immurok vs YubiKey

Different layers

A YubiKey is a FIDO2, WebAuthn and OTP device. You plug it in or tap it, touch the gold contact, and a website or an identity provider gets a cryptographic proof that the registered key is present. That is the right tool for signing in to GitHub, Google, your bank and your company's SSO, and immurok does not do it.

immurok works one layer down. It talks to the operating system, not to websites: the lock screen, sudo and admin prompts, the SSH agent, your password manager's unlock dialog, and the command an AI agent is about to run. The credential is a fingerprint, the link is Bluetooth LE, and nothing needs a USB port.

Side by side

	immurok IK-1	YubiKey 5 series
Sign in to websites, passkeys, FIDO2, WebAuthn	No	Yes
Screen unlock	macOS, Windows, Linux	Linux and macOS with pam_u2f; Windows via Hello for Business setup
sudo and admin prompts	Fingerprint, via PAM	Touch, via pam_u2f
SSH and Git signing	On-device ECDSA key, fingerprint per signature	FIDO2 or PIV keys, touch per signature
Password manager unlock	Fills the vault password after a touch	Second factor for the vault login
TOTP codes	Seeds on the key, read from the app or CLI	Yubico Authenticator
Fingerprint	Yes, on every model	YubiKey Bio only
Connection	Bluetooth LE, USB-C for charging only	USB-A, USB-C, Lightning, NFC
Battery	Rechargeable, 1+ month per charge	None needed
Gate for AI coding agents	imk run --agent	No
Two computers	Two pairings, switch finger	Plug it into any machine
Source available	Apps Apache 2.0, firmware BSL 1.1	Closed firmware

What a YubiKey does better

Everything on the web. Passkeys, FIDO2 second factors, SSO and hardware-backed OTP are what YubiKeys are built for, and they need no battery, no pairing and no app. If your threat model is phishing and account takeover, buy a YubiKey first. If your work computer requires a FIDO key for SSO, immurok does not replace it.

What immurok does better

The dozens of local password prompts a day that a YubiKey does not touch. A YubiKey can be wired into sudo on Linux with pam_u2f, and it can hold SSH keys, but that is a touch on a USB device, per machine, with setup. immurok does it with a fingerprint, over Bluetooth, on macOS, Windows and Linux, and it also unlocks the screen, fills your password manager, and makes an AI agent wait for your finger before it runs git push.

Using both

The clean split: the YubiKey lives on your keyring for websites and SSO; immurok lives on the desk for the machine. GitHub sign-in is the YubiKey; the git push that follows is signed by immurok. Your password manager's account login is the YubiKey as second factor; the unlock prompt it shows ten times a day is immurok. Neither knows the other exists, and they do not need to.

Common questions