Passwords alone are not enough for important accounts. Use a different, long password for every account, then add the strongest sign-in method the service offers. Prefer a passkey or physical security key; use an authenticator app when those are unavailable, and use SMS or email codes only when stronger choices are not offered. Protect recovery methods as carefully as the account itself.
Your email account deserves priority because whoever controls it can often reset banking, shopping, social-media and other passwords. Turn on multifactor authentication (MFA) for email, financial and tax services, payment apps and social accounts first.
As an Amazon Associate I earn from qualifying purchases.
Why a password by itself is a weak barrier
A password can be long and difficult to guess yet still fail when an attacker obtains it another way. Phishing pages imitate a legitimate sign-in screen and capture credentials as you type them. Password databases can be stolen, passwords can be reused across sites, and malware or an exposed browser session can reveal them. A unique password limits damage from reuse, but it cannot make a fake website harmless.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe National Institute of Standards and Technology (NIST) states in its July 2025 Digital Identity Guidelines that Passwords are not phishing-resistant.
That is why a second authenticator matters for accounts containing money, identity information, private messages or the ability to reset other accounts.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Multifactor authentication combines different kinds of proof, such as something you know (a password), something you have (a security key or phone) or something you are (a biometric unlocked on your device). Any additional factor is generally safer than password-only sign-in, but the methods differ substantially in how well they resist phishing and how easy they are to recover.
Which accounts should get MFA first?
Start with accounts that can unlock or expose many others. Work through this order:
- Primary email: attackers can use password-reset links sent there to take over unrelated accounts.
- Banking, credit-card and payment accounts: these can directly expose funds or payment credentials.
- Tax and government-service accounts: they contain identity and financial records.
- Social-media accounts: takeover can be used for scams, impersonation and password-reset attacks against contacts.
- Password-manager and cloud-storage accounts: these may contain the keys to many other services.
The Federal Trade Commission (FTC) specifically recommends enabling two-factor authentication for sensitive services such as banking, credit cards, email, social media, tax filing and payment apps. MFA is often available but not enabled by default, so look for it in each account’s security settings.
Free tools Windows power users keep installed
One-click scans. No signup required.
Passkeys, security keys and codes: how the choices compare
Use the strongest method that the service, your devices and your recovery plan can support. The service’s implementation matters: a label such as “MFA” does not guarantee phishing resistance.
| Method | Security benefit | Limitations and practical considerations |
|---|---|---|
| Passkey | Uses public-key cryptography and is designed to resist phishing; sign-in is usually quick and may work across trusted devices. | Availability, syncing and recovery vary by service and credential manager. Do not assume every passkey works on every device or account. |
| Physical security key | Provides phishing-resistant authentication with a separate device; useful as a primary factor or backup. | It must match the service and your device’s connector or protocol. Keep a safe backup key or another approved recovery method. |
| Authenticator app | Usually safer than SMS against SIM-swap attacks and independent of control of your email inbox. | Manually entered one-time passwords can still be phished or relayed from a fake site to the real service. |
| SMS or email code | Accessible fallback and better than password-only sign-in. | SMS can be exposed by SIM swaps; email codes depend on the security of the email account; both remain vulnerable to phishing. |
| Password alone | A unique, long password reduces guessing and reuse risk. | It does not stop phishing or use of a stolen credential. Add another method for important accounts. |
CISA’s comparison for organizations places physical security keys above authenticator apps with number matching, then apps that generate one-time codes, with text or email codes weakest among those listed. That ordering is a useful security comparison, not a personal risk score. The FTC likewise advises that it’s safer to use an authenticator app or security key, if they’re an option.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What a passkey actually does
A passkey is a FIDO credential based on public-key cryptography. Your device or credential manager keeps a private key; the service stores a corresponding public key. During sign-in, the service sends a challenge and your device proves possession of the private key after you unlock it with a fingerprint, face recognition, device PIN or other local method. The private key is not sent to the website, and a passkey created for one service cannot be replayed at a look-alike domain.
FIDO2 combines WebAuthn, which websites use in the browser, with CTAP, which lets an external authenticator communicate with a device. External authenticators can connect through USB, near-field communication (NFC) or Bluetooth Low Energy. A FIDO2 security key is therefore a physical category, not a guarantee that every model or connector works with every account.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Syncable versus device-bound passkeys
A device-bound credential stays on one authenticator. A correctly implemented syncable passkey can be available on several trusted devices and can simplify recovery when one device is lost. NIST’s April 2024 supplement explains that syncable authenticators can provide phishing resistance, cross-device support and consumer-friendly recovery. The actual behavior depends on the platform, service and account-recovery design: check where a passkey is stored, how it is restored and which devices are trusted.
How to turn on the strongest available method
- Open the account’s security page. Sign in directly through the service’s official app or by typing its known address. Look for labels such as Passkey, Two-factor authentication, Two-step verification or Multifactor authentication.
- Enroll a passkey or security key first. Follow the prompt to create a passkey on a supported device, or insert/tap the physical key and complete its touch or PIN step. Confirm that the new method appears in the account’s list of sign-in options.
- If those are unavailable, add an authenticator app. Scan the service’s setup QR code, verify the generated code, and save the app’s backup or transfer information according to the service’s instructions.
- Use SMS or email only as a fallback. If a service offers no stronger method, enable the code option rather than leaving the account password-only. Treat the phone number and email inbox as security-critical.
- Replace the password with a unique one. Generate and store a separate password for the account. A password manager can help create and remember it, but it does not replace phishing-resistant MFA.
- Test a second sign-in method. Open a private browser window or another device, sign out, and confirm that the passkey, key or app works before you close the setup screen.
Recovery is part of authentication
A strong sign-in method can lock you out if the only device holding it is lost, damaged or replaced. Set up recovery immediately after enrollment, while you are still signed in.
- Download or write down the service’s recovery codes and keep them in a secure location separate from the account they recover. Do not leave the only copy in the same phone or cloud account.
- Add a second approved authenticator, such as a backup security key or another trusted device, when the service permits it.
- Review recovery email addresses and phone numbers. Remove old numbers and addresses you no longer control.
- Understand the service’s account-recovery process before an emergency. Some providers impose waiting periods or require identity checks.
- Store physical keys where you can find them but an intruder cannot. A spare key kept at a separate, secure location can prevent a single-point failure.
Never disclose a verification code to someone who contacts you unexpectedly. The FTC warns that scammers commonly pose as support staff and ask for these codes; a legitimate service should not need you to read a code back to a caller.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What NIST, the FTC and CISA say about password length and MFA
NIST’s final SP 800-63B-4 guidance, published in July 2025, requires at least 15 characters for a password used as a single factor in systems covered by that standard. A verifier may allow a password used only as part of MFA to be shorter, but not below eight characters. These are requirements for systems following NIST’s guidance, not a promise that every consumer website enforces them.
NIST also explains that a manually entered one-time code is not phishing-resistant: an attacker can relay a code from a fake site to the genuine verifier. An authenticator-app code is therefore a useful fallback, not a phishing-proof solution.
The FTC’s consumer guidance, Use Two-Factor Authentication To Protect Your Accounts, recommends turning on MFA and choosing an authenticator app or security key when available. It notes that SMS codes can be exposed through SIM-swap attacks, while authenticator apps are not susceptible to that specific attack. CISA’s Require Multifactor Authentication guidance summarizes the principle plainly: Strong passwords help, but they are no longer enough to keep accounts and systems safe when used alone.
Common mistakes and how to fix them
Relying on a reused “strong” password
Length does not compensate for reuse. Change every reused password, beginning with email and financial services, and generate unrelated passwords for each account.
Assuming every MFA method is equally secure
Choose a passkey or security key where possible. If the service supports only codes, use an authenticator app before SMS or email. Keep the code method enabled only as a necessary fallback and monitor the account for unexpected sign-ins.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Turning on MFA without preparing recovery
Do not remove your old device or reset your phone until the new authenticator works and recovery codes are stored separately. If you are already locked out, use the service’s official recovery flow rather than a link sent by an unsolicited “support” contact.
Approving an unexpected login prompt
Decline prompts you did not initiate. Repeated prompts can indicate that someone has your password and is trying to make you approve access. Change the password from a trusted device and review active sessions.
Assuming a passkey is universally portable
Check the account’s supported browsers, operating systems, connector types and syncing behavior. Keep an approved backup method until you have verified sign-in on each device you actually use.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Should you enable more than one strong method?
For an account that matters, yes. A passkey can be your everyday sign-in while a second passkey, physical security key or service-approved recovery code protects against loss of the primary device. Avoid adding unprotected fallback methods merely for convenience: an old phone number, abandoned email address or shared recovery device can undermine the stronger factor.
Review the account’s enrolled authenticators periodically. Remove devices you sold, lost or no longer recognize, rotate recovery codes after using one, and check sign-in alerts. Security is a continuing account-maintenance task rather than a one-time switch.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Frequently asked questions
Frequently Asked Questions
Is a passkey the same thing as two-factor authentication?
A passkey is an authentication credential that uses public-key cryptography and local device unlocking. Whether it counts as one factor or satisfies a service’s MFA policy depends on that service’s implementation and account rules; check the security page rather than assuming.
Are authenticator-app codes phishing-proof?
No. A one-time code entered into a convincing fake site can be relayed to the real service. Authenticator apps are generally stronger than SMS against SIM swaps, but passkeys and security keys provide better phishing resistance.
What should I do if a website offers only SMS codes?
Enable SMS MFA instead of leaving the account password-only, use a unique password, secure your mobile-carrier account with its own PIN or protections, and check periodically whether the service has added passkeys or an authenticator-app option.
Can I keep SMS as a backup after adding a passkey?
Only if you accept the weaker recovery path. A separate security key, second passkey or securely stored recovery codes is usually a better backup than a phone number that can be transferred through a SIM-swap attack.
What happens if I lose the phone with my passkey or authenticator app?
Use a previously configured passkey on another trusted device, a backup security key or the service’s recovery codes and official recovery process. This is why recovery must be set up before a device is lost.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
