In a hardware token, there's generally a single master secret and private keys are derived on the fly for each website you register/log into. So you can use 1 s

In a hardware token, there's generally a single master secret and private keys are derived on the fly for each website you register/log into. So you can use 1 single hardware token with an unlimited number of sites (note that you prob want to register at least 2 tokens per site, in case you loose one, but this is a different story). The standard also define the concept of resident keys (RKs), that you can use for passwordless authentication (typically with a PIN on the token, to avoid theft). In this case of course each key consumes a bit of storage, so the number of sites is limited. For example, a Solo key can currently store 50 resident keys. To the best of my knowledge, apart from demo sites, the only "real" site supporting resident keys is microsoft/outlook.com, so this is currently not a real practical limitation.