Short answer: yes, you can use a YubiKey with a password manager on your iPhone without paying extra — but only with the right kind of app and the right kind of key. The iOS apps that unlock a KeePass (KDBX) database with a YubiKey all rely on one specific mechanism: HMAC-SHA1 challenge-response over NFC. Most of them put that feature behind a paid tier — KeePassium and Strongbox both charge for YubiKey support. Kakuremi is the exception: its YubiKey unlock is free.

There is one catch that trips up a lot of buyers. The YubiKey "challenge-response" that KeePass apps use is not the same thing as FIDO2, passkeys, or WebAuthn. A FIDO2-only "Security Key" model will not unlock a KDBX file. Below we explain the difference, list which iPhone apps support YubiKey and at what cost, and tell you exactly which key to buy so your money is not wasted.

App	Platforms	YubiKey unlock (HMAC-SHA1 CR)	Cost of YubiKey support	Format	Independent audit
Kakuremi	iPhone (iOS 17/18+)	Yes, over NFC	Free	KDBX 3 / 4	Not yet (Rust core, open format)
KeePassium	iOS, macOS	Yes, NFC or Lightning (5Ci)	Paid — Premium €19.99/yr or €79.99 lifetime	KDBX	Yes — Cure53 (2024)
Strongbox	iOS, macOS	Yes (KeePassXC mode)	Paid — Pro $2.99/mo, $24.99/yr, $124.99 lifetime	KDBX	Not publicly published
KeePassXC	Windows, macOS, Linux (desktop only)	Yes, USB or NFC	Free (open source)	KDBX	Open source (code public)
1Password / Bitwarden / Proton Pass	iOS + cloud sync	No — FIDO2 for account login, not KDBX unlock	Cloud subscription (varies)	Proprietary / cloud	Yes (varies by vendor)

Competitor pricing and features verified June 2026 and may change — check each app's own site for the latest. Kakuremi details reflect the current App Store version.

Two kinds of "YubiKey support" — and why the difference decides everything

A single YubiKey can speak several protocols, and password managers use them in completely different ways. Getting this wrong is the most common reason a YubiKey "doesn't work" with a KDBX app on iPhone.

• FIDO2 / WebAuthn / passkeys — this is the modern, passwordless login standard. Your YubiKey proves your identity to a remote server (a website or a cloud account). This is what cloud password managers use the key for: a second factor to log into their account. It is also the only thing a FIDO2-only model — sold as "Security Key" or "Security Key NFC" — can do.
• HMAC-SHA1 challenge-response (CR) — this is an offline mechanism with no server involved. The app sends a random challenge; the YubiKey computes an HMAC-SHA1 response using a secret stored in one of its configurable slots; the app mixes that response into the database's encryption key. This is the KeePassXC mechanism, and it is what every KeePass/KDBX app on iPhone uses to gate your vault.

The practical consequence: to unlock a KDBX file you need a key that can do HMAC-SHA1 challenge-response. The cheaper FIDO2-only "Security Key" line cannot. You need a YubiKey 5 series (5 NFC, 5C NFC, 5Ci) or an older YubiKey NEO, which include the OTP/challenge-response application. Set expectations accordingly before you buy.

Which iPhone password managers support YubiKey — and what they cost

All of the apps below read the open KDBX format (KeePass), so the same database file is portable between them. They differ on price and on whether YubiKey is free.

• Kakuremi (iOS) — free, local-first KDBX manager. YubiKey unlock via HMAC-SHA1 challenge-response over NFC is included in the free tier, alongside one vault, AutoFill, Face ID, the password generator, search, and editing. No account, no cloud, no telemetry. This is the free CR option.
• KeePassium (iOS, macOS) — a mature, well-respected freemium app. YubiKey support is a paid feature: Premium is €19.99/year, or a one-time lifetime Pro license is €79.99. KeePassium completed an independent Cure53 security audit in 2024 and ships in roughly 20 languages — genuine strengths if a published audit and broad localization matter to you.
• Strongbox (iOS, macOS) — an established freemium app with YubiKey challenge-response (KeePassXC mode). YubiKey is a Pro feature: $2.99/month, $24.99/year, or $124.99 lifetime, with a single license covering iPhone, iPad and Mac.
• KeePassXC (desktop only) — free, open-source, and supports YubiKey CR at no cost — but it runs on Windows/macOS/Linux, not iPhone. It pairs perfectly with any of the iOS apps above for editing the same file on a computer.
• 1Password / Bitwarden / Proton Pass — excellent cloud managers, but a different model. They use a YubiKey via FIDO2 to secure account login, not to encrypt a local KDBX file. If you specifically want a YubiKey as a per-database encryption factor, these are not the same thing.

What you actually need: the right key and a configured slot

Before your YubiKey will open a KDBX vault on iPhone, three things have to be true:

• A compatible key. A YubiKey 5 series or NEO. On iPhone the connection is NFC (tap the key to the top of the phone). KeePassium also supports the Lightning-based 5Ci; Kakuremi uses NFC.
• A configured HMAC-SHA1 slot. A brand-new YubiKey does not have a challenge-response secret until you program one. You do this once on a computer with the free YubiKey Manager (or Yubico Authenticator), choosing the "Challenge-Response" / HMAC-SHA1 application for slot 1 or 2.
• A backup key with the same secret. This is non-negotiable. The challenge-response secret becomes part of your encryption key — if your only YubiKey is lost or damaged, the database cannot be recovered. Program a second key with the identical secret and store it safely.

The YubiKey is an additional factor combined with your master password — not a replacement for it. You still enter (or Face ID-unlock) your password, then tap the key.

Where Kakuremi fits — and where it honestly doesn't

Kakuremi was built around one idea: hardware-key security should not be a paywalled luxury. If you already own (or are buying) a YubiKey 5 or NEO and just want to unlock your vault on your iPhone without a subscription, Kakuremi covers that for free.

What is free: one KDBX 3/4 vault; creating, editing and organizing entries, groups and tags; iOS AutoFill; Face ID; the password generator; search; storing TOTP secrets; viewing attachments; and YubiKey unlock over NFC. The core is written in memory-safe Rust, runs entirely on-device, and the App Store privacy label is "Data Not Collected" — no accounts, no cloud sync, no analytics.

What is Pro ($2.99/mo, $14.99/yr with a 1-month free trial on yearly, or $49.99 lifetime): multiple databases, adding and managing file attachments, and viewing/copying live TOTP codes. YubiKey is not in that gate — it stays free.

Being fair about the trade-offs: Kakuremi is iPhone-only (no macOS app — use KeePassXC on desktop), its core has not yet been independently audited the way KeePassium's has, and it is a newer, smaller app than the long-established alternatives. If a published third-party audit or a native Mac app is a hard requirement, KeePassium or Strongbox may suit you better — and because everything is KDBX, you can switch any time.

Frequently asked questions

Can I use a FIDO2-only "Security Key" to unlock my KDBX database on iPhone?

No. KDBX apps unlock the database with HMAC-SHA1 challenge-response, which FIDO2-only models (sold as "Security Key" / "Security Key NFC") cannot perform. You need a YubiKey 5 series or NEO, which include the challenge-response application.

Is Kakuremi's YubiKey support really free?

Yes. YubiKey unlock over NFC is part of the free tier, along with one vault, AutoFill, Face ID, the password generator, search and full editing. Most KeePass-compatible iOS apps charge for YubiKey; Kakuremi does not.

Which YubiKey models work with a password manager on iPhone?

A YubiKey 5 series (5 NFC, 5C NFC, or 5Ci) or a YubiKey NEO, with one slot configured for HMAC-SHA1 challenge-response. On iPhone the key connects by NFC (some apps also support the Lightning-based 5Ci).

Do I need to set anything up on the key first?

Yes. A new YubiKey has no challenge-response secret until you program one. Use the free YubiKey Manager or Yubico Authenticator on a computer to enable the Challenge-Response (HMAC-SHA1) application on slot 1 or 2.

Do I need a backup YubiKey?

Strongly yes. The challenge-response secret becomes part of your encryption key, so if your only key is lost or broken the database cannot be recovered. Program a second key with the identical secret and store it separately.

Can I open the same database on my Mac or PC?

Yes. The KDBX format is the interoperability standard. KeePassXC on desktop supports the same YubiKey challenge-response for free, so you can edit the same file on a computer and unlock it on your iPhone with Kakuremi.

If you already have a YubiKey 5 or NEO, try Kakuremi free on the App Store and unlock your KDBX vault by NFC tap — no subscription, no account, no catch. Download Kakuremi free.