Nitrokey 3 Firmware

Nitrokey 3 Firmware at a glance

The Nitrokey 3 is a hardware security key with USB-A, USB-C and NFC. It acts as a FIDO2 and WebAuthn authenticator for passwordless sign-in and two-factor login, provides one-time passwords, and works as an OpenPGP smart card and PIV token for S/MIME, SSH login and disk encryption. Administrators deploy it wherever private key material must never leave the device.

The device firmware is open source and published in the vendor repository: stable builds plus occasional pre-releases, each with a changelog, signed update files and migration notes. It is applied using the vendor's command-line tool or desktop application.

Before a rollout, read the release notes: downgrades are not supported, newer update file formats require an up-to-date flashing tool, and individual builds change behaviour of OpenPGP, PIV or the number of resident keys that can be stored. Stored credentials and PINs normally survive an update. Even so, update a test device first and keep a second registered key as a fallback for the affected accounts before the rest of the fleet follows.