Customer Release Notes
Product Description
SafeNet FIDO Key Manager for Windows is a standalone offline application that allows customers and end users to manage and setup Thales’ FIDO USB tokens and Smart Cards, Certificate-Based PKI USB Authentication Tokens, and Certificate-based PKI Smart Cards.
You can use FIDO and PKI devices for a secure and phishing-resistant authentication method for logging in to various websites or applications. It allows administrators or users to be in full control of their physical devices and not be dependent on the limited functionality offered natively by browsers or desktops. With SafeNet FIDO Key Manager, you can configure the basic FIDO and PKI specifications and the unique set of additional features that it offers for better security and control.
Release Description
07/10/2025
Legal & Compliance:
- Updated End User License Agreement (EULA) and Privacy Policy.
FIDO 2.1 Enhancements:
-
Enforce minimum PIN length on standard and enterprise devices.
-
Mandatory user verification enforcement.
-
Enforce PIN change for standard and enterprise devices.
-
Ability to convert devices from Managed mode to Unmanaged mode via factory reset option.
-
Menu updates for Standard Profile and BIO cards.
-
Auto-detection and support for new and future Thales FIDO devices.
PKI operations:
-
Device detection and display of device information for PKI devices.
-
Change PIN for PKI devices.
04/11/2025
SafeNet FIDO Key Manager for Windows v1.4 introduces the following features:
-
Support for the latest Thales devices: Thales FIDO and Fusion devices, including standard and enterprise profiles, are supported. Additional SafeNet devices: IDPrime 3940C (FIDO 2.0, 2.1, 2.1 EE), 940C (FIDO 2.0, 2.1), FIDO (2.1, 2.1 EE), PIV 4.0 FIDO 2.1 EE, and eToken Fusion NFC Enterprise.
-
Device serial number identification: Identify the device by matching the printed serial number with the serial number displayed in the software.
-
Improvements for device reset: For FIDO standard profile tokens, the user gets information to tap the device to complete the reset flow.
-
UI Improvements: Overall application user interface enhancements to align with the Windows Fluent Design System.
-
Compliant with accessibility guidelines: Support for contrast theme, screen reader (narrator), bigger text size, screen resolution, scaling, and keyboard accessibility. See the documentation for details.
10/14/2024
SafeNet FIDO Key Manager for Windows v1.3 introduces the following features:
-
Enforce Change PIN: Allows the administrator to mandate that users change their PIN upon the device's initial use.
-
Bulk Configuration: Enables users to configure multiple FIDO devices simultaneously. Every smart card or USB token connected to the system will be configured at the same time.
-
Support for the eToken Fusion FIPS NFC device
07/22/2024
SafeNet FIDO Key Manager for Windows v1.2 introduces the following feature and resolves the issues listed below:
-
Support for the eToken Fusion NFC PIV device
-
Resolved Issues
-
The SafeNet FIDO key manager application was unable to launch in admin mode on Windows machines with restricted access to the Windows Store app.
-
The confirmation reset button failed to enable when the card was removed and reinserted.
-
04/15/2024
SafeNet FIDO Key Manager for Windows v1.1 introduces the following features:
-
Suppport for biometrics: Allows users to add or remove a fingerprint when using a compatible SafeNet Bio Smart card. This allows users to replace their PIN with a fingerprint during authentication.
-
Support for managing FIDO credentials: Allows users to view and delete the credentials that are registered on a FIDO Key.
-
New tutorial screens: Introduce SafeNet FIDO Key Manager for Windows functionality the first time you open the application.
12/15/2023
SafeNet FIDO Key Manager 1.0 introduces the following features:
-
Pin Management: Users can set a PIN for a new FIDO key as well as change their existing PIN.
-
Device Reset: Users can reset their FIDO keys if they no longer remember their PIN or if they want to clear the credentials on their FIDO keys.
If the FIDO key is under administrator control, the administrator can determine whether a FIDO key reset is permitted. In such cases, users must utilize the SafeNet FIDO Key Manager on the Windows platform to reset a managed FIDO key.
-
Additional features unique to SafeNet FIDO tokens and smartcards:
Available on FIDO 2.1 FIDO Key onwards.
SafeNet FIDO tokens and smartcards can be managed by an administrator to have more control on the FIDO Keys before they are handed over to the users. Some of those administrator features are:
-
Admin PIN Setup: An administrator can set or change admin PIN on a FIDO device that will put the device in the managed mode. When the device is in managed mode, the admin can restrict or control certain capabilities (listed below) that are available on the FIDO device.
-
Unlock PIN: An administrator has the capability to unlock a FIDO device that has been locked due to multiple PIN retries. Utilizing the admin PIN, the device is unlocked, and a new PIN must be set on the device.
-
Application Whitelist: When the administrator manages the FIDO device, they have the authority to limit its usage to specific web applications. This restriction includes limiting storage on the device to add more credentials, ensuring that the device can only be utilized for the approved websites.
-
Minimum PIN Length: Administrators can restrict the device PIN to be set with a specified minimum PIN length.
-
Manage Device Reset: Administrators can limit the capability of users to directly reset the device, mandating the use of an admin PIN before the device can be reset.
-
Advisory Notes
Run as Administrator
-
This application needs administrator permissions to function properly with FIDO keys. To run the application with administrator permission, Right-click the SafeNet FIDO Key Manager app icon from the app list and choose Run as administrator option. If a window pops up, click Yes for confirmation.
-
Windows 32-bit system is now not supported by SafeNet FIDO Key Manager.
Localization
SafeNet FIDO Key Manager for Windows supports the English language only.
Limitations
-
You cannot reduce the minimum PIN length below the current value, as this may be restricted by the FIDO device you are using.
-
Downgrade of SafeNet FIDO Key Manager's exe installer from v2.0.163 to v1.4.2 fails.
Known Issues
Issue | Workaround |
---|---|
When deleting one fingerprint, both the fingerprints enrolled on the SafeNet eToken Fusion BIO device are getting deleted. | None. |
The Manage Fingerprint option is visible instead of the Add fingerprint option when all the fingerprints are deleted for "SafeNet eToken Fusion BIO" device. | Re-insert the device to view the correct options. |
During the token reset for standard profile tokens, if the user cancels after being prompted to touch, there will be a brief delay (the app might hang slightly) before navigating to the device info page. | Wait out the delay or relaunch the application. |
When two NFC PIV devices are connected—one via USB and the other through a Smart card reader—the application only recognizes a single device. | Consider utilizing either the USB connector or the smart card reader exclusively. |
If, during the unblock process, the user or admin enters a response code that differs from the one received, the eToken/Card will fail to unblock. | If the response code changes during the exchange, the user needs to create a new challenge code, have the admin re-sign it, and then use the newly signed code. |
During Batch Configuration, the application sometimes fails to detect a Smartcard that is inserted in a reader connected directly via USB. | Remove and reinsert the card into the card reader to re-establish the connection. |
If user enrolls multiple failed fingerprints before successful one, the application retains and displays the previously assigned friendly names. Furthermore, deleting any of the failed fingerprints will also delete the successfully enrolled fingerprint. | None. |
In the reset flow, when the application prompts the user with the instruction Remove and re-insert your Thales FIDO Key within 20 seconds, if the user inserts another FIDO Key with the same AAGUID as the previously selected FIDO Key, the new device will undergo the reset process. | Ensure that you re-insert the same FIDO key to perform the reset operation on that specific FIDO key only. |
Compatibility Information
Operating System
-
Windows 11 (64-bit) Desktop/ Tablet Devices, minimum OS version 22H2
-
Windows 10 (64-bit) Desktop/Tablet Devices, minimum OS version 21H2
Beta releases of the operating system are not supported.
Note
The Remote Desktop Protocol (RDP)/VM is not supported on SafeNet FIDO Key Manager.
Supported Cards and Tokens
Following list of devices is supported in SafeNet FIDO Key Manager v2.0.0:
Following FIDO devices are supported:
-
SafeNet IDPrime FIDO Bio
-
SafeNet eToken FIDO NFC (upcoming)
-
SafeNet eToken FIDO NFC Enterprise (upcoming)
Following PKI devices are supported:
-
SafeNet eToken 5110 CC (940)
-
SafeNet eToken 5110+ CC (940B)
-
Safenet eToken 5110+ CC (940C)
-
Safenet eToken 5110+ FIPS
-
Safenet etoken 5110 FIPS
-
SafeNet eToken 5300 C
-
SafeNet IDPrime 930
-
Safenet IDPrime 940
-
Safenet IDPrime 940B
-
Safenet IDPrime 940C
-
Safenet IDPrime 3940C
-
SafeNet IDPrime DI PIV4.0 FIPS (upcoming)
Following Fusion (FIDO + PKI) devices are supported:
-
Safenet eToken Fusion
-
Safenet eToken Fusion CC
-
Safenet eToken Fusion FIPS
-
Safenet eToken Fusion NFC FIPS
-
SafeNet eToken Fusion NFC PIV
-
SafeNet eToken Fusion NFC PIV Enterprise
-
SafeNet IDPrime 3930 FIDO
-
SafeNet IDPrime 3940 FIDO
-
SafeNet IDPrime 940B FIDO
-
SafeNet eToken Fusion BIO (upcoming)
-
SafeNet eToken Fusion BIO Enterprise (upcoming)
-
SafeNet IDPrime DI PIV4.0 FIPS FIDO2.1 FIPS (upcoming)
-
SafeNet IDPrime DI PIV4.0 FIPS FIDO2.1 FIPS Enterprise (upcoming)
Architecture
- x64