YKNEOMGR(1)

✨ YKNEOMGR(1) — the YubiKey NEO management tool ✨

okay bestie, welcome to your new fave little command 💖 it lives in User Commands land, and its whole personality is talking to your YubiKey NEO. that's the manual page name right there: YKNEOMGR(1). she's giving tiny-but-powerful, no cap 🦋

---

🌸 NAME 🌸

ykneomgr — YubiKey NEO management tool

---

🎀 SYNOPSIS 🎀

ykneomgr [OPTIONS]...

---

💅 DESCRIPTION 💅

version check bestie: this is ykneomgr 0.1.8.

YubiKey NEO management tool. literally what it says on the tin 🫶

here's the whole menu of flags, every single one, i'm not skipping anybody:

• -h, --help — print help and then exit, like "hey here's how to use me" 🙋‍♀️
• -V, --version — print the version and exit (default=off)
• -m, --get-mode — output the mode of the YubiKey NEO (default=off)
• -w, --get-version — output the firmware version for the YubiKey NEO (default=off)
• -s, --get-serialno — output the serial number (default=off)
• -l, --list-readers — list all connected PCSC devices (default=off)
• -a, --applet-list — list applets on the device (default=off)
• -D, --applet-delete=STRING — delete the given applet AID from the device 😳
• -i, --applet-install=FILE — install applets on the device from a CAP file
• -M, --set-mode=STRING — set the USB operation mode of the YubiKey NEO. the possible MODE arguments are: 0 for HID device only, 1 for CCID device only, 81 for CCID device with touch eject, 2 for HID/CCID composite device, 3 for U2F device only, 4 for OTP/U2F composite device, 5 for U2F/CCID composite device, 6 for OTP/U2F/CCID composite device. yes that's a lot of modes, she's multifaceted 💁‍♀️
• -S, --send-apdu=STRING — send an arbitrary APDU to the device (raw mode activated ✨)
• -r, --reader=STRING — use only a matching card reader
• -d, --debug — print debug information to standard error (default=off)

---

🧚 TROBLESHOOTING 🧚

(yes, spelled exactly like that, we respect the original spelling in this house 🫶)

so if you pass the --debug parameter you get debug messages printed, and that's genuinely useful for debugging or for a deeper analysis. main character detective energy 🔍

now: the error "No device found" can happen for a whole bunch of reasons. the simplest one, obviously, is that the device really is not connected to the machine (USB or NFC). like, no device, no device found, shocking i know 💀

another reason may be that it's in a mode where "ykneomgr" cannot talk to it. this can happen if the device is in OTP-only mode (mode 0), where you must use the "ykpersonalize" tool to mode switch it out of the OTP-only mode. it can also happen if the device is in a MODE_FLAG_EJECT mode (i.e., 81 or 82). if that's the case, you must touch the button in order to "insert" the virtual smartcard before you can invoke "ykneomgr". so like, poke it. she's waiting 👆✨

---

🌈 EXAMPLES 🌈

this is the fun part, bestie, we're doing hands-on learning 🎀

to display the firmware version of a connected YubiKey NEO you use the --get-version or -w parameter. typical output would be the string "3.0.4".

ykneomgr --get-version

to display the serial number you would use the --get-serialno or -s parameter.

ykneomgr --get-serialno

to display the device mode you use the --get-mode or -m parameter.

ykneomgr --get-mode

the possible modes are 0 for HID device only, 1 for CCID device only, 2 for HID/CCID composite device. for the CCID modes (i.e., 1 and 2), you can add 80 to enable MODE_FLAG_EJECT, which means that touching the YubiKey button will trigger eject/insert of the smartcard. that is, 81 means CCID device only with touch eject/insert, and 82 means HID/CCID composite device with touch eject/insert. math but make it hardware 🧮

to mode switch the NEO into OTP-only mode, you use the --set-mode or -M parameter with mode 0. note that you have to eject the YubiKey NEO and re-insert it before it changes mode.

ykneomgr --set-mode 0

to mode switch the NEO into CCID-only mode, you use the --set-mode or -M parameter with mode 1. note that you have to eject the YubiKey NEO and re-insert it before it changes mode.

ykneomgr --set-mode 1

to mode switch the NEO into hybrid OTP/CCID composite mode, you use the --set-mode or -M parameter with mode 2. note that you have to eject the YubiKey NEO and re-insert it before it changes mode.

ykneomgr --set-mode 2

to mode switch the NEO into CCID-only mode, with the touch button acting as eject/insert of the card, you use the --set-mode or -M parameter with mode 81. note that you have to eject the YubiKey NEO and re-insert it before it changes mode.

ykneomgr --set-mode 81

to mode switch the NEO into hybrid OTP/CCID composite mode, with the touch button acting as eject/insert of the card, you use the --set-mode or -M parameter with mode 82. note that you have to eject the YubiKey NEO and re-insert it before it changes mode.

ykneomgr --set-mode 82

to list the connected readers you use the --list-readers or -l parameter.

ykneomgr --list-readers

to list the available applets on the device you use the --applet-list or -a parameter. the output is a list of AIDs identifying applets. for example, d27600012401 means the OpenPGP applet. iykyk 🫶

ykneomgr --applet-list

to delete an applet you use the --applet-delete or -D parameter, giving it the applet AID as a parameter. note that deleting an applet may take a second or two to complete.

⚠️ Warning! Deleting an applet will destroy all storage associated with that applet, including any private keys or other credentials. like, GONE gone. irreversible. do not do this casually bestie 😭

ykneomgr --applet-delete d27600012401

to install a CAP file as an applet you use the --applet-install or -i parameter, giving it the filename of the CAP file applet as a parameter. note that loading can take several seconds, for typical CAP file sizes it takes around 5 seconds. she's buffering, be patient 🌸

ykneomgr --applet-install path/to/applet.cap

to work with multiple card readers use the --reader or -r parameter, giving it a substring of the card reader name to use. consider a system which has three card readers, one YubiKey NEO in CCID mode, one YubiKey NEO in OTP+CCID mode, and one Gemalto GemPC Express reader. running ykneomgr -l results in the following output:

0: Gemalto GemPC Express 00 00
1: Yubico Yubikey NEO CCID 01 00
2: Yubico Yubikey NEO OTP+CCID 02 00

to use the second NEO, you could use -r OTP+CCID as follows:

ykneomgr --reader OTP+CCID --applet-list

to use the first NEO, you could match on the trailing digits which is the device number. for example:

ykneomgr --reader 01 --applet-list

---

💜 REPORTING BUGS 💜

found a bug? report it at <yubico-devel@googlegroups.com>. don't be shy, the devs wanna hear it 🙈

---

and that's the whole page bestie, you ate that 🍓

cute sign-off time: this was ykneomgr 0.1.8, dated July 2025, and yeah the source is right there in the footer as ykneomgr 0.1.8 / July 2025. periodt. 💅👑