The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →To create a PIN for a physical security key in Windows 11, open Settings > Accounts > Sign-in options > Security Key > Manage. Insert the USB key, or tap an NFC key on the computer’s NFC reader. In the Security Key PIN section, select Add, enter the new PIN twice, select OK, and then select Close.
This PIN belongs to the FIDO2 security key. It is not the Windows Hello PIN that unlocks your PC. Use Change in the same Manage window when a key already has a PIN.
What you need before creating the PIN
Have the physical key with you before opening the management screen. Windows supports keys that connect through USB and keys that communicate by NFC. A USB key must be plugged into a working USB port; an NFC key must be tapped against an NFC reader supported by the computer.
For a personal Microsoft account, the Security Key controls may be available directly in Windows Settings. For a work or school account, availability depends on the organization’s identity-system configuration and administrator policy. The key normally must be a FIDO2 authenticator that meets Microsoft requirements and is approved by the organization. If your employer or school has not enabled security-key management, the option may not appear even when the hardware itself works elsewhere.
#1 Best Overall
You do not need to buy new hardware if you already have a compatible key. If you need one, look for a generic FIDO2 security key and check two things before purchase: whether your device supports its connection method (USB or NFC), and whether your organization permits that key model. Microsoft describes security keys as products commonly sold through computer-accessory retailers, but a particular model, price, connector, or retailer should not be assumed to be available for every user.
Before changing a PIN, identify which account and which physical key you are working with. The PIN is stored on the authenticator, not in your Windows profile. If you own several keys, label them externally or keep an inventory of which key is registered to which accounts. Never write the PIN on the key or store it with the key.
How do I create a new security key PIN in Windows 11?
- Open Settings. You can select the Start button and choose Settings, or press Windows key + I.
- Open the sign-in settings. Select Accounts, then Sign-in options.
- Open security-key management. Select Security Key, then select Manage. If Windows asks you to verify your identity, follow that prompt.
- Present the key. Insert the security key into USB. For an NFC key, tap it on the computer’s NFC reader. Keep it available while the management dialog opens.
- Choose Add. Find the Security Key PIN area and select Add. The button creates a PIN when the key does not already have one.
- Enter and confirm the PIN. Type the new PIN, type it again when prompted, and select OK. Windows sends the PIN-management request to the physical authenticator; this does not alter your Windows Hello credentials.
- Finish. Select Close after Windows confirms the operation. Leave the key connected until the dialog has closed.
The exact PIN rules are enforced by the authenticator and its Windows management interface. Microsoft’s instructions do not establish one universal PIN length, character set, or retry limit for every FIDO2 key, so follow the requirements shown on your screen and in the key manufacturer’s documentation. A message rejecting a PIN does not necessarily mean that Windows is broken; it may indicate that the key’s own policy was not met.
What the Add process does—and does not do
Selecting Add initializes a PIN on the physical security key when no PIN is set. It does not create a Windows account password, change your Microsoft account password, or alter the PIN used to unlock the computer. The operation also does not automatically register a new account credential. It only manages the PIN capability of the key you present.
Free tools Windows power users keep installed
One-click scans. No signup required.
After the PIN exists, a website or identity provider can request user verification when you sign in with that key. Depending on the authenticator and the request, verification can involve the key PIN or another supported method. The PIN therefore protects use of the key during supported sign-ins; it is not a substitute for keeping the device itself secure.
How do I change an existing security key PIN?
Use the same path whenever the key already has a PIN:
Rank #2
- Open Settings > Accounts > Sign-in options.
- Select Security Key > Manage.
- Insert the USB key or tap the NFC key.
- In Security Key PIN, select Change rather than Add.
- Enter the current PIN if requested, enter the replacement PIN twice, and select OK.
- Select Close.
Add is for a key with no PIN. Change is for replacing a PIN that is already set. Choosing the wrong action can make the workflow appear inconsistent, so first determine whether the key has been initialized with a PIN. If Windows displays only one of these controls, follow the state reported by the key rather than trying to force the other action.
Do not unplug the key, move an NFC key out of range, close Settings, or shut down the computer while the PIN operation is in progress. If the dialog fails, wait for an error or completion message, then reconnect the key and start again. Avoid repeatedly guessing a PIN because retry and lockout behavior is determined by the authenticator and is not universal.
Recommended Free Tools
Is a security key PIN the same as my Windows PIN?
No. They protect different authenticators:
| Credential | Where it is stored | Windows location | What it unlocks |
|---|---|---|---|
| Windows Hello PIN | The PC’s Windows Hello sign-in system | Settings > Accounts > Sign-in options > PIN (Windows Hello) | Sign-in to that Windows device |
| Security key PIN | The physical FIDO2 security key | Settings > Accounts > Sign-in options > Security Key > Manage | Use of that key during supported account sign-ins |
Changing PIN (Windows Hello) changes only the PC sign-in credential. It does not add, change, or reset the PIN stored on a USB or NFC security key. Conversely, changing the key PIN does not change how you unlock Windows with Windows Hello. If a support article sends you to the Windows Hello PIN page when your problem concerns a physical key, you are in the wrong workflow.
Why is Windows asking me to create a security key PIN?
Windows 11 can request a key PIN during a normal FIDO2 sign-in even when you never created one in Settings. Microsoft documents this behavior for Windows 11 versions 24H2 and 25H2 after the September 29, 2025 preview update and later updates. During authentication, a website or identity provider can request User Verification = Preferred. When the authenticator supports verification but has no PIN, Windows may ask you to create one.
Microsoft says the rollout of this behavior completed with the November 11, 2025 security update or later. Preferred verification means the relying party wants an additional verification method when the authenticator supports one; that method can be a PIN or a biometric check, depending on the key. This sign-in prompt is separate from deliberately opening Security Key > Manage to configure the key.
If the prompt appears during a sign-in and you recognize the account and website, complete the on-screen PIN-creation process if you want to use the key with that verification requirement. If you intended to manage the key manually, cancel the sign-in flow and use the Settings route so you can see whether Windows offers Add or Change. Never enter a key PIN into an unrelated password field or an unfamiliar site.
USB versus NFC: which connection should you use?
| Connection | How you present the key | What to verify | Common limitation |
|---|---|---|---|
| USB | Insert the key into a compatible USB port and leave it connected while Windows communicates with it. | Connector type, available port, and any organization approval for the model. | A damaged port, adapter, or unsupported connector can prevent detection. |
| NFC | Tap the key on the computer’s NFC reader when Windows asks for it. | That the computer has an active NFC reader and that the key supports NFC. | A desktop or laptop without an NFC reader cannot use the tap method. |
There is no universally best connection method in Microsoft’s guidance. Choose the method your computer can read reliably and that your administrator permits. A key can be physically present yet unusable if its connection type is incompatible with the reader. On a USB device, check the connector and port rather than assuming every USB-shaped plug supports the same interface. With NFC, tap at the reader’s indicated location and hold the key there until Windows responds.
Personal accounts versus work or school accounts
Personal Microsoft accounts can expose security-key management in Windows Settings, but the exact controls still depend on account configuration and the Windows release. A work or school account adds an administrative layer: the organization must enable the feature, and its identity policy may restrict which FIDO2 authenticators can be registered or managed.
For organizational use, confirm all three prerequisites before troubleshooting the PIN: security-key use is enabled for your account, the physical key is FIDO2-compliant and meets Microsoft requirements, and the model is approved by the administrator. A key that works with a personal account may still be blocked at work or school. Ask the help desk whether the policy permits USB, NFC, or both connection types.
Microsoft’s work-or-school guidance says an account may have up to 10 registered keys. That ceiling concerns registrations associated with the account; it does not mean every user should maintain ten active devices. Keep only keys you control, remove entries for lost or retired keys, and maintain an alternate sign-in method before changing or resetting hardware.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat if Security Key is missing from Sign-in options?
On a work or school account, the most likely explanation is policy rather than a missing Windows component. The organization must enable security-key use, and it may restrict registration or management to approved FIDO2 models. Contact the help desk or identity administrator and ask whether security keys are enabled for your account and whether your key is on the approved list.
For a personal account, confirm that you are looking under Accounts > Sign-in options rather than PIN (Windows Hello), reconnect the key, and reopen Settings. Account controls can vary with the Windows release and account configuration. If Windows does not show manufacturer-specific management instructions, Microsoft directs you to the key maker’s site for those instructions.
Rank #4
What if Windows does not recognize the key?
- Check the connection method. Reinsert a USB key firmly, try another compatible port, or tap an NFC key directly on the reader’s indicated area.
- Remove avoidable adapters. If possible, connect a USB key directly instead of through a hub or adapter.
- Confirm compatibility. For organizational accounts, verify that the key is FIDO2-compliant and approved by the administrator.
- Check the reader. NFC requires an active NFC reader on the computer; simply owning an NFC key does not add NFC capability to a device.
- Follow the manufacturer’s management instructions. Windows may not display manufacturer-specific controls. Microsoft directs users to the key maker’s documentation when those instructions are not listed in Windows.
- Retry from a clean session. Close the Manage dialog, disconnect the key, reconnect it, and return to Security Key > Manage. Do not remove the key while a PIN operation is still running.
What if I forgot the security key PIN?
Do not automatically choose PIN (Windows Hello); that workflow concerns the PC and cannot be assumed to reset the physical key. Microsoft’s general Windows instructions explain how to create and change a security-key PIN but do not define one universal forgotten-PIN recovery sequence for every authenticator.
Use the options shown when you open Security Key > Manage, and consult the key manufacturer’s instructions for that model. Some authenticators provide their own reset or retry handling, while others may require a factory reset. A factory reset is destructive: it clears data and credentials stored on the key. Do not perform it unless you understand that you may need to register the key again with every account that used it.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Because retry and lockout policies differ, do not promise a fixed number of attempts or a universal recovery code. If the key is controlled by an employer or school, ask the administrator before resetting it; the organization may have a required recovery or replacement process.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What happens if the key is lost or you no longer want to use it?
Remove the key from the account’s registered security information to stop that account from accepting it. Account removal and device reset are different operations:
- Account removal revokes that key’s use with the selected account but does not erase credentials or the PIN stored on the physical device.
- Factory reset clears the key’s stored data and credentials. It affects the device itself and can require re-enrollment everywhere.
If a key is lost, remove it from every account where it was registered and use another available sign-in method while replacing it. If the key was managed by an employer or school, follow the organization’s incident procedure as well. If you later find the key, do not assume that removing it from one account removed it from every other account.
How many keys can an account register?
Microsoft’s work-or-school security-key guidance says an account may have up to 10 registered keys. That is an account product limit, not a recommendation to keep ten active devices. Register only the keys you control, label them so you can identify them, and remove entries for keys that are lost, retired, or transferred.
Safe setup checklist
- Confirm that you are editing Security Key > Manage, not PIN (Windows Hello).
- Have the physical USB or NFC key present before selecting Manage.
- Use Add only when the key has no PIN; use Change for an existing PIN.
- Keep the key connected or within NFC range until Windows finishes.
- Follow the key’s displayed PIN requirements; do not assume a universal length or retry count.
- For work or school use, confirm administrator enablement and model approval.
- Record which accounts use each key, but never record the PIN alongside the key.
- Keep an alternate sign-in method available before changing, removing, or resetting a key.
- Before resetting a key, make sure you understand that stored credentials will be erased.
Frequently Asked Questions
Can I create a security key PIN without inserting the key?
No. Windows needs to communicate with the physical authenticator. Insert a USB key or tap an NFC key on a supported reader when Security Key > Manage asks for it.
Should I select Add or Change?
Select Add when the key has no PIN. Select Change when a PIN is already configured. The two actions represent different key states.
Will changing my Windows Hello PIN change my security key PIN?
No. Windows Hello is stored in the PC’s sign-in system, while the security key PIN is stored on the physical FIDO2 key. Use Security Key > Manage for the key.
Why did a website suddenly ask me to create a key PIN?
On Windows 11 24H2 and 25H2, supported updates can show this prompt when a website or identity provider requests preferred user verification and the key has no PIN. The behavior rolled out with the November 11, 2025 security update or later.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhat if my employer blocks the Security Key option?
Work and school accounts depend on administrator policy. Ask the help desk whether security keys are enabled and whether your FIDO2 model is approved and compliant.
Does removing a key from my account erase its PIN?
No. Account removal stops that account from accepting the key but does not clear data on the device. A factory reset clears stored credentials and can require re-enrollment.
The Bottom Line
Use Settings > Accounts > Sign-in options > Security Key > Manage, present the physical USB or NFC key, and choose Add for a first PIN or Change for an existing one. Keep this separate from the Windows Hello PIN, follow the key’s own requirements, and check administrator policy for work or school accounts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
