Use your own numbers
Start with three basic values. Reserve, planning period and monthly per-key and base licences are optional.
YUBIKEY COST SCENARIO
How many YubiKeys do you really need?
Enter people, identities and unit price to see two hardware scenarios. Add monthly software licences if needed. Your security architecture decides whether those identities may share a key.
VALUE IN 30 SECONDS
A calculation that makes every assumption visible.
Compare two scenarios
Classic layout: one YubiKey per identity. x.ID model: one YubiKey per person, provided an approved slot profile accommodates all required identities.
Keep security in control
The calculation never decides which roles may share hardware. That remains an architecture and policy decision.
FROM ROLES TO HARDWARE DEMAND
Which assumptions actually determine the number of security keys?
A person with a user account and two separate administrator accounts counts as one person with three identities here. Authentication, signing and encryption are use cases—not additional people or identities.
-
01
Count people and identities
Begin with the number of users and the average number of distinct PIV identities or roles each person needs.
-
02
Understand the two layouts
For the comparison scenario, we plan one YubiKey per identity. In the x.ID scenario, one person’s approved identities share one key. This is a calculation assumption, not a general limit of the PIV standard.
-
03
Add reserve and monthly licences
Optionally enter spares, planning years and quoted prices: per managed YubiKey per month plus one base licence per month.
-
04
Compare hardware and total cost
Review the physical-key delta, hardware cost, management licences and total cost, then validate the security assumptions.
LOCAL SCENARIO CALCULATION
Calculate your YubiKey cost scenario.
Start with three values. Compare one identity per key with a shared key per person. Add reserve and monthly software cost only when needed.
Model assumption: all identities belonging to one person fit an approved x.ID slot profile on one YubiKey. S/MIME reservations and security rules must permit this. The calculator does not validate that prerequisite. A software price of 0 means “not included”, not “free”. This is not a comparison with a specific competitor.
YubiKeys incl. reserve · one identity per key
- Hardware
- –
- Software over period
- –
- Total
- –
YubiKeys incl. reserve · one key per person in this model
- Hardware
- –
- Software over period
- –
- Total
- –
How the calculation works
Comparison: people × identities. x.ID: one key per person. Both: initial quantity × (1 + reserve / 100), rounded up to whole YubiKeys. Hardware = quantity × unit price. Software = (managed YubiKeys excluding reserve × monthly unit licence + monthly base licence) × 12 × years. Total = one-time hardware + software over the period. Difference is comparison minus x.ID; negative amounts mean higher x.ID model cost.
Planning guidance, not a quotation. Implementation, services, taxes, shipping, accessories and operations are not included. The number of identities a YubiKey may actually carry must fit the hardware, cryptography and security policy.
TECHNICAL DEPTH
How the scenario is calculated.
The formula is deliberately simple and visible. It supports an initial decision conversation without pretending to replace a detailed rollout and lifecycle calculation.
- One-identity-per-key baseline
- People × identities per person gives the managed comparison keys. Add reserve as initial quantity × (1 + reserve percent / 100), rounded up to whole devices.
- Multi-identity scenario
- One approved key per person gives the managed x.ID quantity. Reserve is calculated in the same way as for the comparison. This is a model assumption, not an automatic slot-capacity or policy check.
- Monthly software cost in both scenarios
- (Managed YubiKeys × licence per YubiKey/month + base licence/month) × 12 × years. The base licence is charged once per scenario, not per person. 0 means not included, not free.
- Hardware, period and difference
- Hardware = YubiKeys including reserve × unit price, charged once. Total = hardware + software over the planning period. Difference = comparison minus x.ID; a negative amount means higher x.ID model cost. The period is not a tax depreciation calculation.
EVIDENCE & BOUNDARIES
What this calculator can support.
Use the result to ask the right procurement and architecture questions—not to skip the technical design.
Transparent assumptions
Every input affecting the result remains visible and editable.
Local processing
The browser calculates the scenario without sending or storing the entered values.
Architecture review
The scenario provides a concrete starting point for validating role separation, slot use and lifecycle policy.
RELATED PRODUCT
SYNRION x.ID
Manage YubiKeys, identities, PIV certificates and FIDO2 centrally in a browser. SYNRION x.ID combines native Entra integration with cloud, on-premises or hybrid deployment through Outpost connectors. The portal also supports mobile access; the feature overview states release status and requirements.
THE NEXT CONTROLLED STEP
Turn the scenario into a defensible architecture.
Bring your user groups, role model, hardware requirements and procurement assumptions. We will separate feasible consolidation from roles that need dedicated keys.