Written 9 Sep 2026. This is a how-to, not a product card.

A YubiKey can wait

A laptop file key is enough. Don't buy a hardware key to turn off leftover-box passwords.

The first key is a file on the laptop: log in with a key, not the password every time. One laptop key is enough: one laptop key is enough. Turning off password login is later, when that key is boring: turn off password login once the key works. A YubiKey does not make ads skip.

Plan and ByteRush are already passkeys

Lab plan and ByteRush already use a passkey on the phone or laptop. That is not leftover-box SSH. Those two apps share one Labthrift login: one Labthrift passkey.

What next

Couch login: SSH from the couch. Tick Lab plan after the file key works. Keep SSH inside: house network only.

Optional: file key vs a later YubiKey as a sandbox in ByteRush — same Labthrift passkey as Plan. Skip if you just want to keep reading.

Skip

Skip a YubiKey, Titan, and “hardware SSH” this weekend.
Skip turning off password login while the file key is still flaky.
Skip buying a second laptop so you can buy a YubiKey.

Sources

File key: log in with a key. Later harden: turn off password login. Lessons: ByteRush.

Also on this topic

Log in with a key, not the password every timeA file on the laptop. Keep the password as a backup at first. One laptop key is enoughDon't buy a second computer for authorized_keys. Turn off password login once the key worksLater, when the key is boring.