Nitrokey vs Token2

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round drawn
   Nitrokey—none0/10

   Probes explicitly confirm no llms.txt or agent-oriented docs endpoint exists (404s), and no evidence of AI-native documentation is present anywhere in the pack.

   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.nitrokey.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://docs.nitrokey.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Token2—none0/10

   Direct probes show no llms.txt (404) and no markdown-accessible docs (404), and no OpenAPI/agent-oriented documentation exists; Token2 is a hardware security key vendor with no evidence of agent-discoverable docs.

   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://www.token2.com/site/page/tools-for-fido-security-keys.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round drawn
   Nitrokey~partialprobed4/10

   Nitrokey ships an official CLI (nitropy) that installs headlessly via pip/uvx and can be scripted, which is the closest evidence to CI-style automation (nitrokey-docs-14, nitrokey-probe-4, nitrokey-probe-rt-1). However, there is no documentation of CI pipelines, headless authentication flows, or automation guides, and the core use cases (FIDO2/OTP/PGP) inherently require physical touch presence, limiting true headless operation. Missing for 10: explicit CI/automation documentation, examples of nitropy used in pipelines, and clarification on how touch-required operations are handled headlessly.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   Token2~partialprobed4/10

   Token2 ships a PowerShell bulk-enrollment script (fido2_bulkenroll_entraid) that could in principle be scripted/automated, and fido2-manage exposes some command-line-style operations (PIN, SSH key management) beyond its Python/tkinter GUI, suggesting some automation potential. However, the flagship tool is explicitly GUI-based and requires physical FIDO2 hardware interaction over USB/NFC, and there is no documented headless mode, CI integration, or automation-focused CLI/API (no OpenAPI, no llms.txt, no CI examples). Missing for 10: dedicated headless/CI-mode documentation, evidence of non-interactive scripted runs without physical key presence, and any CI/pipeline integration guide.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [probe] “official CLI documented at https://github.com/token2/fido2-manage”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”

   proof ↗⚑ flag

3. ai-native userUse an official CLI

   weight 2 · round to Nitrokey
   Nitrokey✓fullprobed8/10

   Nitrokey ships an official, actively maintained CLI (nitropy) documented at docs.nitrokey.com and verified at runtime to install cleanly via PyPI/uvx and report its version, confirming it works as claimed for scripting/automation-style interaction with the device. Missing for 10: no evidence of AI-agent-specific integration, tool-calling support, or third-party corroboration of the CLI's use in agentic workflows.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   Token2~partialprobed5/10

   Token2 publishes official open-source tools (fido2-manage, fido2_bulkenroll_entraid) that expose scriptable command operations (list/delete/generate/upload for keys, PIN, biometrics, SSH) usable from the command line, and the PowerShell bulk-enroll tool is inherently a CLI-style utility, but neither is explicitly branded or documented as an 'official CLI' for AI-native/agentic workflows — the flagship fido2-manage tool is described primarily as a GUI (Python/tkinter) application with underlying scriptable functions rather than a dedicated documented CLI interface. Missing for 10: explicit CLI documentation/binary/flags, examples of scripting/automation for AI agents, and independent confirmation the tool is used headlessly.

   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”
   • [probe] “official CLI documented at https://github.com/token2/fido2-manage”

   proof ↗⚑ flag

4. ai-native userDrive the product through a documented public API

   weight 3 · round to Nitrokey
   Nitrokey~partialprobed5/10

   Nitrokey ships a documented CLI/SDK (nitropy, pynitrokey) that lets scripts/agents drive the hardware token programmatically, confirmed by runtime probes showing it installs and runs from PyPI. However, there is no REST/OpenAPI-style public API — explicit probes for llms.txt, docs-md, and openapi.json all 404 — so an AI agent has no network-callable documented API, only a local CLI/SDK. Missing for 10: a documented HTTP/OpenAPI public API, machine-readable API spec, and any AI-agent-specific integration guidance.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.nitrokey.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://docs.nitrokey.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Token2—none0/10

   Token2 is a hardware security key vendor; probes explicitly show no public API, no OpenAPI/Swagger spec, and no llms.txt (404s across all checked endpoints). Its tools (fido2-manage CLI, GUI, browser demos) are device-management utilities over USB/NFC/WebAuthn, not a documented public API for programmatic/agentic control.

   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://www.token2.com/site/page/tools-for-fido-security-keys.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”

   proof ↗⚑ flag

5. ai-native userBuild against official SDKs

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed6/10

   Nitrokey publishes an official CLI (nitropy) and a Python SDK (pynitrokey) on PyPI, both confirmed working via runtime probes, and firmware/source are open on GitHub — giving developers a real path to build against official tooling. However there's no evidence of broader multi-language SDKs, API references beyond nitropy, or any AI/agent-specific integration surface (no OpenAPI, no llms.txt, probes for both 404). Missing for 10: multi-language/official SDKs beyond Python, formal API docs/OpenAPI spec, AI-agent-specific integration examples.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [github] “The Nitrokey 3 firmware is written in Rust. It uses the Trussed firmware framework and is developed in collaboration with SoloKeys”
   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.nitrokey.com/llms.txt”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Token2—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round drawn
   Nitrokey—none0/10

   Probes explicitly show no OpenAPI/interactive API reference exists (404s for openapi.json, swagger.json, etc.), and no docs mention runnable examples or an interactive API explorer despite Nitrokey having a CLI (nitropy) and Python SDK.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.nitrokey.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://docs.nitrokey.com/.md”
   • [claimed-docs] “nitropy - Nitrokey Documentation”

   proof ↗⚑ flag

   Token2—none0/10

   Token2 is a hardware security key vendor with no evidence of an API reference at all — the probes explicitly show no OpenAPI/swagger spec exists (404s across all candidate paths) and no llms.txt or docs.md exposure. There's no indication of an interactive, runnable API explorer anywhere in the evidence.

   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://www.token2.com/site/page/tools-for-fido-security-keys.md”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   Nitrokey—none0/10

   Nitrokey is a hardware security key vendor; the probe explicitly checked for a machine-readable API spec (openapi.json, swagger.json, etc.) and all candidates returned 404, with no OpenAPI/Swagger spec documented anywhere in the evidence pack.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Token2—none0/10

   Token2 is a hardware security key vendor with desktop/browser tools and a CLI, but there is no evidence of a machine-readable API spec; explicit probes for OpenAPI/Swagger endpoints and llms.txt all returned 404.

   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://www.token2.com/site/page/tools-for-fido-security-keys.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”

   proof ↗⚑ flag

3. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   Nitrokey—none0/10

   Nitrokey ships a versioned CLI (nitropy) and Python SDK, but there is no evidence of a documented API deprecation policy, versioned public API, or OpenAPI spec — probes explicitly show 404s for OpenAPI/llms.txt discovery. The axis applies since Nitrokey does provide developer tooling, but no deprecation-policy documentation exists in the evidence.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.nitrokey.com/llms.txt”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [claimed-docs] “nitropy - Nitrokey Documentation”

   proof ↗⚑ flag

   Token2—none0/10

   Token2 is a hardware security key vendor with desktop/CLI tools for FIDO2/PIV management; there is no evidence of any versioned public API, and probes confirm no OpenAPI/Swagger spec exists (404s across all candidate paths). No documentation of API versioning or deprecation policy is present anywhere in the evidence.

   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://www.token2.com/site/page/tools-for-fido-security-keys.md”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round to Token2
   Nitrokey—none0/10

   Nitrokey ships a CLI (nitropy) and Python SDK that could in principle be scripted, but no evidence in the pack shows any documented bulk-operation workflow (e.g., batch provisioning, mass key management, scripted multi-device automation) for AI-native or automated bulk use. Only single-device/product feature lists and an 'Entra ID provisioning' mention appear, with no concrete bulk-operation documentation or example. missing for 10: documented bulk/batch API or CLI commands, evidence of managing many items/devices at once, automation examples for large-scale provisioning.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [claimed-docs] “Nitrokey Provisioning for Entra ID”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   Token2~partialprobed6/10

   Token2 provides fido2_bulkenroll_entraid, a dedicated PowerShell tool for bulk-provisioning FIDO2 keys into Entra ID, and fido2-manage is a scriptable CLI (list/delete/edit passkeys, PIN and bio-template management, SSH key handling) that can be run in loops/scripts to act across many devices. This is real automation-depth for security-key/credential management but is narrow in scope (security keys/passkeys, one specific IdP integration) rather than a general bulk-operations API. Missing for 10: a general-purpose bulk API/SDK, documented batch endpoints beyond the Entra-specific script, and independent evidence of large-scale bulk use in production.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Openpgp

1. developerKeep OpenPGP keys on the device and use them for git commit signing and encrypted email

   weight 2 · round to Nitrokey
   Nitrokey✓fullclaimed8/10

   Nitrokey devices support the OpenPGP smart card standard with on-device key generation, touch confirmation, and documented integration with Thunderbird for encrypted email; the OpenPGP card standard is also the basis for git commit signing via GPG, which is a well-known standard use case for OpenPGP smart cards. Docs explicitly cover keygen-on-device, touch confirmation, and Thunderbird email use. Missing for 10: explicit first-party documentation naming 'git commit signing' as a use case, and independent hands-on corroboration of the OpenPGP-card signing workflow.

   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “Keygen on device”
   • [claimed-docs] “Thunderbird”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”

   proof ↗⚑ flag

   Token2—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Otp

1. power userThe key covers legacy one-time-password schemes — TOTP/HOTP slots or challenge-response — for services that still lack WebAuthn

   weight 2 · round to Nitrokey
   Nitrokey~partialclaimed6/10

   Docs explicitly list 'Two Factor Authentication' and OTP support (login using OTP for Google/Facebook), and the Nitrokey 3 product page mentions 'one-time passwords' among combined features, indicating TOTP/HOTP slot support. However, no explicit mention of HOTP challenge-response mode, no detail on number of slots, no independent hands-on verification of OTP functionality, and community evidence focuses on other features (HSM, durability) without confirming OTP reliability. Missing for 10: explicit challenge-response documentation, slot-count/configuration details, independent hands-on confirmation of OTP/HOTP working as advertised.

   • [claimed-docs] “Login to websites (e.g. Google, Facebook) using secure One Time Passwords (OTP), U2F or ordinary static passwords.”
   • [claimed-docs] “Two Factor Authentication”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”

   proof ↗⚑ flag

   Token2—none0/10

   The evidence only shows a browser-based TOTP toolset (docs-4, docs-6) and Entra ID seed export, unrelated to the FIDO2 security key itself carrying TOTP/HOTP slots or challenge-response capability; no documentation shows the hardware key supports legacy OTP protocols. Missing for 10: any spec sheet or docs stating the key itself implements TOTP/HOTP slots, challenge-response mode, or dual-protocol firmware.

   • [claimed-docs] “Generate and verify TOTP codes entirely in your browser. Algorithm: SHA-1. All computation happens locally — no seed is ever sent to a serve…”
   • [claimed-docs] “Export the current seed as an Entra ID hardware-token import file (CSV or JSON).”

   proof ↗⚑ flag

Piv

1. it adminThe key acts as a PIV smart card for certificate-based login — workstation sign-in, VPN, and code signing with keys that never leave the device

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity6/10

   Nitrokey documents PIV support explicitly (nitrokey-docs-11) plus Windows Login/AD, S/MIME, PAM (Linux), OpenVPN and on-device keygen with touch confirmation (nitrokey-docs-5,6,7,8,15), covering workstation login, VPN and code-signing-adjacent use cases with non-exportable keys. However, code-signing evidence is limited to CLI/attestation tooling rather than a dedicated PIV code-signing workflow, and community reports flag missing feature parity and cryptographic limitations (Ed25519 unsupported, non-standard attestation cert formats) versus competitors, plus slow/incomplete rollout of promised features. Missing for 10: dedicated PIV-specific code-signing documentation/integration guide, independent hands-on verification of PIV smart-card login working end-to-end, and confirmation that PIV certs are exportable/usable in enterprise CA workflows.

   • [claimed-docs] “PIV (Personal Identity Verification)”
   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [claimed-docs] “Keygen on device”
   • [claimed-docs] “PAM (Linux)”
   • [claimed-docs] “OpenVPN”
   • [community] “I'm currently using both Nitrokeys and YubiHSMs on a client project. Nitrokeys can't do Ed25519, stuck with NSA Suite B for ECC. Attestation…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   Token2~partialclaimed5/10

   Token2 documents PIV support via a Windows miniDriver and macOS Companion App enabling smartcard-based certificate enrollment and login with on-prem AD, which covers workstation sign-in use cases. However, there is no evidence for VPN integration or code signing use cases specifically, nor independent/hands-on verification of PIV certificate workflows beyond vendor docs. missing for 10: VPN certificate-auth evidence, code-signing use case evidence, independent/hands-on validation of PIV smartcard login, detail on key non-exportability guarantees for PIV certs.

   • [claimed-docs] “Using the Windows miniDriver, users can manage essential PIV functions such as PIN setup, PIN changes, and basic card configuration.”
   • [claimed-docs] “the miniDriver is needed to configure smartcard-based certificate enrollment and login with Windows on-premises Active Directory.”
   • [claimed-docs] “PIV features can be configured using our all-in-one management tool, the Companion App, which is now also available on macOS.”

   proof ↗⚑ flag

Ssh

1. developerMy SSH keys can be hardware-backed on the device — via FIDO2 sk-ssh keys, PIV, or OpenPGP — so server access requires a physical touch

   weight 2 · round drawn
   Nitrokey~partialcommunity6/10

   Docs confirm SSH login via certificates, PIV support, and OpenPGP card with touch confirmation, and a dedicated 'SSH Keys' page under the FIDO2 section suggests sk-ssh key support, aligning with the hardware-backed SSH story. However, there's no explicit walkthrough of FIDO2 sk-ssh key generation/usage, and community threads note the Nitrokey 3 has lagged in reaching feature parity with competitors, raising some doubt about full FIDO2 SSH robustness. Missing for 10: explicit sk-ssh setup documentation/examples, independent hands-on confirmation of FIDO2 SSH touch-to-authenticate working end-to-end.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Login to computers and network services (e.g. SSH) using certificates.”
   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “PIV (Personal Identity Verification)”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”

   proof ↗⚑ flag

   Token2~partialprobed6/10

   Token2's fido2-manage tool explicitly supports SSH security keys (generate, list resident, download/rehydrate, ssh-copy-id, add to local ssh-agent), directly evidencing FIDO2 sk-ssh hardware-backed key workflows. PIV is also supported via the Windows miniDriver and Companion App for smartcard-based certificate enrollment, but there is no mention of OpenPGP support for SSH auth. missing for 10: OpenPGP-based SSH key support, independent/hands-on verification of the sk-ssh workflow, and cross-platform PIV parity beyond Windows/macOS.

   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “Using the Windows miniDriver, users can manage essential PIV functions such as PIN setup, PIN changes, and basic card configuration.”
   • [claimed-docs] “the miniDriver is needed to configure smartcard-based certificate enrollment and login with Windows on-premises Active Directory.”
   • [claimed-docs] “PIV features can be configured using our all-in-one management tool, the Companion App, which is now also available on macOS.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Agent audit

1. ai-native userAn agent can read a key's state programmatically — serial, firmware version, enabled applications, stored credentials — to audit security posture across a fleet

   weight 2 · round drawn
   Nitrokey~partialprobed5/10

   The official nitropy CLI (and Python SDK) can programmatically query device attributes such as version and connected devices (e.g., 'nitropy version', device listing), giving agents a scriptable way to pull serial/firmware info, and firmware update tooling is documented. However, there is no evidence of a documented way to enumerate 'enabled applications' or 'stored credentials' via CLI/API for fleet-wide security audits, and no fleet-management or structured (JSON/API) output is shown. Missing for 10: documented commands/output for enabled applications and stored credential enumeration, structured machine-readable output format, and any fleet-audit tooling or API/OpenAPI spec (probes show none exists).

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Token2~partialprobed5/10

   Token2's open-source fido2-manage CLI/GUI tool (scriptable over USB/NFC) can view device information, list resident credentials (passkeys) with user handle, manage PINs, and enumerate biometric templates — giving an agent a scriptable path to audit key state across a fleet. However, no evidence documents reading serial numbers, firmware version, or 'enabled applications' specifically, nor is there a structured/JSON API, OpenAPI spec, or llms.txt for machine-readable output (confirmed 404s), so agent-friendly programmatic access is only partially evidenced. Missing for 10: documented serial/firmware-version fields, explicit 'enabled applications' enumeration, and a structured machine-readable output/API for agent consumption.

   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Attestation

1. security engineerVerify device attestation at registration to enforce that only genuine, approved key models are enrolled

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity4/10

   Nitrokey ships FIDO2 (which includes device attestation) and PIV, but there is no documentation of an attestation verification workflow for registration, and a hands-on report notes attestation certificates can't be exported via standard PKCS#11 and require a custom vendor tool plus a non-standard ASN.1 cert format, adding real friction for engineers building attestation checks. missing for 10: first-party docs on attestation cert format/verification API, standard PKCS#11/FIDO2 attestation export support, independent confirmation of a smooth registration-time attestation check.

   • [claimed-docs] “SSH Keys”
   • [community] “I'm currently using both Nitrokeys and YubiHSMs on a client project. Nitrokeys can't do Ed25519, stuck with NSA Suite B for ECC. Attestation…”

   proof ↗⚑ flag

   Token2~partialclaimed3/10

   Token2 provides an AAGUID lookup tool to identify certified authenticators and a WebAuthn registration demo, which touch on device identification, but there is no documented mechanism for verifying attestation certificates or enforcing an allow-list of approved key models at registration. missing for 10: attestation certificate chain validation, FIDO Metadata Service integration, documented enterprise enrollment policy enforcement.

   • [claimed-docs] “Look up any certified authenticator by name or AAGUID — no key required.”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”

   proof ↗⚑ flag

Cli

1. developerConfigure and manage the key from an official CLI — enable applications, set PINs, manage slots, read device state — scriptably

   weight 3 · round to Nitrokey
   Nitrokey✓fullprobed8/10

   Nitrokey ships an official CLI, nitropy, documented at docs.nitrokey.com/software/nitropy and verified installable/runnable via PyPI, described as a tool to interact with Nitrokey devices (identity/version checks, firmware updates, etc.), plus a companion Python SDK — this covers scriptable device configuration and management. Missing for 10: explicit documentation/examples in the evidence pack of specific subcommands for PIN-setting, slot management, and app enable/disable, and independent hands-on confirmation of full feature parity across all device operations.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [claimed-docs] “Firmware Update”

   proof ↗⚑ flag

   Token2~partialprobed6/10

   fido2-manage is an official open-source Token2 tool that supports PIN set/change, resident-credential (passkey) and biometric slot management, and device info viewing, and a probe confirms it is documented as a CLI, giving genuine scriptable control over FIDO2 keys. However most docs describe it primarily as a Python/tkinter GUI rather than a dedicated CLI, and there's no explicit mention of an 'enable applications' feature or comprehensive CLI usage examples/API reference. missing for 10: explicit CLI command reference/examples, 'enable applications' capability, independent hands-on CLI scripting confirmation.

   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [probe] “official CLI documented at https://github.com/token2/fido2-manage”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Sdks

1. developerOfficial SDKs let me integrate the key into my own desktop and mobile apps

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed5/10

   Nitrokey provides nitropy CLI and a Python 'nitrokey' SDK on PyPI plus PIV/OpenPGP/PKCS#11 support that developers can integrate into tooling, but there is no evidence of official mobile SDKs (iOS/Android app libraries) or desktop app integration SDKs beyond the low-level Python/CLI tooling. missing for 10: dedicated mobile (iOS/Android) SDKs, higher-level desktop app integration libraries (e.g. for Electron/Swift/Java), first-party sample apps or API docs showing SDK usage in third-party apps.

   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [claimed-docs] “Android / NitroPhone”

   proof ↗⚑ flag

   Token2—none0/10

   Evidence shows only management/admin tools (fido2-manage GUI/CLI, bulk enrollment for Entra ID, browser-based WebAuthn demo) rather than an official SDK or library for embedding the key's authentication into a developer's own desktop/mobile applications. No mention of a downloadable SDK, API bindings, or mobile library is found anywhere in the pack.

   • [claimed-docs] “Open-source cross-platform desktop companion application for managing FIDO2 security keys.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “official CLI documented at https://github.com/token2/fido2-manage”

   proof ↗⚑ flag

Agent approval

1. ai-native userRequire a physical key touch as the human-approval step for sensitive automated or agent-initiated actions

   weight 1 · round drawn
   Nitrokey—none0/10

   Nitrokey documents generic touch-confirmation for OpenPGP/FIDO2 operations, but there is no evidence tying this to AI-agent or automated-action approval workflows, MCP, or any agentic tooling — the capability as described in the story is unevidenced.

   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Two Factor Authentication”

   proof ↗⚑ flag

   Token2—none0/10

   Token2's evidence covers FIDO2 key management, PIV, TOTP tools, and WebAuthn demos, but nothing shows integration with AI agents or automated workflows that would use a physical touch as an approval gate for agent-initiated actions. Missing for 10: any documentation of agent/automation integration, an approval-step API or SDK, or a workflow example tying physical touch to AI-agent action authorization.

   • [claimed-docs] “Open-source cross-platform desktop companion application for managing FIDO2 security keys.”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [claimed-docs] “This manufacturer-agnostic tool works with any FIDO2.1 device.”

   proof ↗⚑ flag

Compatibility

1. power userThe key works across my operating systems and browsers, with a published compatibility catalog of supported services

   weight 2 · round to Token2
   Nitrokey!disputedcontradicted4/10

   Docs scatter claims of broad compatibility (SSH, FIDO2, OTP, PIV, OpenPGP, Windows/AD, Office 365, Nextcloud, Thunderbird, OpenVPN) but there is no single published compatibility catalog/matrix of supported services or browsers. Community evidence concretely contradicts smooth cross-platform delivery: users report needing to allow unsigned driver installation on Windows, and multiple reports that Nitrokey 3 still lists many features as 'planned' and lags Yubikey in feature parity years after purchase. missing for 10: a unified compatibility matrix/catalog page, confirmation of parity across all claimed services, resolution of the Windows driver-signing friction.

   • [claimed-docs] “Login to websites (e.g. Google, Facebook) using secure One Time Passwords (OTP), U2F or ordinary static passwords.”
   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [community] “To install the driver, you may need to allow the installation of unsigned drivers first. Nope, thanks.”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   Token2~partialclaimed5/10

   Evidence shows solid cross-OS/browser support (Windows control panel, Chromium browsers, macOS/Linux companion app, PIV miniDriver) and manufacturer-agnostic FIDO2.1 tooling, but there is no published catalog listing which third-party services/relying parties are certified compatible with Token2 keys. missing for 10: a published service/RP compatibility catalog, independent cross-browser/OS corroboration beyond vendor docs.

   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “If you are using macOS or Linux, you can manage your FIDO2 keys using the tool integrated into the latest Chromium based browsers, such as G…”
   • [claimed-docs] “You can use the standard Windows control panel tool to manage your key, as long as you run Windows 10 build 1903 or later.”
   • [claimed-docs] “PIV features can be configured using our all-in-one management tool, the Companion App, which is now also available on macOS.”
   • [claimed-docs] “This manufacturer-agnostic tool works with any FIDO2.1 device.”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”

   proof ↗⚑ flag

Recovery

1. security engineerThe vendor documents a credible lockout-recovery strategy — registering a backup key, and what is and is not recoverable if a key is lost

   weight 3 · round to Token2
   Nitrokey—none0/10

   No evidence pack item documents a vendor-provided lockout-recovery strategy (e.g., registering a backup Nitrokey, or what OpenPGP/FIDO2/PIV credentials are or are not recoverable if a key is lost). The closest mention is a third-party community comment about offline key escrow for the unrelated HSM product, not official documentation of recovery/backup-key enrollment.

   • [community] “Used the original Nitrokey HSM model on a code-signing server project. The applet running inside is not free/open source but dev tools and d…”

   proof ↗⚑ flag

   Token2~partialclaimed3/10

   Token2's FAQ includes a 'How Do I Set Up a Backup Key?' entry, indicating some guidance exists, but the evidence pack contains no actual content on what is/isn't recoverable if a key is lost (e.g., resident credentials, PINs, biometrics, or TOTP seeds). Missing for 10: detailed recovery/lockout policy content, explicit statement of non-recoverable data (e.g., resident key private keys), and any independent corroboration of the backup-key workflow.

   • [claimed-docs] “How Do I Set Up a Backup Key?”

   proof ↗⚑ flag

Setup

1. power userFirst-time setup is guided — clear instructions or a setup app walk me through registering the key with my accounts

   weight 2 · round to Token2
   Nitrokey~partialprobed5/10

   Nitrokey provides scattered feature-specific docs (SSH, PIV, OpenPGP, FIDO2, general instructions) and a CLI tool (nitropy) for device management, which can guide account registration for specific services, but there's no single unified setup wizard/app walking a user end-to-end through registering with major accounts. Community feedback also flags real setup friction (e.g., needing to allow unsigned driver installation) that undercuts a smooth guided experience. Missing for 10: a dedicated onboarding app/wizard, first-party account-registration walkthroughs (e.g., for Google/Microsoft/GitHub), and independent hands-on confirmation that setup is smooth.

   • [claimed-docs] “Two Factor Authentication”
   • [claimed-docs] “General Instructions”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [community] “To install the driver, you may need to allow the installation of unsigned drivers first. Nope, thanks.”

   proof ↗⚑ flag

   Token2~partialclaimed6/10

   Token2 provides multiple avenues for onboarding: a browser-based FIDO2/passkey demo to test registration (token2-docs-5, token2-docs-16), OS-native guidance for macOS/Linux/Chrome and Windows control panel (token2-docs-13/14/15), a companion GUI app for device/passkey management (token2-docs-1/7/8), and an FAQ entry on setting up a backup key (token2-docs-17). This gives a reasonably guided path but is scattered across docs/tools rather than a single cohesive first-time setup wizard that walks a user through registering with specific real-world accounts (e.g., Google, Microsoft, GitHub). Missing for 10: a unified step-by-step onboarding flow/app tailored to major account providers, and independent user reports confirming ease of first-time setup.

   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [claimed-docs] “Explore FIDO2 and passkey authentication hands-on. Register a security key or passkey, then log in with it — all in your browser using the W…”
   • [claimed-docs] “No special tool installation is needed to start using the FIDO keys, as most modern browsers will prompt to set a PIN when required”
   • [claimed-docs] “If you are using macOS or Linux, you can manage your FIDO2 keys using the tool integrated into the latest Chromium based browsers, such as G…”
   • [claimed-docs] “You can use the standard Windows control panel tool to manage your key, as long as you run Windows 10 build 1903 or later.”
   • [claimed-docs] “How Do I Set Up a Backup Key?”
   • [claimed-docs] “Open-source cross-platform desktop companion application for managing FIDO2 security keys.”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”

   proof ↗⚑ flag

Source

1. security engineerThe firmware is open source or independently audited, so I don't have to take the vendor's word for what runs on the device

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed7/10

   Nitrokey 3 firmware is confirmed open source (Rust, dual Apache2.0/MIT licensed, tagged releases on GitHub) which lets engineers inspect what runs on the device, but the HSM applet is explicitly noted as not open source, and there is no evidence of an independent third-party security audit of the firmware. missing for 10: independent audit report, confirmation that all product lines (not just Nitrokey 3) are open source, no audit mention for the closed HSM applet.

   • [github] “This software is fully open source.”
   • [github] “The Nitrokey 3 firmware is written in Rust. It uses the Trussed firmware framework and is developed in collaboration with SoloKeys”
   • [github] “All software, unless otherwise noted, is dual licensed under Apache 2.0 and MIT license.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey 3 firmware is open source in Rust WITH tagged, installable releases — https://github.com/Nitro…”
   • [community] “Used the original Nitrokey HSM model on a code-signing server project. The applet running inside is not free/open source but dev tools and d…”

   proof ↗⚑ flag

   Token2—none0/10

   All evidence concerns open-source host-side management tools (fido2-manage GUI, companion app, bulk-enrollment scripts) that run on a computer to manage the keys — none of it addresses whether the actual device firmware running on the Token2 hardware key itself is open source or has undergone independent security audit.

   ⚑ flag

Updates

1. security engineerThe vendor has a clear firmware update and vulnerability-response story — advisories, affected-model lookup, and how fixes reach devices

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed4/10

   Nitrokey documents a firmware-update mechanism (dedicated firmware-update guide, nitropy CLI, tagged GitHub releases like v1.8.3) and open-source firmware for transparency, but there is no evidence of a formal security-advisory feed, CVE list, or affected-model lookup tool comparable to a vendor security bulletin process; a community post references a real key-extraction issue discussed ad hoc rather than via a documented advisory pipeline. Missing for 10: dedicated security advisories page, CVE/vulnerability database, affected-model/version lookup tool, and clear SLA for how fixes reach devices beyond generic update docs.

   • [claimed-docs] “Firmware Update”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey 3 firmware is open source in Rust WITH tagged, installable releases — https://github.com/Nitro…”
   • [community] “Author here: extracting Nitrokey HSM RSA private keys is not a vulnerability per se - it requires the attacker to already have the keys to t…”
   • [github] “This software is fully open source.”

   proof ↗⚑ flag

   Token2—none0/10

   Evidence covers key management tools (PIN, passkeys, PIV, SSH) but contains no security advisories, CVE/vulnerability disclosure process, affected-model lookup tool, or firmware update delivery mechanism for Token2 devices.

   ⚑ flag

Agent provisioning

1. ai-native userAn agent can drive key provisioning end to end — ordering, assignment, pre-registration — through documented enterprise APIs instead of a human-only console

   weight 2 · round to Token2
   Nitrokey—none0/10

   Nitrokey documents an nitropy CLI for on-device configuration and an Entra ID provisioning integration, but there is no evidence of a documented enterprise API supporting agent-driven ordering, assignment, or pre-registration workflows — OpenAPI/API probes all returned 404. missing for 10: documented REST/enterprise API for ordering and fleet assignment, evidence of programmatic pre-registration, any API reference beyond CLI tooling.

   • [claimed-docs] “Nitrokey Provisioning for Entra ID”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   Token2~partialprobed3/10

   Token2 ships an open-source CLI (fido2-manage) for local device configuration and a PowerShell bulk-enrollment script that automates pre-registering keys into Microsoft Entra ID via Microsoft's Graph API — some scriptable, agent-drivable provisioning exists. However, there is no evidence of Token2's own documented enterprise API for ordering or assigning keys to users, and probes confirm no OpenAPI/swagger spec exists on their site. missing for 10: a Token2-owned ordering API, an assignment/fleet-management API, and any documented enterprise API surface beyond third-party (Microsoft) integration scripts.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Delivery

1. it adminAn enterprise delivery service ships keys directly to distributed employees, driven by an API or console rather than manual logistics

   weight 2 · round drawn
   Nitrokey—none0/10

   Evidence covers device features (FIDO2, OpenPGP, PIV), firmware/CLI tooling, and community feedback on hardware/support quality, but nothing addresses enterprise bulk-shipping/fleet logistics, an API/console for distributing keys directly to distributed employees, or any provisioning-and-delivery service comparable to fleet-management logistics.

   ⚑ flag

   Token2—none0/10

   Evidence covers device management, bulk enrollment, and provisioning tools but nothing about a logistics/delivery service (e.g., automated shipping of physical keys to distributed employees) driven by API or console. No fulfillment, shipping, or distribution capability is documented anywhere in the evidence pack.

   ⚑ flag

Idp

1. it adminThe key integrates with my identity provider — Okta, Entra ID, Google Workspace — and I can enforce policies requiring hardware-key authentication

   weight 2 · round drawn
   Nitrokey~partialclaimed4/10

   Nitrokey documents FIDO2/PIV/OpenPGP protocol support and a specific 'Nitrokey Provisioning for Entra ID' tool, showing some IdP integration, but there is no evidence of Okta or Google Workspace integration, nor any admin console/policy engine to enforce hardware-key-only authentication fleet-wide. Missing for 10: Okta integration, Google Workspace integration, centralized policy enforcement/fleet management console, documentation of admin-side enrollment/compliance workflows.

   • [claimed-docs] “Nitrokey Provisioning for Entra ID”
   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [claimed-docs] “PIV (Personal Identity Verification)”

   proof ↗⚑ flag

   Token2~partialprobed4/10

   Token2 documents a dedicated Entra ID bulk-enrollment tool leveraging the Graph API, showing concrete IdP integration for one provider, and its keys are standard FIDO2 devices that any IdP could require via WebAuthn policy. However, there is no evidence of Okta or Google Workspace-specific integration tooling, nor documentation of admin-side policy enforcement (e.g., conditional access rules mandating hardware-key auth) — these are typically the IdP's own settings, not something Token2 documents supporting or configuring. Missing for 10: Okta integration evidence, Google Workspace integration evidence, and any documentation of fleet-wide policy enforcement/reporting.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”
   • [claimed-docs] “the miniDriver is needed to configure smartcard-based certificate enrollment and login with Windows on-premises Active Directory.”

   proof ↗⚑ flag

Provisioning

1. it adminProvision keys across an organization at scale — pre-registration, bulk configuration, and lifecycle tracking of issued keys

   weight 3 · round to Token2
   Nitrokey~partialprobed3/10

   Nitrokey ships an official CLI (nitropy) and Python SDK for scripting device operations, and docs reference 'Nitrokey Provisioning for Entra ID,' suggesting some enterprise provisioning path exists, but there is no evidence of bulk pre-registration workflows, centralized fleet dashboards, or lifecycle/audit tracking across many issued keys. missing for 10: bulk enrollment/pre-registration tooling, centralized admin console for fleet inventory, lifecycle/revocation tracking at scale, independent case studies of large deployments.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [claimed-docs] “Nitrokey Provisioning for Entra ID”

   proof ↗⚑ flag

   Token2~partialprobed5/10

   Token2 offers a PowerShell-based bulk enrollment tool for Entra ID (fido2_bulkenroll_entraid) and an open-source fido2-manage CLI/GUI for per-key PIN, biometric, and passkey configuration, which supports pre-registration and bulk configuration workflows. However, there is no evidence of an organization-wide inventory, dashboard, or lifecycle-tracking system for issued keys beyond individual device management and Entra-specific scripting. Missing for 10: centralized fleet inventory/dashboard, cross-platform (non-Entra ID) bulk provisioning, and lifecycle status tracking (issued/revoked/expired) across an organization.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”

   proof ↗⚑ flag

Certifications

1. it adminCertified models exist for regulated environments — FIPS 140 validated or Common Criteria certified — with documented durability (water/crush resistance)

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity3/10

   Nitrokey documents a Common Criteria EAL 6+ certified secure element in the Nitrokey 3 (nitrokey-docs-16), satisfying the certification half of the story, but there is no mention anywhere in the evidence of FIPS 140 validation, nor any documented water/crush-resistance or ruggedization specs. Community hands-on feedback actively undercuts the durability angle, describing the U2F key as feeling 'flimsy' compared to competitors (nitrokey-comm-3, nitrokey-comm-4). Missing for 10: FIPS 140 validation evidence, explicit IP/MIL-STD or water/crush durability specs, and independent corroboration of ruggedness rather than community complaints about build quality.

   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [community] “I wish they would make something that felt more durable. I bought the U2F key and the combination of plastic and not being sure where to pre…”
   • [community] “Unlike some competitors, Nitrokey contains a complete and standard compliant USB plug... Here I am waiting for a Type-C from them. Yet they …”

   proof ↗⚑ flag

   Token2—none0/10

   The evidence pack covers management tools and software (companion apps, FIDO2 demo, PIV miniDriver) but contains no mention of FIPS 140 validation, Common Criteria certification, or physical durability specifications (water/crush resistance) for any Token2 hardware devices. missing for 10: FIPS 140 validation certificates, Common Criteria certification listings, IP rating or crush-resistance test documentation for hardware keys.

   ⚑ flag

Connectors

1. power userThe lineup covers my ports and carry style — USB-C and USB-A models, keychain and low-profile nano form factors

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity4/10

   Evidence indirectly shows both USB-A and USB-C variants exist (the shop page references 'nk3an-nitrokey-3a-nfc' and a community comment mentions ordering a 'Nitrokey 3C NFC'), suggesting the lineup covers both port types. However, there is no evidence of keychain or nano low-profile form factors anywhere in the pack, and one community comment even complains about waiting years for a Type-C model, casting some doubt on breadth/availability. Missing for 10: explicit nano/keychain form-factor SKUs, confirmed current availability of USB-C models, first-party spec sheet comparing form factors.

   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [community] “Unlike some competitors, Nitrokey contains a complete and standard compliant USB plug... Here I am waiting for a Type-C from them. Yet they …”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”

   proof ↗⚑ flag

   Token2—none0/10

   The evidence pack focuses entirely on software tools (FIDO2 management apps, TOTP toolset, PIV drivers) and never describes Token2's physical hardware lineup, connector types (USB-C/USB-A), or form factors (keychain, nano). No mention of product SKUs, dimensions, or port types is present, so there's no basis to confirm coverage of power-user form-factor variety. Missing for 10: hardware product listings, connector-type specs, form-factor descriptions (nano/keychain), any comparison chart of models.

   ⚑ flag

Nfc

1. power userTap the key on my phone over NFC to authenticate in mobile browsers and apps

   weight 2 · round drawn
   Nitrokey~partialclaimed4/10

   Nitrokey sells an NFC-enabled model (Nitrokey 3A NFC) and documents FIDO2/U2F/OTP login flows and an Android/NitroPhone integration, implying NFC tap-to-auth is technically supported, but no evidence explicitly confirms tapping the key against a phone to authenticate in mobile browsers/apps, nor any hands-on report of this working. Missing for 10: explicit documentation or user testimony of NFC-based authentication on phones, coverage across major mobile browsers/apps, and confirmation it works as smoothly as competitors.

   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [claimed-docs] “Android / NitroPhone”
   • [claimed-docs] “Two Factor Authentication”

   proof ↗⚑ flag

   Token2~partialclaimed4/10

   Token2's own tooling confirms its FIDO2 keys support NFC as a communication transport (used by the fido2-manage companion app to manage keys over USB or NFC), which implies NFC-capable hardware, but there is no explicit documentation stating that users can tap the key on a phone to authenticate within mobile browsers or apps via WebAuthn/CTAP2 NFC. Missing for 10: explicit end-user documentation or demo of phone-NFC-based authentication in mobile browsers/apps, and any independent confirmation of this specific mobile use case.

   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [claimed-docs] “This manufacturer-agnostic tool works with any FIDO2.1 device.”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round drawn
   Nitrokey~partialprobed4/10

   Nitrokey ships an official CLI (nitropy) and Python SDK that can configure/manage devices programmatically, confirmed to install and run via PyPI, but there is no formal REST/OpenAPI interface (all API endpoint probes 404) and no explicit vendor claim of full UI/CLI feature parity for AI-native automation. Missing for 10: documented API/OpenAPI spec, explicit parity statement between GUI app and nitropy CLI, and independent verification that all UI-exposed features are scriptable via nitropy.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Token2~partialprobed4/10

   Token2 ships an open-source CLI (fido2-manage) that overlaps with much of the companion GUI's functionality — resident credential/passkey management, PIN setup, biometric template management, and SSH key operations can all be scripted — giving some AI-native/automation parity with the desktop UI. However, there is no true REST/HTTP API (probes confirm openapi.json/swagger.json all 404), and several UI-only web tools (TOTP toolset, WebAuthn browser demo, factory reset) have no documented programmatic equivalent. Missing for 10: a formal API surface (REST/OpenAPI) covering all UI functions, CLI/API parity for the web-based demo and TOTP tools, and independent confirmation that CLI coverage is fully equivalent to the GUI.

   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “Generate and verify TOTP codes entirely in your browser. Algorithm: SHA-1. All computation happens locally — no seed is ever sent to a serve…”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “official CLI documented at https://github.com/token2/fido2-manage”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Token2
   Nitrokey!disputedcontradicted3/10

   Nitrokey's firmware and licensing are open source (nitrokey-gh-1, nitrokey-gh-3) and it uses open standards like FIDO2/OpenPGP/PIV, which in principle avoid lock-in, but a hands-on user report describes the opposite of clean data portability: Nitrokey attestation certs 'can't be exported via PKCS#11' and require a 'custom vendor shell' with a non-standard ASN.1 cert container (nitrokey-comm-2) — directly contradicting an open, portable data-export claim. Missing for 10: any first-party documentation of a bulk/data export feature or standard export format for stored secrets, and no counter-evidence resolving the community-reported non-standard export path.

   • [github] “This software is fully open source.”
   • [github] “All software, unless otherwise noted, is dual licensed under Apache 2.0 and MIT license.”
   • [community] “I'm currently using both Nitrokeys and YubiHSMs on a client project. Nitrokeys can't do Ed25519, stuck with NSA Suite B for ECC. Attestation…”

   proof ↗⚑ flag

   Token2~partialprobed5/10

   Token2 supports exporting TOTP seeds as open CSV/JSON files for Entra ID import, and its open-source fido2-manage tool lets users list, download, and rehydrate resident credentials and SSH keys from FIDO2 devices, plus it's explicitly manufacturer-agnostic (works with any FIDO2.1 key), supporting migration away from Token2 hardware without lock-in. However, this covers only specific data types (TOTP seeds, credentials, SSH keys) rather than a full account/data export, and there's no unified 'export everything' feature or documentation. Missing for 10: comprehensive account-wide data export, first-party documentation framing this as a full data portability/exit feature, independent verification of export completeness.

   • [claimed-docs] “Export the current seed as an Entra ID hardware-token import file (CSV or JSON).”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “This manufacturer-agnostic tool works with any FIDO2.1 device.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to Nitrokey
   Nitrokey✓fullprobed8/10

   Nitrokey 3 firmware source is hosted on GitHub, explicitly stated to be fully open source, dual-licensed under Apache 2.0/MIT, with tagged releases confirming active open development. This directly satisfies reading source under an open license for the core firmware. Missing for 10: confirmation that all components (e.g., HSM applet, some proprietary parts noted in community evidence) are open, and no independent audit of license completeness beyond firmware repo.

   • [github] “This software is fully open source.”
   • [github] “The Nitrokey 3 firmware is written in Rust. It uses the Trussed firmware framework and is developed in collaboration with SoloKeys”
   • [github] “All software, unless otherwise noted, is dual licensed under Apache 2.0 and MIT license.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey 3 firmware is open source in Rust WITH tagged, installable releases — https://github.com/Nitro…”

   proof ↗⚑ flag

   Token2~partialprobed6/10

   Token2 open-sources some companion tooling on GitHub (fido2-manage, fido2_bulkenroll_entraid) with real activity (112 stars, recent pushes), letting an AI-native user inspect that code, but the core hardware product/firmware and several web tools (TOTP toolset, FIDO2 demo) are not shown to have public source, and no explicit license file/type is cited. Missing for 10: confirmed OSI license text, source availability for the full product line (not just auxiliary management tools).

   • [claimed-docs] “Open-source cross-platform desktop companion application for managing FIDO2 security keys.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round drawn
   Nitrokey—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Token2—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

1. ai-native userControl data retention and deletion

   weight 2 · round to Token2
   Nitrokey—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Token2~partialclaimed5/10

   Token2's tools give users direct control to delete data stored on their own security keys — resident credentials/passkeys can be listed, edited, and deleted, biometric templates can be deleted, and factory resets are supported (token2-gh-1, token2-gh-3, token2-docs-7). This covers device-level data deletion but there is no documentation of server-side retention policies, account-level data deletion, or how long any cloud-side telemetry/data is retained. Missing for 10: server-side/account data retention policy documentation, explicit data-deletion request process for any cloud-stored data, independent confirmation of retention practices.

   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”

   proof ↗⚑ flag

2. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   Nitrokey—none0/10

   The evidence pack covers Nitrokey's hardware features (FIDO2, OpenPGP, PIV), its open-source firmware/CLI (nitropy), and community commentary on durability/support, but contains no mention of any telemetry, usage tracking, or opt-out settings for its software (nitropy CLI, firmware update service) or hardware. Since Nitrokey ships software tools that could in principle collect usage data, the axis applies, but there is no evidence either confirming or denying telemetry practices.

   ⚑ flag

   Token2—none0/10

   The evidence pack contains no mention of telemetry, analytics, or usage tracking, nor any settings to opt out of such tracking, for Token2's desktop companion app, fido2-manage tool, or web tools. missing for 10: any documentation of data collection practices, a privacy policy reference, or a telemetry opt-out mechanism.

   ⚑ flag

Credential management

1. power userList and delete the passkeys stored on my key and know its credential capacity before it fills up

   weight 2 · round to Token2
   Nitrokey—none0/10

   While Nitrokey ships FIDO2 support and an official nitropy CLI, the evidence pack contains no documentation or mention of commands/features to list resident passkeys, delete individual credentials, or view credential storage capacity/limits. This is a fair capability to expect from a FIDO2 authenticator, but no evidence confirms it.

   ⚑ flag

   Token2~partialprobed7/10

   fido2-manage (with GUI and CLI) lists resident credentials/passkeys with user handle, allows delete and edit metadata, and works over USB/NFC for any FIDO2.1 device, directly covering list/delete of passkeys stored on the key. However, there is no explicit evidence of a feature reporting remaining credential capacity or slot count before the key fills up. Missing for 10: explicit credential-capacity/slots-remaining reporting, independent hands-on confirmation of listing/deleting behavior.

   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Fido2

1. security engineerThe key stores discoverable FIDO2 credentials (resident keys / device-bound passkeys) so users can sign in to WebAuthn services without typing a username

   weight 3 · round to Token2
   Nitrokey~partialcommunity6/10

   Docs confirm FIDO2 support and explicitly market 'passwordless login' to Microsoft/Nextcloud (nitrokey-docs-4), which implies discoverable/resident-key credentials, and FIDO2 is listed as a core feature (nitrokey-docs-1, nitrokey-docs-16). However, no documentation explicitly names 'resident keys' or 'discoverable credentials,' and community reports note the Nitrokey 3 has lagged on FIDO2 feature parity with competitors (many features listed as 'planned'), raising doubt about completeness. Missing for 10: explicit resident-key/discoverable-credential documentation, independent hands-on verification of usernameless sign-in working end-to-end.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   Token2✓fullprobed8/10

   Token2 sells FIDO2 hardware keys explicitly supporting resident/discoverable credentials (passkeys), with documentation and an open-source companion tool (fido2-manage) that lists, edits, and manages resident credentials including user handles, plus a browser-based demo to register and authenticate via WebAuthn without typing a username. Independent GitHub evidence corroborates the resident-key management feature set (list with user handle, delete, edit metadata). missing for 10: no explicit third-party/independent test confirming passwordless username-less sign-in flow in production RP scenarios, and no FIDO Alliance certification citation for discoverable credential compliance.

   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

2. power userThe key works as a WebAuthn/U2F second factor across the major services I already use — Google, GitHub, Microsoft, password managers

   weight 2 · round drawn
   Nitrokey~partialcommunity6/10

   Docs confirm FIDO2/U2F support and explicitly name Google/Facebook U2F login and Microsoft passwordless login, and general 'Two Factor Authentication' docs exist, but GitHub and password-manager compatibility are never explicitly evidenced. Community reports also note the Nitrokey 3 lagging in feature parity vs. competitors and having 'planned' rather than shipped features, raising some doubt about full protocol coverage. Missing for 10: explicit GitHub WebAuthn/U2F confirmation, password-manager (e.g. Bitwarden/1Password) compatibility evidence, and independent hands-on confirmation across these specific services.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Login to websites (e.g. Google, Facebook) using secure One Time Passwords (OTP), U2F or ordinary static passwords.”
   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “Two Factor Authentication”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   Token2~partialclaimed6/10

   Token2 provides standards-based FIDO2/WebAuthn/U2F hardware keys with strong first-party tooling for Microsoft Entra ID enrollment and a general WebAuthn demo/testing tool, implying broad cross-service compatibility as a certified FIDO2.1 device. However, there is no direct documentation or independent confirmation of successful registration/use with Google, GitHub, or specific password managers. Missing for 10: explicit vendor or third-party evidence of working as a 2FA/passkey with Google, GitHub, and named password managers.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [claimed-docs] “This manufacturer-agnostic tool works with any FIDO2.1 device.”
   • [claimed-docs] “Explore FIDO2 and passkey authentication hands-on. Register a security key or passkey, then log in with it — all in your browser using the W…”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”

   proof ↗⚑ flag

User verification

1. security engineerThe key supports on-device user verification — a FIDO2 PIN or built-in biometric — so a stolen key alone cannot authenticate

   weight 2 · round to Token2
   Nitrokey—none0/10

   Evidence confirms Nitrokey devices support FIDO2 and mentions 'Touch Confirmation' (a presence check), but nowhere does it document a FIDO2 PIN or biometric on-device user-verification mechanism that would block use by a mere possessor of a stolen key. Missing for 10: explicit documentation of FIDO2 PIN setup/enforcement, biometric sensor support, or any UV (user verification) flag being satisfied — only touch/presence confirmation is evidenced, which is a different, weaker security property.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”

   proof ↗⚑ flag

   Token2✓fullprobed8/10

   Evidence confirms FIDO2 PIN setup/change and biometric template enrollment/management via the companion tool and fido2-manage (PIN management, min PIN length, biometric templates: list, rename, delete, enroll), and browsers/OS natively prompt for PIN when required, satisfying on-device user verification against theft. missing for 10: no independent/hands-on third-party testing confirming UV enforcement during actual authentication ceremonies, and no explicit CTAP2 'uv' flag/attestation documentation.

   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “No special tool installation is needed to start using the FIDO keys, as most modern browsers will prompt to set a PIN when required”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag