In short: Duo hardware tokens are small devices that display a one-time passcode for Duo MFA, for users without a smartphone. Duo supports its own OTP tokens, third-party OATH HOTP tokens and YubiKey OTP, plus FIDO2 security keys for phishing-resistant login. Admins import and assign tokens in the Duo Admin Panel.
When hardware tokens make sense
Duo Mobile is the easiest method for most people, but there are plenty of situations where a phone is not an option:
- Staff who do not have a work phone and do not want to install apps on a personal one
- Sites where phones are banned or impractical: factory floors, labs, secure rooms, some healthcare and care settings
- Schools and colleges, where many staff and support workers have no work mobile (see Duo for schools)
- Shared workstations and kiosks used by several people
- Administrators and break-glass accounts that should not depend on one person's phone
- Areas with poor mobile signal, where push is unreliable
Tokens and security keys sit alongside other methods, so you can give a token only to the people who need one.
Types of token and key Duo supports
| Type | How it works | Good to know |
|---|---|---|
| Duo OTP tokens | Press the button, type the code shown | Bought from Duo and added to your account automatically, so there is nothing to import |
| Third-party OATH HOTP tokens | Counter-based one-time codes, 6 or 8 digits | SHA-1 OATH HOTP tokens can be imported from the supplier's details |
| OATH TOTP tokens | Time-based codes that change every few seconds | Can be imported, but Duo does not recommend them and they cannot be resynchronised |
| YubiKey OTP (Yubico OTP) | Touch the key and it types a one-time code | Accepted even when risk-based step-up blocks other OTP codes; a YubiKey used in OATH-HOTP mode is not |
| FIDO2 / WebAuthn security keys | Insert or tap the key, often with a PIN | Phishing-resistant; can also be used for passwordless login |
FIDO2 security keys are the strongest choice. They work only with the genuine site, so they cannot be phished, and there is no code to type. One-time-passcode tokens are simpler and work with older systems such as VPNs that only accept a typed code.
How admins set up tokens
Tokens are managed in the Duo Admin Panel under the hardware tokens section:
- Import third-party tokens by choosing the token type and pasting the details from the supplier's file in CSV format (serial number and secret key). Duo's own tokens are added to your account for you.
- Assign a token to a user from their user page, or attach users from the token's page. A token can be shared between users, and a user can hold several.
- Resynchronise an HOTP token that has drifted (usually from too many button presses) by entering three consecutive codes from it.
- Remove a lost token from the user straight away. Third-party tokens you imported can also be deleted outright, which removes them from every user they were attached to; tokens bought from Duo cannot be deleted, only detached.
Security keys work slightly differently. Users can enrol their own keys through the Universal Prompt, and an admin can enrol one key for a user from the Admin Panel. Keys enrolled by an admin are registered for two-factor use only; for passwordless login, the user must enrol the key themselves. Keys cannot be moved between users, so a reassigned key is removed and re-enrolled. One-time-passcode tokens can also be assigned to Duo administrators to protect Admin Panel logins on paid editions; this needs the Owner admin role.
Tokens, policy and risk-based authentication
Admins choose whether hardware tokens are allowed in the authentication methods policy, globally or for particular applications and groups. You could, for example, allow tokens only for a warehouse group and require security keys for admins.
If you use risk-based authentication (Advantage and Premier), bear in mind that when Duo detects risk and steps a user up, typed codes from hardware tokens (other than Yubico OTP), Duo Mobile passcodes and SMS are not accepted until the user completes a stronger login. FIDO2 security keys and Yubico OTP still are. Users who rely only on an HOTP token may therefore need a security key as well.
Buying tokens and keys
We supply Duo-compatible OTP tokens and FIDO2 security keys alongside your Duo licences, and can import and assign them in your Admin Panel before they are handed out. The right choice depends on what the users log in to: a security key for modern cloud apps and passwordless, an OTP token where a typed code is the only option.
Ask us for a quote for tokens and keys. We will recommend the type that suits each group rather than a single answer for everyone.
How we help
We design the method mix for each group of users, import and assign tokens, write a simple user guide and set up a process for lost and broken tokens, so your help desk is not left guessing. Contact us to plan MFA for staff without a smartphone.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can I use Duo without a smartphone?
Yes. Duo supports OTP hardware tokens, FIDO2 security keys, platform authenticators such as Windows Hello and Touch ID, and Duo Desktop authentication on the computer itself. SMS and phone callback are also available, though they are weaker options.
Does Duo work with YubiKey?
Yes. YubiKeys can be used as FIDO2 security keys, which is the most secure option, or in Yubico OTP mode as a hardware token. For OTP use, the key's details are imported into the Duo Admin Panel.
Can I use my existing OATH tokens with Duo?
Usually. Duo accepts SHA-1 OATH HOTP tokens with 6 or 8 digit codes, imported in the Admin Panel. TOTP tokens can be imported but Duo does not recommend them, because time drift cannot be corrected by resynchronising.
What happens if a user loses their Duo token?
An admin detaches the token from the user in the Duo Admin Panel, or deletes it if it is an imported third-party token, so it stops working for that account straight away. The admin can then issue a bypass code so the user can log in until a replacement token is assigned.
How much do Duo hardware tokens cost?
It depends on the type and quantity. Ask us for a quote for OTP tokens or FIDO2 security keys, and we will recommend which suits each group of users.