# Understanding the feature set of the Nitrokey 3 NFC
**URL:** https://support.nitrokey.com/t/understanding-the-feature-set-of-the-nitrokey-3-nfc/7579
**Category:** FIDO2 / Nitrokey 3
**Created:** [April 17, 2026, 8:53pm UTC](https://support.nitrokey.com/t/understanding-the-feature-set-of-the-nitrokey-3-nfc/7579 "2026-04-17T20:53:27Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@jduenas](https://support.nitrokey.com/u/jduenas)
#### Post date: [April 17, 2026, 8:53pm UTC](https://support.nitrokey.com/t/understanding-the-feature-set-of-the-nitrokey-3-nfc/7579/1 "2026-04-17T20:53:27Z")
I want to promote the NK3 among friends and colleagues, therefore I want to be sure that I understand some of the main features correctly. Please excuse my sloppy terminology.
- it is possible to configure **one** **HMAC “key” only** - in my case it works for unlocking KeepassXC - but this one HMAC can be used to unlock additional systems. I.e., the second device would not “know” and would not “care” that I am already using the HMAC for my KeepassXC. Correct? (This implies the upsides and downsides of a key that opens more than one door, of course)
- if I use the NK3 to create a passkey as a the second factor on a login system which requires user ID and password [\* then that passkey is a so-called non-resident key](https://www.corbado.com/glossary/non-resident-keys) which is not actually stored in the NK3 because it is not needed according to the underlying protocol. According to the linked article, the NK3 can handle a practically unlimited number of non-resident keys for a practically unlimited number of system logins Correct?.
Thanks in advance!
---
### Author:  [@jduenas](https://support.nitrokey.com/u/jduenas)
#### Post date: [April 19, 2026, 4:06pm UTC](https://support.nitrokey.com/t/understanding-the-feature-set-of-the-nitrokey-3-nfc/7579/2 "2026-04-19T16:06:08Z")
Allow me to rephrase my questions in a more straightforward manner:
- you can only configure one HMAC “key” but you can use it to authenticate on more than one system
- you can use the NK3 as a “passkey container” to authenticate on a practically unlimited number of systems as long as the passkeys are used as the second factor - i.e. instead of TOTP, in addition to user ID and password - for systems which support 2FA..
Is my understanding correct? Thanks in advance!
---
### Author:  [@nku](https://support.nitrokey.com/u/nku)
#### Post date: [April 22, 2026, 9:10am UTC](https://support.nitrokey.com/t/understanding-the-feature-set-of-the-nitrokey-3-nfc/7579/3 "2026-04-22T09:10:55Z")
For Nitrokey 3, there are two slots for a hmac secret, that can be set with nitropy or the app. This however will be used directly by supported applications. I know of keepassxc that supports this to protect and encrypt a password database.
Then theee are old HMAC challenge responses similar to yubikey. They are now used very rarely and change after every use as a counter gets increased. You may ignore them.
For Linux you could also use fido2-cred and fido2-assert to create one on device fido2 credential for the sake of creating arbitrary challenge responses using the hmac-secret extension.
Also there are tools like age-plugin-fido2-hmac that can be used to encrypt data using fido2 and thus a nitrokey 3.
You can authenticate unlimited sites using non-discoverable fido2 as second factor. The website stores the required data next to a user account that is useable only with your fido2 token.