- Fido2, U2f, Otp (Source, checked September 26, 2026)
- Connectors
- USB-a, USB-c (Source, checked September 26, 2026)
- Biometric unlock
- No (Source, checked September 26, 2026)
- Legal entity
- CryptoTrust LLC (Source, checked September 26, 2026)
- Headquarters
- United States (Source, checked September 26, 2026)
- Founded
- 2016 (Source, checked September 26, 2026)
- Support channels
- Email, Help-centre, Community (Source, checked September 26, 2026)
- Official website
- onlykey.io
Privacy tools
- Price from
- €49.95 (Source, checked September 26, 2026)
- Free plan
- No (Source, checked September 26, 2026)
- Platforms
- Windows, MacOS, Android, Linux, Chrome OS (Source, checked September 26, 2026)
- Protocols
- Fido2, U2f, Otp (Source, checked September 26, 2026)
- Logging policy
- Zero knowledge: no customer keys or sensitive data stored by the company (Source, checked September 26, 2026)
- Jurisdiction
- US (Source, checked September 26, 2026)
- Open source
- Yes (Source, checked September 26, 2026)
- Legal entity
- CryptoTrust LLC (Source, checked September 26, 2026)
- Headquarters
- United States (Source, checked September 26, 2026)
- Founded
- 2016 (Source, checked September 26, 2026)
- Support channels
- Email, Help-centre, Community (Source, checked September 26, 2026)
Password managers
- Price from
- €49.95 (Source, checked September 26, 2026)
- Free plan
- No (Source, checked September 26, 2026)
- Platforms
- Windows, MacOS, Android, Linux, Chrome OS (Source, checked September 26, 2026)
- Passkeys
- Yes (Source, checked September 26, 2026)
- Encryption
- AES-256-GCM, PIN protected with wipe after 10 failed unlock attempts (Source, checked September 26, 2026)
- Features
- TOTP (Source, checked September 26, 2026)
- Open source
- Yes (Source, checked September 26, 2026)
- Legal entity
- CryptoTrust LLC (Source, checked September 26, 2026)
- Headquarters
- United States (Source, checked September 26, 2026)
- Founded
- 2016 (Source, checked September 26, 2026)
- Support channels
- Email, Help-centre, Community (Source, checked September 26, 2026)
Apps and profiles
Pros and cons
Pros
- Open source firmware, paired with a logging policy in which the company states it holds no customer keys or sensitive data.
- The Duo carries usb a and usb c in the same unit, so machines with either port are covered by the same purchase.
- It speaks fido2, u2f and otp and also handles totp codes, so the same key covers security keys, authenticator codes and passwords.
- The PIN is protected in hardware, and the device wipes after repeated failed unlock attempts.
- Support runs on email, help centre and community, with a help centre in front of email and a community forum.
Cons
- Biometric unlock is no, which leaves the PIN and its wipe rule carrying the security of the device.
- The free plan is no, so the only route to the features is buying hardware at €49.95.
- The price runs above Token2 at €7 to €37 and the Google Titan Security Key at $30 to $35.
- Support runs on email, help centre and community only, with no phone line among them.
Ready to try OnlyKey?
Scored 8.2 / 10 by ShieldCue.
Who it suits
- People who want a physical key for passkeys and authenticator codes and who treat open source firmware as a requirement rather than a bonus.
- Mixed-port desks that need USB-C and USB-A covered by usb a and usb c in a single purchase.
- Buyers who would rather own the key outright and can accept a PIN instead of biometric unlock.
Who should look elsewhere
- Not for the tightest budget, since Token2 runs €7 to €37 against OnlyKey at €49.95.
- Not for people who expect to pick up a phone, because OnlyKey lists email, help centre and community as its support routes.
Audits, logging and jurisdiction
OnlyKey operates under US law, and the terms of service are set in the same jurisdiction. On data, the company states that it holds no customer keys or sensitive data, so a compromise of its systems would not hand over the material a login needs. Passwords, codes and keys live on the device or in the store the user controls. The practical read is that the sensitive part of a login never sits with the vendor, and a reader in US has a named legal party to hold to that description.
Where it runs
The platform list is Windows, macOS and Android, so the same key covers Windows, macOS, Android, Linux and Chrome OS without a second device. The Duo plugs in through usb a and usb c, which matters when the desktop still has the older rectangular port and the laptop or phone has the newer one. Android sits in that list, so a phone works alongside a desktop rather than needing something else. The device is bought outright and pairs with the browser and password manager already on the machine, so there is no separate app to keep current.
The company behind it
OnlyKey is sold by CryptoTrust LLC, which is based in the United States, and the business dates to 2016. A named legal entity plus published terms give buyers something concrete to check, and the open firmware claim means the code behind the key can be read rather than taken on trust. Support runs on email, help centre and community: a help centre carries routine questions, email takes direct ones and a community forum fills the rest. Phone support is not among them, so a written trail is what a hardware problem leaves behind.
How OnlyKey compares
8.2 vs 9.1
8.2 vs 8.8
8.2 vs 8.5
8.2 vs 9.5
8.2 vs 9.4
8.2 vs 9.1
8.2 vs 9.2
8.2 vs 9.4
8.2 vs 9.2
8.2 vs 8.8
8.2 vs 9.3
8.2 vs 9.0
8.2 vs 9.0
8.2 vs 9.4
Frequently asked questions
What does an OnlyKey cost, and what do rivals charge?+
The Duo is priced at €49.95, and entry prices start at €49.95. The figure buys the hardware, so the outlay at entry is the outlay later on, and the device price is the only price on offer here. Cheaper rivals exist: Token2 runs €7 to €37 and the Google Titan Security Key runs $30 to $35.
Which protocols and passkey methods does it support?+
The protocol list is fido2, u2f and otp, and passkeys are supported as well. That lets the same device act as a passkey authenticator, a security key for a login prompt and an OTP token for codes. Password storage sits on the key too, so a login, a code and a saved credential are handled by the same purchase rather than by separate tools.
Which computers and phones does it work on?+
The platform list is Windows, macOS and Android, and the Duo connects through usb a and usb c. A desktop with the older rectangular port and a laptop or phone with the newer one are both covered, and Chrome OS machines are included. The device is bought outright and pairs with the browser and password manager already installed on the machine.
Is there a free version or a free plan?+
The free plan is no. Everything sits behind the hardware, which starts at €49.95, and the same unit carries totp codes for authenticator apps, so codes come from the key rather than from a separate app purchase. There is no tier structure to move up through, which keeps the decision to a single choice of device.
How is the key protected, and what happens if it is lost?+
Encryption is handled in hardware with a PIN, and repeated failed unlock attempts wipe the device. Secret material stays with the holder under the company's logging policy, and the business is governed by US law. A lost unit is a lost key rather than a lost account, which makes spares worth keeping for anyone carrying it daily.
Who is behind OnlyKey and how do you get help?+
OnlyKey is sold by CryptoTrust LLC, based in the United States, and the business dates to 2016. Support runs on email, help centre and community: a help centre for routine questions, email for direct ones and a community forum for everything else. No phone line appears in that list, so written channels carry anything urgent.
Who is OnlyKey built for?+
It suits people who want passkeys, TOTP codes and password storage on the same device, and who read open source firmware as a requirement rather than a bonus. The protocol list is fido2, u2f and otp, and the Duo ships with usb a and usb c in the same unit, so a desk with mixed ports is covered. It fits poorly for anyone who needs a fingerprint reader or a free tier.
How does that price rank against the field?+
On price, OnlyKey sits at 14 of 15 across the security keys here. The median security key price is €30.69 and the lowest listed is €6.95, so OnlyKey sits in the dearer part of the field. Thetis at $24.99 to $49.99 is the closest comparison on spend.
Sources
- onlykey.io checked September 26, 2026
Backs: Passkeys, Price from
“You can use your OnlyKey immediately for two-factor authentication and passwordless login (FIDO2) supported by major websites such as Microsoft, Google, Facebook, Dropbox, GitHub, Okta, AWS and more.”
- onlykey.io/pages/faq checked September 26, 2026
Backs: Encryption, Logging policy
“The data stored on OnlyKey is encrypted with the strongest encryption available (AES-256-GCM) and most importantly is PIN protected.”
- onlykey.io/pages/how-it-works checked September 26, 2026
Backs: Biometric unlock, Founded, Open source, Platforms
“Your PIN code must be typed onto the 6 button keypad of the OnlyKey in order to unlock.”
- onlykey.io/pages/support checked September 26, 2026
Backs: Headquarters, Legal entity, Support channels
“CryptoTrust LLC. 11312 US 15-501 North Suite 107143 Chapel Hill, NC 27517”
- onlykey.io/policies/terms-of-service checked September 26, 2026
Backs: Jurisdiction
“These Terms of Service and any separate agreements whereby we provide you Services shall be governed by and construed in accordance with the laws of 11312 US 15-501 North Suite 107143 Chapel Hill, NC...”
- onlykey.io/products/onlykey-color-secure-password-manager... checked September 26, 2026
Backs: Features, Free plan
“OnlyKey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubikey OTP, TOTP, Challenge-response.”
- onlykey.io/products/onlykey-duo-dual-usb-c-and-usb-a-secu... checked September 26, 2026
Backs: Connectors, Price, Protocols
“OnlyKey DUO is a USB security key that works virtually everywhere, supporting both USB-A and USB-C.”
Compiled from 7 source pages, checked September 26, 2026. We did not open an account.
Related by the facts
OnlyKey
Buyers who want passkeys, authenticator codes and password storage on the same device.