Notes 
Open-source hardware security key line from Berlin-based Nitrokey, with models ranging from the FIDO2-only Nitrokey Passkey to the Nitrokey 3, which adds PIV smart card, OpenPGP, and TOTP support.
Reviewed by Marcus Holmberg
Nitrokey
nitrokey.com 2 ratings so far*
Rate Nitrokey: No account needed
Threat level
Hardened
A hardened pick. Worth the effort once you have chosen to shrink your footprint on purpose. Enough for most people. Threat levels
Our take
Nitrokey’s key differentiator over Yubico is transparency: the firmware is open source and auditable, the hardware designs are published, and the company is based in Germany with no US jurisdiction concerns. The Nitrokey 3 covers the same protocol breadth as the YubiKey 5. The practical catch is ecosystem polish: the companion app and documentation are less refined than Yubico’s, and some enterprise integrations assume a YubiKey. A strong pick for privacy-conscious users who want to verify what runs on their security hardware.
GitHub at a glance
Nitrokey/nitrokey-3-firmware Apache-2.0
Stars
401
+3 this week
Forks
47
19 watching
Last commit
1d ago
healthy
Latest release
v1.9.1
1mo ago, 62 total
Star history
Issues
70% closed
78
open
179
closed
+12 / -8
opened / closed, last 4 weeks
Opened vs closed, last 12 weeks
Commits, last 26 weeks
83 commits, active 19 of 26 weeks
14 contributors since May 2021
Languages
- Rust 62.4%
- C 24.7%
- Python 5.4%
- Other 7.5%
Updated daily from the GitHub API. Star tracking since Jun 22, 2026.
Website at a glance
nitrokey.com
B score 75
Solid website security headers
Graded by Mozilla HTTP Observatory, tested 1d ago
Inspect this site yourself
Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.
Nitrokey alternatives
YubiKey 5 Series Full-featured hardware security key from Yubico supporting FIDO2/WebAuthn, TOTP/HOTP, smart card (PIV), and OpenPGP across multiple form factors including USB-A, USB-C, and NFC variants.
Yubico Security Key Yubico's entry-level hardware security key offering FIDO2/WebAuthn support at a lower price point, available in USB-A and USB-C variants, with NFC on select models.
Nitrokey license, in plain English
Apache-2.0 Permissive
Permissive like MIT, with an explicit patent grant and a requirement to flag any changes you make.
Permits
- Commercial use
- Modification
- Distribution
- Patent use
- Private use
Requires
- License and copyright notice
- State changes
Does not provide
- Trademark use
- Liability cover
- Warranty
Why it matters: Permissive licensing lets anyone reuse this, including inside closed products. That is freedom to build on, but no guarantee that downstream copies stay open.
Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.
* Average ratings will show on this page once the threshold of 5 ratings is reached.