How a Tech Enthusiast Turned a $6 Microcontroller into a DIY Security Key to Avoid Buying a YubiKey

Hardware authentication for passwordless logins has steadily grown in popularity as digital security demands more robust alternatives to traditional passwords. However, the financial barrier associated with dedicated hardware tokens often leaves budget-conscious users looking for alternative solutions. Rather than investing roughly $30 in a commercial YubiKey, one technology writer decided to explore whether a common, low-cost microcontroller already sitting in a drawer could successfully replicate the exact same experience. The result was a surprising revelation in how accessible modern hardware security tools have become for everyday users.

What is an ESP32, and how does it replace a YubiKey?

The core of this alternative setup relies on the ESP32, a remarkably versatile and inexpensive small microcontroller originally designed by Espressif. Manufactured by various third-party companies at a minimal cost, these boards have become staples in the maker and DIY tech communities. Specifically, the project utilizes the ESP32-S3N16R8 model, an iteration of the ESP32-S3 board equipped with 16 megabytes of flash memory and 8 megabytes of PSRAM.

What makes the ESP32 particularly powerful for this application is its ability to function natively as a USB device. This functionality allows the microcontroller to emulate standard USB peripherals on any connected host computer, ranging from a basic keyboard or mouse to more specialized devices. Because the hardware can be programmed to execute custom instructions and interact with operating systems directly via USB, it serves as a flexible blank canvas. In this case, instead of controlling a cursor or typing text strings, the board was programmed to act as a dedicated hardware security key capable of handling passwordless authentication protocols.

What is a YubiKey?

To understand the scope of the DIY project, it helps to look at the commercial standard it seeks to mimic. Several years ago, major technology ecosystems introduced passkeys as a modern replacement for traditional passwords, offering a streamlined login method that eliminates the need to remember or type complex character strings. Passkeys are inherently more secure than standard passwords, making them exceptionally difficult to compromise through typical credential-harvesting attacks.

The most common way consumers interact with passkeys is through software-based password managers. While convenient, this approach introduces a distinct vulnerability: if a cloud-based password manager account is breached, the associated passkeys could theoretically be exposed.

Physical security keys like the YubiKey take a fundamentally different approach. These dedicated hardware tokens store passkeys directly within secure, onboard physical storage. The cryptographic credentials remain isolated inside that specific device vault. If the physical token is lost, the passkey is lost along with it, though alternative account recovery mechanisms are typically available. Because the credentials never leave the physical hardware, they are exceptionally secure and virtually immune to phishing attempts. However, with retail prices ranging around $30, these commercial dongles represent an added expense for users who simply want to test out hardware-based security for the first time.

How did I set up my ESP32-S3 to replicate a YubiKey?

Configuring the ESP32-S3 to function as a security key proved to be a remarkably swift process, taking less than two minutes from start to finish. The deployment began by utilizing Pico Keys, a specialized platform designed to help users deploy their own hardware secure modules. The website features an integrated browser-based flasher tool specifically engineered for ESP32-S2 and ESP32-S3 microcontrollers.

Through the web flasher interface, the project utilized Pico FIDO, software that equips the ESP32 to register and operate seamlessly as a passkey authenticator within modern web browsers. This firmware brings comprehensive WebAuthn support, PIN protection, and physical button confirmation directly to the microcontroller’s authentication stack. The actual flashing procedure took between 60 and 90 seconds. Once the process concluded, the ESP32 was temporarily unplugged from the host MacBook, allowed to reset for a few seconds, and reconnected.

To verify functionality, the writer visited WebAuthn.io, a dedicated testing platform designed to evaluate security keys. The platform functions by registering a temporary user account and binding a passkey directly to the connected security hardware. Following a brief calibration period, the setup consistently authenticated test logins, allowing the microcontroller to remain plugged into the workstation and ready to store passkeys for various services without requiring typed passwords.

Would I trust this instead of a YubiKey?

From a purely functional and cryptographic perspective, the ESP32 proves to be a trustworthy substitute for a commercial YubiKey. Both devices are microcontrollers that interface via USB to handle secure authentication protocols for a host machine.

The primary drawback lies entirely in the physical form factor and durability. A commercial YubiKey is engineered specifically to be rugged, compact, and resilient enough to live on a keychain alongside house and car keys. By contrast, the ESP32 board used in the project is relatively large and delicate. While a custom 3D-printed enclosure could theoretically provide additional physical protection, the raw board remains bulky and unsuited for pocket or travel carry.

For a stationary desktop workflow, leaving the microcontroller plugged into a workstation dock presents virtually no operational issues. However, tossing the exposed board into a backpack or pocket for on-the-go authentication is impractical, which somewhat undermines the portability benefits typically associated with physical security tokens. Ultimately, while the hardware reliability and security performance are solid, its physical resilience leaves room for improvement.

For users hesitant to invest in commercial hardware without knowing whether they will adopt the workflow, going the DIY route serves as an effective testing ground. Exploring hardware-based authentication using an inexpensive, pre-owned microcontroller allows individuals to experience the benefits of passkeys and physical verification firsthand before deciding whether to purchase a dedicated commercial product.