One FIDO key for the whole working day
A Hideez Key 5 hangs on a keyring and covers what an employee otherwise needs three separate things for: it signs them in to apps and accounts as a FIDO2 security key, unlocks the Windows workstation as they walk up and locks it as they walk away, and opens the office door on the way in.
It earns its place where phones are not an option — production floors and clean rooms that ban cameras, hospital wards, sites where personal devices stay in a locker. The same Hideez Workforce Identity console manages the FIDO security key, sets what it may open and cuts it off when it goes missing, so hardware and the mobile app are two routes into one system rather than two systems to run.
Six security tools. One FIDO2 device.
Passwordless FIDO2 security key
Phishing-resistant sign-in to Microsoft Entra ID, Google Workspace and hundreds of FIDO services over USB-C, NFC or Bluetooth.
Hardware password manager*
Up to 1,000 logins and passwords with autofill, provisioned and managed centrally.
OTP generator*
Up to 1,000 TOTP accounts — a hardware token that replaces authenticator apps, with no personal phones involved.
Proximity workstation login*
The workstation signs an employee in as their FIDO key approaches — with an optional PIN as a second factor, or Tap&Go where one workstation is shared.
Proximity walk-away lock*
The Bluetooth signal locks the workstation the moment the employee steps away. Trigger distance is tunable down to a meter.
Physical access credential
The same FIDO key opens compatible office doors and turnstiles. MIFARE is built in, with custom options available on order.
* Provisioned and managed with Hideez Workforce Identity Server
Passwordless where it’s supported, protected where it isn’t
One FIDO2 security key signs employees in to modern and legacy systems alike — using FIDO2 where the standard is supported, and stored credentials where it is not.
- Passwordless FIDO2. Phishing-resistant sign-in to hundreds of FIDO services over USB-C, NFC or Bluetooth.
- Hardware password manager. Up to 1,000 login and password pairs with autofill by button press or hotkey, plus a strong-password generator — for the internal apps that still expect a password.
- OTP generator. TOTP codes (RFC 6238) for up to 1,000 accounts, so enterprise 2FA no longer depends on personal phones.
- Hardware-backed signing and encryption. A BLE crypto service on the authentication key exposes AES-256 and ECC P-256 operations: private keys are generated on-device and cannot be exported, symmetric keys are write-only. Applications integrate it for document-signing and data-protection workflows.
The password manager, OTP generator and 2FA workstation login are provisioned and managed centrally with the Hideez Client app.
Proximity login and walk-away lock for Windows with one authentication key
Presence replaces the password at the workstation: Windows signs the employee in on approach and locks the moment they step away — no user discipline required.
- Signing in. Unlock on approach, click-to-unlock or unlock-on-activity — with an optional PIN as a second factor, or Tap&Go where several people share one workstation.
- Walking away. The Bluetooth signal tells the workstation the employee has left and it locks itself. The trigger distance is tunable down to a meter.
- Standard mode. Works with the workstation’s built-in Bluetooth — no extra hardware. Proximity is estimated from signal level.
- Precision mode. Bluetooth 6 Channel Sounding measures real distance (2–10 m) using a second Key 5 as a USB-C dongle — it tells users apart at shared workstations and resists relay attacks.
One credential for doors, turnstiles and IT systems
The built-in contactless NFC credential opens electronic doors and turnstiles: MIFARE Plus EV2 (2K) by default, with MIFARE Classic, MIFARE DESFire or 125 kHz RFID installed on customer order from 1,000 units.
- Provisioned with the existing access-control tooling of the organization
- Fully isolated from the FIDO key electronics
- Keychain eyelet built in; the rear accepts a standard 20 mm watch strap (wristband sold separately)
Hardware-rooted trust in every FIDO security key
Every Hideez Key 5 FIDO2 security key pairs a Microchip ATECC608C secure element with Arm TrustZone isolation, hardware-accelerated AES-256 and ECC P-256 cryptography, and a PAKE-secured channel to the client.
Firmware is protected end to end: secure boot, encrypted storage and signed over-the-air updates. A PIN with progressive lockout guards the device, with optional PUK recovery.
Each unit ships with a factory-provisioned certificate, so every security key is verifiably genuine. FIDO2 Level 2, CE and FCC certifications are planned.
One FIDO2 hardware security key for every kind of access
| Hideez Key 5 | FIDO security keys | FIDO smart cards | MS Authenticator | |
|---|---|---|---|---|
| Phishing-resistant passwordless sign-in (FIDO2 / WebAuthn) | ||||
| Works without a personal smartphone | ||||
| Signs in to apps that still expect a password | 1,000 credentials | Not typically | Autofill retired in 2025 | |
| One-time codes (TOTP) generated by the device | 1,000 accounts | Some models, with a companion app | On the phone itself | |
| Unlocks a Windows workstation on approach | ||||
| Locks the workstation on walk-away | ||||
| Opens doors and turnstiles | MIFARE built in | Some models | Some models |
The password manager, OTP generator and proximity features require Hideez Workforce Identity Server and Hideez Client App for Windows. The FIDO security key and door credential work standalone.
Part of the Hideez Workforce Identity platform
Hideez Key 5 works standalone out of the box for supported FIDO2 and U2F authentication. Connect it to the Hideez Workforce Identity platform to enable the hardware password manager, OTP, proximity login and centralized lifecycle management for every FIDO key in your fleet.
The control center of the platform — manage users, credentials, app integrations, workstation policies, and a full audit trail from one console, deployed as SaaS, private cloud, or on-premises.
Provision and deprovision users, rotate credentials, and enforce policies across every connected app and workstation from one place.
See who signed in, where, and when, with exportable logs that support your compliance and security reviews.
Run as SaaS, private cloud, or on-premises to meet your data-residency and regulatory requirements.
Turns a smartphone into a secure identity key: employees sign in to Windows workstations and business apps with a tap, and proximity can lock the PC when they step away.
Unlock Windows PCs with a phone tap instead of a typed password.
The workstation locks automatically when the paired phone moves out of range.
Fast, personal sign-in on shared workstations in healthcare, manufacturing, and retail.
Phishing-resistant FIDO2 / WebAuthn sign-in using device biometrics or a security key — no shared secret to steal, built on open standards that work across modern browsers.
Public-key credentials can't be reused or captured by fake sign-in pages.
Users sign in with the fingerprint or face unlock already on their device.
Built on FIDO2 / WebAuthn, so it works with modern browsers and identity providers.
Hideez AuthShield extends passwordless authentication and MFA to legacy web applications that were never designed for modern IAM or SSO.
It enables passwordless or MFA-based access to any web systems — helping organizations modernize authentication without rebuilding or replacing critical applications.
LEARN MOREFAQs
When will Hideez Key 5 be available?
Serial production starts in October 2026. Leave your email under Notify me and we will contact you the moment pre-orders open.
Does it work without any Hideez software?
Yes. As a FIDO2 / U2F security key it works out of the box with Microsoft Entra ID, Google and hundreds of WebAuthn services on Windows, macOS, Android, iOS and Linux.
Is Hideez Key 5 a USB security key or an NFC security key?
Both, in one authentication key. It works as a FIDO2 USB security key for workforce authentication when plugged into a compatible device over USB-C, as an NFC security key when tapped on a supported phone or reader, and as a Bluetooth security key where wireless authentication is supported. All three transports carry FIDO2 and U2F, so the same key covers desktops, laptops, tablets and phones.
What is the difference between a hardware token and a FIDO2 security key?
A classic hardware token displays one-time codes that a person types in, and those codes can still be phished or relayed. A FIDO2 security key instead signs a cryptographic challenge bound to the website’s origin, so there is nothing phishable to type.
Hideez Key 5 combines both functions in one FIDO2 device: a FIDO2 security key for supported passwordless sign-in, and a hardware token that generates TOTP codes for services that use one-time passwords.
Is Hideez Key 5 a good YubiKey alternative?
The right choice depends on the features your organization needs. Hideez Key 5 combines FIDO2/WebAuthn sign-in over supported connections with a hardware password manager for 1,000 logins, TOTP generation, proximity login and walk-away locking for Windows, and a contactless credential for compatible doors. One FIDO2 device instead of a security key, an OTP token and a badge.
Which features require the Hideez server?
The hardware password manager, OTP generator, proximity login/lock and 2FA workstation login are managed by Hideez Workforce Identity Server (v.4) together with the Hideez Client App for Windows.
What is Dongle mode? Do I need two keys?
Precision proximity (2–10 m measured distance) uses a second Hideez Key 5 connected to the workstation over USB-C as a Bluetooth dongle — one dongle per shared workstation. Standard mode needs only one FIDO key and the workstation’s compatible built-in Bluetooth.
Is the wristband included?
No. The Hideez FIDO key has a keychain eyelet built into the enclosure, and the rear of the device accepts a standard 20 mm watch strap. The wristband is sold separately.
Does it support macOS?
As a FIDO security key — yes, fully. The Hideez Client App features (password autofill, proximity lock/unlock) currently run on Windows; the macOS app is in development.
Can it replace our office badge?
The Hideez Key 5 FIDO2 security key ships with MIFARE Plus EV2 by default; MIFARE Classic, MIFARE DESFire or 125 kHz RFID are installed on orders from 1,000 units. The credential is provisioned with your usual access-control tooling, so no reader changes are needed.
How is it different from Hideez Key 4?
Bluetooth 6 with Channel Sounding for measured-distance proximity, USB-C, a hardware cryptographic service for signing and encryption, customizable physical-access options and a wristband option. See the comparison table above.
How long does the battery last?
The Hideez Key 5 multifunctional FIDO2 security key runs for up to 60 days per charge and recharges over USB-C.
Can we buy FIDO2 security keys in bulk?
Yes. Contact sales for a quote on bulk and enterprise security key deployments — we work with purchase orders and issue VAT invoices. Physical-access customization (MIFARE Classic, DESFire or 125 kHz RFID) is available on orders from 1,000 units, and pilot programs with Hideez Workforce Identity Server can be arranged on request.
Plan your passwordless rollout with the Hideez FIDO security key
Join the waitlist to line up a pilot for your team: shipping starts October 2026 at $65 MSRP per unit. Volume pricing and physical-access customization are available from 1,000 units.