YUBICO-PIV-TOOL(1)

💖 NAME 💖

okay so hi bestie, this is YUBICO-PIV-TOOL(1), and it is the tool for managing Personal Identity Verification credentials on Yubikeys. that's it. that's the job. PIV creds, on your YubiKey, handled. 👑

it lives in the User Commands part of the manual, which is exactly the energy it deserves. periodt.

---

🦋 SYNOPSIS 🦋

yubico-piv-tool [OPTION]...

like… that's it. options. go off. 💅

---

🌸 DESCRIPTION 🌸

so the whole description is the options, bestie — this tool is a bunch of flags that each do a thing, and you stack them. here's the full roster, no skips, no cuts, no "we'll get to it later". we never do that here. 🫶

• -h, --help — print help and dip out. classic. ✨
• --full-help — print help but this time it includes the hidden options too, then exit. the secret menu, iykyk. 🙈
• -V, --version — print the version and exit.
• -v, --verbose[=INT] — print more info. the default is 0.
• -r, --reader=STRING — only use a matching reader. default is Yubikey.
• -k, --key[=STRING] — the management key to use. if you don't give a value, it will ask for the key. default is 010203040506070801020304050607080102030405060708.
• -a, --action=ENUM — the action to take. possible values are "version", "generate", "set-mgm-key", "reset", "pin-retries", "import-key", "import-certificate", "set-chuid", "request-certificate", "verify-pin", "verify-bio", "change-pin", "change-puk", "unblock-pin", "selfsign-certificate", "delete-certificate", "read-certificate", "read-public-key", "status", "test-signature", "test-decipher", "list-readers", "set-ccc", "write-object", "read-object", "attest", "move-key", "delete-key".

and here's the part that goes so hard: you can give multiple actions at once and they'll be executed in order. for example:

--action=verify-pin --action=request-certificate

chef's kiss. the pipeline of it all. 😌

• -s, --slot=ENUM — what key slot to operate on. possible values are "9a", "9c", "9d", "9e", "82", "83", "84", "85", "86", "87", "88", "89", "8a", "8b", "8c", "8d", "8e", "8f", "90", "91", "92", "93", "94", "95", "f9".

so like, what does each one even mean:

• 9a is for PIV Authentication
• 9c is for Digital Signature (PIN always checked)
• 9d is for Key Management
• 9e is for Card Authentication (PIN never checked)
• 82-95 is for Retired Key Management
• f9 is for Attestation

thank you for coming to my ted talk. 🎀

• --to-slot=ENUM — what slot to move an existing key to. same possible values: "9a", "9c", "9d", "9e", "82", "83", "84", "85", "86", "87", "88", "89", "8a", "8b", "8c", "8d", "8e", "8f", "90", "91", "92", "93", "94", "95", "f9".

and again, for the people in the back:

• 9a is for PIV Authentication
• 9c is for Digital Signature (PIN always checked)
• 9d is for Key Management
• 9e is for Card Authentication (PIN never checked)
• 82-95 is for Retired Key Management
• f9 is for Attestation

• -A, --algorithm=ENUM — what algorithm to use. possible values are "RSA1024", "RSA2048", "RSA3072", "RSA4096", "ECCP256", "ECCP384", "ED25519", "X25519". default is RSA2048.
• -H, --hash=ENUM — the hash to use for signatures. possible values are "SHA1", "SHA256", "SHA384", "SHA512". default is SHA256.
• -n, --new-key=STRING — the new management key to use for the set-mgm-key action. if you skip it, it will ask for the key.
• --pin-retries=INT — how many retries before the pin code is blocked. (bestie. be careful with this one, fr fr. 🔥)
• --puk-retries=INT — how many retries before the puk code is blocked.
• -i, --input=STRING — filename to use as input. - means stdin. default is -.
• -o, --output=STRING — filename to use as output. - means stdout. default is -.
• -K, --key-format=ENUM — the format of the key being read/written. possible values are "PEM", "PKCS12", "GZIP", "DER", "SSH". default is PEM.
• --compress — compress a large certificate using GZIP before importing it. default is off. 🗜️
• --global — reset the whole device, across all applications. default is off. (this is the big red button energy, ngl. 💀)
• -p, --password=STRING — password for decryption of the private key file. if you skip it, the password will be asked for.
• -S, --subject=STRING — the subject to use for the certificate request.

and the subject has to be written exactly like this:

/CN=host.example.com/OU=test/O=example.com/

format girlies, we respect them. ✨

• --serial=INT — the serial number of the self-signed certificate.
• --valid-days=INT — how long (in days) until the self-signed certificate expires. default is 365.
• -P, --pin=STRING — pin/puk code for verification. if you skip it, the pin/puk will be asked for.
• -N, --new-pin=STRING — new pin/puk code for changing. if you skip it, the pin/puk will be asked for.
• --pin-policy=ENUM — set the pin policy for the generate or import-key action. only available on YubiKey 4 or newer. possible values are "never", "once", "always", "matchonce", "matchalways".
• --touch-policy=ENUM — set the touch policy for the generate, import-key or set-mgm-key action. only available on YubiKey 4 or newer. possible values are "never", "always", "cached".
• --id=INT — the id of the object for write/read object. 🪪
• -f, --format=ENUM — the format of the data for write/read object. possible values are "hex", "base64", "binary". default is hex.
• --attestation — add attestation cross-signature. default is off.
• -m, --new-key-algo=ENUM — new management key algorithm to use for the set-mgm-key action. possible values are "TDES", "AES128", "AES192", "AES256". default is TDES.
• --scp11 — communication with the YubiKey is done over an encrypted channel. default is off.

DEPRECATED! please use the --enc flag instead. it's giving "we've moved on, bestie". 🫶

• --enc — communication with the YubiKey is done over an encrypted channel. default is off. 🔐

---

and that's the whole page, no crumbs left behind. this was yubico-piv-tool version 2.7.3, dated January 2026, and honestly? she ate. 💅✨ go manage those PIV credentials, bestie, you've got this. 🎀💖