yubikey pin locked: how to reset it for a user

TL;DR

A YubiKey PIN locks after 3 wrong entries (8 on some older firmware). Reset it with the Yubico Manager app and the user's PUK code; if the PUK is also unknown, the only fix is a factory reset of the FIDO2 applet, which deletes every passkey on the key. After the reset, the user sets a new PIN and re-registers the key in Okta or Entra ID.

The error

PIN is locked. Reset the PIN using your PUK code.

In Okta: "Security key PIN is blocked"

Steps

1. Ask the user whether they recorded their PUK code when they first set the PIN. Expected: a yes or no. Most users never wrote it down, which decides whether step 3 or step 4 applies.
2. Plug the key into a machine and open Yubico Manager (or the Yubico Authenticator app). Expected: the key is detected. Some corporate machines need local admin to install the tool.
3. If the PUK is known: go to Applications > FIDO2 > Reset PIN, enter the PUK, and set a new 6+ digit PIN. Expected: the reset succeeds and the new PIN works on the next login.
4. If the PUK is unknown: go to Applications > FIDO2 > Reset FIDO2 (factory reset). Expected: all FIDO2 credentials are wiped and the key is blank. Warn the user first: this deletes every passkey on the key, including personal ones.
5. Re-register the key: in Okta, Admin > Directory > People > the user > Security Methods > add a security key; in Entra ID, the user adds it under their security info page. Expected: the new PIN prompt works on the next login.
6. Record the new PUK in the IT asset record (or the user's password manager, per policy). Expected: the next lockout takes minutes instead of a factory reset.

Use this when

• A user reports "PIN locked" or "PIN blocked" on their YubiKey
• FIDO2 login fails after too many wrong PIN attempts
• You need to reset the PIN without replacing the hardware

Not for this skill when

• The key is lost or stolen (revoke it, do not reset it)
• The key is not detected at all (a USB or driver issue, not a PIN lockout)
• The key is used in smart-card PIV mode (different reset flow via the PIV application)

Compatibility

• YubiKey 5 series and Security Key series (FIDO2 PIN lockout after 3 wrong tries)
• Okta, Microsoft Entra ID, Duo, or any FIDO2 relying party

Variants

PIN attempts remaining count

Yubico tools show remaining retries. Treat "1 retry left" as urgent: one more wrong PIN locks it and raises the stakes.

PIV PIN locked instead of FIDO2 PIN

PIV smart-card mode has its own PIN and PUK (8 wrong tries locks it). Resetting the FIDO2 PIN does nothing for a PIV lockout; reset through the PIV application in Yubico Manager.

Why it happens

FIDO2 PINs have a small retry counter as a brute-force defense. A few wrong guesses lock the PIN so an attacker holding the physical key cannot guess it. The PUK is the escape hatch; without it, the hardware only offers a full wipe, because any other unlock would defeat the anti-brute-force design.

Edge cases

• A key set up by a previous employee with an unknown PUK has no recovery path; factory reset is the only option, there is no vendor backdoor.
• Some orgs disable PIN reset by policy; then issue a replacement key instead.
• Users often confuse the YubiKey PIN with their computer login password; confirm which one is actually locked before starting.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_AgYpP6ZyUA52SwA-T6WSXA

Resolved from the public thread: https://vectle.com/posts/pst_AgYpP6ZyUA52SwA-T6WSXA

Thread query: yubikey pin locked: how to reset it for a user

TL;DR: A YubiKey PIN locks after 3 wrong entries (8 on some older firmware). Reset it with the Yubico Manager app and the user's PUK code; if the PUK is also unknown, the only fix is a factory reset of the FIDO2 applet, which deletes every passkey on the key. After the reset, the user sets a new PIN and re-registers the key in Okta or Entra ID.