Six security tools. One device.
Passwordless FIDO2 security key
Phishing-resistant sign-in to Microsoft Entra ID, Google Workspace and hundreds of FIDO services over USB-C, NFC or Bluetooth.
Hardware password manager*
Up to 1,000 logins and passwords with autofill, provisioned and managed centrally.
OTP generator*
Up to 1,000 TOTP accounts — a hardware token that replaces authenticator apps, with no personal phones involved.
Proximity workstation login*
The workstation signs an employee in on approach — with an optional PIN as a second factor, or Tap&Go where one workstation is shared.
Proximity walk-away lock*
The Bluetooth signal locks the workstation the moment the employee steps away. Trigger distance is tunable down to a meter.
Physical access credential
Opens office doors and turnstiles. MIFARE built in, custom options on order.
* Provisioned and managed with Hideez Workforce Identity Server
Passwordless where it’s supported, protected where it isn’t
One FIDO2 security key signs employees in to modern and legacy systems alike — where the standard is supported, and with stored credentials where it is not.
- Passwordless FIDO2. Phishing-resistant sign-in to hundreds of FIDO services over USB-C, NFC or Bluetooth.
- Hardware password manager. Up to 1,000 login and password pairs with autofill by button press or hotkey, plus a strong-password generator — for the internal apps that still expect a password.
- OTP generator. TOTP codes (RFC 6238) for up to 1,000 accounts, so enterprise 2FA no longer depends on personal phones.
- Hardware-backed signing and encryption. A BLE crypto service exposes AES-256 and ECC P-256 operations: private keys are generated on-device and cannot be exported, symmetric keys are write-only. Applications integrate it for document-signing and data-protection workflows.
The password manager, OTP generator and 2FA workstation login are provisioned and managed centrally with the Hideez Client app.
Proximity login and walk-away lock for Windows workstations
Presence replaces the password at the workstation: Windows signs the employee in on approach and locks the moment they step away — no user discipline required.
- Signing in. Unlock on approach, click-to-unlock or unlock-on-activity — with an optional PIN as a second factor, or Tap&Go where several people share one workstation.
- Walking away. The Bluetooth signal tells the workstation the employee has left and it locks itself. The trigger distance is tunable down to a meter.
- Standard mode. Works with the workstation’s built-in Bluetooth — no extra hardware. Proximity is estimated from signal level.
- Precision mode. Bluetooth 6 Channel Sounding measures real distance (2–10 m) using a second Key 5 as a USB-C dongle — it tells users apart at shared workstations and resists relay attacks.
One credential for doors, turnstiles and IT systems
The built-in contactless NFC credential opens electronic doors and turnstiles: MIFARE Plus EV2 (2K) by default, with MIFARE Classic, MIFARE DESFire or 125 kHz RFID installed on customer order from 1,000 units.
- Provisioned with the existing access-control tooling of the organization
- Fully isolated from the security-key electronics
- Keychain eyelet built in; the rear accepts a standard 20 mm watch strap (wristband sold separately)
Hardware-rooted trust in every security key
Every Hideez Key 5 pairs a Microchip ATECC608C secure element with Arm TrustZone isolation, hardware-accelerated AES-256 and ECC P-256 cryptography, and a PAKE-secured channel to the client.
Firmware is protected end to end: secure boot, encrypted storage and signed over-the-air updates. A PIN with progressive lockout guards the device, with optional PUK recovery.
Each unit ships with a factory-provisioned certificate, so every key is verifiably genuine. FIDO2 Level 2, CE and FCC certifications are planned.
One device for every kind of access
| Hideez Key 5 | FIDO security keys | FIDO smart cards | MS Authenticator | |
|---|---|---|---|---|
| Phishing-resistant passwordless sign-in (FIDO2 / WebAuthn) | ||||
| Works without a personal smartphone | ||||
| Signs in to apps that still expect a password | 1,000 credentials | Not typically | Autofill retired in 2025 | |
| One-time codes (TOTP) generated by the device | 1,000 accounts | Some models, with a companion app | On the phone itself | |
| Unlocks a Windows workstation on approach | ||||
| Locks the workstation on walk-away | ||||
| Opens doors and turnstiles | MIFARE built in | Some models | Some models |
The password manager, OTP generator and proximity features are provisioned with Hideez Client application and run on Windows. The security key and door credential work standalone.
Part of the Hideez Workforce Identity platform
Hideez Key 5 works standalone out of the box. Connect it to the Hideez Workforce Identity platform to unlock the hardware password manager, OTP, proximity login and centralized lifecycle management for every key in your fleet.
The control center of the platform — manage users, credentials, app integrations, workstation policies, and a full audit trail from one console, deployed as SaaS, private cloud, or on-premises.
Provision and deprovision users, rotate credentials, and enforce policies across every connected app and workstation from one place.
See who signed in, where, and when, with exportable logs that support your compliance and security reviews.
Run as SaaS, private cloud, or on-premises to meet your data-residency and regulatory requirements.
Turns a smartphone into a secure identity key: employees sign in to Windows workstations and business apps with a tap, and proximity can lock the PC when they step away.
Unlock Windows PCs with a phone tap instead of a typed password.
The workstation locks automatically when the paired phone moves out of range.
Fast, personal sign-in on shared workstations in healthcare, manufacturing, and retail.
Phishing-resistant FIDO2 / WebAuthn sign-in using device biometrics or a security key — no shared secret to steal, built on open standards that work across modern browsers.
Public-key credentials can't be reused or captured by fake sign-in pages.
Users sign in with the fingerprint or face unlock already on their device.
Built on FIDO2 / WebAuthn, so it works with modern browsers and identity providers.
Hideez AuthShield extends passwordless authentication and MFA to legacy web applications that were never designed for modern IAM or SSO.
It enables passwordless or MFA-based access to any web systems — helping organizations modernize authentication without rebuilding or replacing critical applications.
LEARN MOREFAQs
When will Hideez Key 5 be available?
Serial production starts in October 2026. Leave your email under Notify me and we will contact you the moment pre-orders open.
Does it work without any Hideez software?
Yes. As a FIDO2 / U2F security key it works out of the box with Microsoft Entra ID, Google and hundreds of WebAuthn services on Windows, macOS, Android, iOS and Linux.
Is Hideez Key 5 a USB security key or an NFC security key?
Both, in one device. It works as a USB-C security key when plugged into a workstation, as an NFC security key when tapped on a phone or reader, and as a Bluetooth security key when paired wirelessly. All three transports carry FIDO2 and U2F, so the same key covers desktops, laptops, tablets and phones.
What is the difference between a hardware token and a FIDO2 security key?
A classic hardware token displays one-time codes that a person types in, and those codes can still be phished or relayed. A FIDO2 security key instead signs a cryptographic challenge bound to the website’s origin, so there is nothing phishable to type. Hideez Key 5 is both: a FIDO2 security key for phishing-resistant passwordless sign-in, and a hardware token that generates TOTP codes for services that still only support one-time passwords.
Is Hideez Key 5 a good YubiKey alternative?
It covers what a classic FIDO2 security key does — phishing-resistant WebAuthn sign-in over USB-C and NFC — and adds what a single-purpose token can’t: Bluetooth, a hardware password manager for 1,000 logins, a TOTP hardware token that replaces authenticator apps, proximity login and walk-away lock for Windows, and a contactless credential for doors. One device instead of a security key, an OTP token and a badge.
Which features require the Hideez server?
The hardware password manager, OTP generator, proximity login/lock and 2FA workstation login are managed by Hideez Workforce Identity Server (v.4) together with the Hideez Client App for Windows.
What is Dongle mode? Do I need two keys?
Precision proximity (2–10 m measured distance) uses a second Hideez Key 5 connected to the workstation over USB-C as a Bluetooth dongle — one dongle per shared workstation. Standard mode works with the workstation’s built-in Bluetooth and needs nothing extra.
Is the wristband included?
No. The keychain eyelet is built into the enclosure, and the rear of the device accepts a standard 20 mm watch strap. The wristband is sold separately.
Does it support macOS?
As a security key — yes, fully. The Hideez Client App features (password autofill, proximity lock/unlock) currently run on Windows; the macOS app is in development.
Can it replace our office badge?
Yes. It ships with MIFARE Plus EV2 by default; MIFARE Classic, MIFARE DESFire or 125 kHz RFID are installed on order from 1,000 units. The credential is provisioned with your usual access-control tooling, so no reader changes are needed.
How is it different from Hideez Key 4?
Bluetooth 6 with Channel Sounding for measured-distance proximity, USB-C, a hardware cryptographic service for signing and encryption, customizable physical-access options and a wristband option. See the comparison table above.
How long does the battery last?
Up to 60 days per charge. Recharges over USB-C.
Can we buy FIDO2 security keys in bulk?
Yes. Contact sales for a quote on bulk and enterprise security key deployments — we work with purchase orders and issue VAT invoices. Physical-access customization (MIFARE Classic, DESFire or 125 kHz RFID) is available on orders from 1,000 units, and pilot programs with Hideez Workforce Identity Server can be arranged on request.
Plan your passwordless rollout with Hideez Key 5
Join the waitlist to line up a pilot for your team: shipping starts October 2026 at $65 MSRP per unit. Volume pricing and physical-access customization are available from 1,000 units.