Oct 25, 2026

ChatGPT Advanced Account Security and YubiKeys (2026)

Advanced Account Security is an opt-in ChatGPT setting that turns off your password and lets you sign in only with a passkey or a hardware security key like a YubiKey. It also turns off email and SMS recovery, shortens sessions, emails you on every sign-in and keeps your conversations out of model training. OpenAI launched it on April 30, 2026, with a two-key YubiKey bundle from Yubico. The trade-off is real: lose every key and every recovery key, and OpenAI Support can’t get you back in.

What changes when you turn it on

From OpenAI’s Advanced Account Security help page:

	Standard ChatGPT account	With Advanced Account Security
Sign in with	Password, codes or a passkey	Passkey or security key only
Email and SMS sign-in codes	On	Off
Email account recovery	On	Off
Email alert on every sign-in	Off	On
Session length	Standard	Shorter
Chats used for model training	Your data controls decide	Never
OpenAI Support can restore access	Yes, after a verification process	No

Enrolling signs you out of every device, and you sign back in with a key. Codex uses the same OpenAI sign-in, so it gets the same protection.

What you need before you start

Two sign-in methods, one of which works across devices. A passkey plus a YubiKey qualifies. So do two YubiKeys, or two passkeys where at least one syncs (iCloud Keychain, Google Password Manager, a password manager). A passkey saved on a single device may not count.
A safe place for recovery keys. Setup gives you recovery keys. Each works once, and entering one starts a 48-hour wait before the account unlocks.
A personal account. Enterprise-managed accounts and accounts on a verified company domain can’t enroll. On ChatGPT Business it depends on your workspace. If the option isn’t under Settings → Security, it isn’t available to you yet.

Any FIDO-compatible security key works. You don’t need a YubiKey, and you don’t need OpenAI’s bundle.

How to turn it on

In ChatGPT on the web, open Settings → Security → Advanced Account Security and click Enroll. The phone apps send you to a browser to finish.
On the setup page, click Continue.
Add your two sign-in methods. For a YubiKey, plug it in (or hold it to your phone for NFC) and touch it when asked.
Save your recovery keys, then confirm you saved them.
You’re signed out everywhere. Sign back in with a key or passkey.

To replace recovery keys: Settings → Security → Advanced Account Security → Recovery keys → Manage → Replace recovery keys. The old ones stop working.

To turn it off: same page, Disable. Your password, sign-in codes and email recovery come back. Your keys stay on the account as optional passkeys.

The OpenAI YubiKey bundle

OpenAI and Yubico sell two keys together at what OpenAI calls preferred pricing (bundle details):

YubiKey C Nano. Stays in your laptop’s USB-C port for everyday sign-ins.
YubiKey C NFC. The backup. It also taps against your phone.

Both ship with OTP switched off, which removes a weaker fallback. Order at chatgpt.com/yubikey while signed in, in the US, UK or EEA. Checkout, shipping and returns all run through Yubico, and the price shows at Yubico’s checkout. You can buy the bundle without enrolling, and the keys work on your Google, Microsoft and other accounts too.

Who should turn it on

OpenAI built it for people at higher risk of targeted attacks, and for anyone who wants the strongest sign-in available and accepts the recovery risk that comes with it.

For one group it’s mandatory. Since September 1, 2026, individual members of OpenAI’s Trusted Access for Cyber program need it, with a hardware-backed passkey, to keep access to OpenAI’s most capable cyber models (Yubico’s write-up). Anthropic set a similar bar for its own cyber program. See which AI assistants support YubiKeys for how every major assistant compares.

A stolen ChatGPT login used to expose your chat history. Once ChatGPT connects to your email and calendar, it exposes those too.

That’s where most of the value is now. With the Carly plugin, ChatGPT labels and sorts your email, does advanced calendar work, and texts and calls people for you, following your rules the same way every time. Click Get the Carly plugin, add it, and sign in with your Carly account.

Two keys close both doors:

On ChatGPT, with Advanced Account Security.
On the Google or Microsoft account behind your inbox. A single YubiKey holds passkeys for many accounts, so the same pair covers both.

If you’re weighing the email connection itself, read is it safe to connect ChatGPT to Gmail.

If you lose a key

One key gone: sign in with the other, then add a replacement.
All keys gone: enter a recovery key. The account unlocks after 48 hours.
Keys and recovery keys gone: you may lose the account. Support can’t reset a password, remove Advanced Account Security or add a sign-in method for you.

Keep one recovery key somewhere you can reach without your keys: printed and filed, or in a password manager that doesn’t itself unlock with the same YubiKey.

FAQ

Do I need a YubiKey for ChatGPT Advanced Account Security?

No. Any FIDO-compatible security key works, and so do passkeys. You need at least two sign-in methods, one of which works across devices.

No. Password sign-in and email or SMS codes are off while Advanced Account Security is on. Disabling it brings them back.

Is Advanced Account Security available on ChatGPT Enterprise or Business?

Not on Enterprise or on accounts tied to a verified company domain. On Business it depends on how the workspace is set up. If it isn’t listed under Settings → Security, your account can’t use it yet.

Does Advanced Account Security stop ChatGPT training on my chats?

Yes. Conversations aren’t used to train OpenAI models while it’s on.

What happens if I lose my YubiKey?

Sign in with your second key or passkey and add a replacement. If every method is gone, a recovery key starts a 48-hour unlock. Without recovery keys, OpenAI can’t restore the account.

Can I use the same YubiKey for ChatGPT, Google and Microsoft?

Yes. A YubiKey stores passkeys for many accounts, so one pair can protect ChatGPT and the email accounts it connects to.

Ready to automate your busywork?

Carly schedules, researches, and briefs you—so you can focus on what matters.

See what people say

"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.

Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.

On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."

Gus Ibrahim, Founder & Director, IHR