Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallUse a FIDO2/WebAuthn hardware security key when your bank or exchange supports it and you can keep a backup. It gives the strongest protection against phishing because the credential is cryptographically bound to the legitimate website. Use a time-based authenticator app (TOTP) when a service does not accept keys, when several people need shared access, or when easier portability and recovery outweigh maximum phishing resistance. In either case, plan recovery before you remove an existing factor.
What the two methods actually do
Authenticator apps: shared secrets and one-time codes
A TOTP authenticator app stores a shared secret created when you enroll the account. The app uses that secret and the current time to display a short-lived code, usually six digits. You type the code into the bank or exchange’s login page. The server calculates the expected value from the same secret and accepts it only during a narrow time window.
As an Amazon Associate I earn from qualifying purchases.
Some apps use push approvals instead of displayed codes. A sign-in request appears on your phone and you approve or deny it. Push is convenient, but an attacker who has your password can repeatedly trigger prompts or persuade you to approve a fraudulent request. Number matching, where the website shows a number that must be entered in the app, is safer than a simple “Approve” button because it reduces accidental approvals.
Microsoft’s NIST mapping classifies app push as single-factor out-of-band authentication and app OTP as single-factor OTP. Both are stronger than a password alone and generally stronger than SMS, but neither prevents a determined attacker from relaying a code or approval through a convincing fake login.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Hardware security keys: public-key credentials
A FIDO2/WebAuthn key creates an asymmetric credential. The service stores a public key; the private key remains in the hardware. During sign-in, the website sends a challenge and the key signs it only for the legitimate relying-party domain, usually after you touch the key or unlock it with a PIN.
NIST calls this verifier name binding: the authenticator uses the authenticated domain name when selecting the credential, so a phishing site cannot obtain a valid response for the real bank or exchange. CISA therefore ranks physical security keys above number-matching prompts, authenticator-app OTP, biometrics, and SMS or email codes, describing a security key as the option that provides the best protection against phishing.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
FIDO2 keys are multi-factor cryptographic hardware when a PIN or other user verification is required. Older U2F-capable keys can still be accepted by some services, but check the institution’s current terminology and supported protocols before buying.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Security comparison at a glance
| Factor | TOTP authenticator app | FIDO2/WebAuthn hardware key |
|---|---|---|
| Phishing resistance | Moderate. A six-digit code can be captured and relayed; push requests can be socially engineered. | High. The signed response is bound to the legitimate origin, so a look-alike site cannot use it for the real site. |
| Service compatibility | Very broad. Most banks and exchanges that offer MFA support an authenticator app. | Only available where the service supports FIDO2, WebAuthn, U2F, or passkeys with external authenticators. |
| Recovery after loss | Often possible with a second enrolled device, cloud or vendor backup, recovery codes, or the provider’s identity-verification process. | Requires a second enrolled key, recovery codes, or the provider’s account-recovery process. Losing the only key can lock you out. |
| Portability | Convenient across phones when the app supports secure transfer or synchronization; moving secrets must be done carefully. | Works across compatible computers and phones, but connector, NFC, operating-system, and browser support must match. |
| Exposure to phone malware | The secret and displayed code are on the phone; a compromised device or malicious backup can weaken protection. | The private key stays in the hardware and is not displayed, copied, or typed into a website. |
| Exposure to theft | A stolen unlocked phone may expose accounts or approval prompts; a strong device lock and remote-wipe plan help. | A stolen key is generally unusable without its PIN or the account’s other factor, but possession of an unlocked or PIN-known key is dangerous. |
| Setup friction | Scan a QR code, confirm a code, and save recovery material. | Register the key in each account, then use its touch, PIN, USB connector, or NFC interface at sign-in. |
| High-risk actions | Useful where the service requires an app, but codes and approvals can still be phished. | Best suited to withdrawals, transfers, changing security settings, and adding payment or withdrawal destinations when the service supports it. |
| Direct cost | Usually no separate hardware purchase; the cost is a compatible phone and secure backup or recovery. | Requires purchasing at least one compatible key, and a prudent setup includes a second key for backup. |
Which is safer for banking?
For a bank account that offers FIDO2 security keys or passkeys with an external key, enroll one. The origin binding blocks the most common weakness of OTP: entering a genuine-looking code into a fraudulent site. Keep an authenticator app or the bank’s recovery codes as a documented fallback if the bank permits it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Many banks still expose only app-based MFA. Fidelity’s published guidance documents enrollment with Google Authenticator, Microsoft Authenticator, and Apple Passwords, and tells customers to enter codes only in the official Fidelity app or website. That makes a TOTP app the practical strongest choice there, provided you verify the domain or use the official app before entering a code.
Capabilities differ by institution. Chase documents passkey support, while other banks may call the feature a security key, FIDO2, WebAuthn, or simply “passkey.” Look at the bank’s security settings rather than assuming that support at one bank applies to another.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Banking setup checklist
- Open the bank’s security or multifactor-authentication page and look specifically for “security key,” “FIDO2,” “WebAuthn,” “U2F,” or “passkey.”
- If a key is supported, register a primary and backup key, then sign out and test each one.
- If only an app is offered, choose a reputable TOTP app, lock the phone with a passcode or biometric, and follow the app vendor’s documented export or backup procedure.
- Save recovery codes offline in a location separate from the phone and key.
- Do not delete the old factor until the new factor and the recovery route have both been tested.
- Turn on transaction alerts and review the destination and amount inside the bank’s own interface before approving a transfer.
Which is safer for crypto accounts?
Crypto accounts deserve a stricter standard because an attacker who passes account MFA may be able to withdraw assets, change the email address, or alter security controls. A hardware key is preferable wherever the exchange accepts one, and it should be used for both login and sensitive changes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Coinbase’s retail documentation lists SMS, authenticator-application, and security-key methods and says any TOTP-compatible app should work. Its security guidance recommends a security key or passkey. Coinbase Prime requires you and designated teammates to use a YubiKey or another physical security key for sign-in, withdrawals, transfers, settings, and permission changes.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Binance documents authenticator apps and passkeys, including hardware authenticators. Its controls can be applied to login, assets, account settings, and security management. The exact enrollment screens and which actions require the factor can change, so check the current security page for your account type and region.
Separate the layers of crypto protection
- Email account: Protect the email address used for the exchange with its own hardware key or authenticator app. Email takeover can defeat exchange recovery.
- Exchange login: Use the strongest factor the exchange supports, preferably a FIDO2 key.
- Withdrawal controls: Enable address whitelists, withdrawal delays, team approvals, or transaction signing features where available. MFA does not validate that a destination address is yours.
- Hardware wallet: Review the recipient, network, amount, and fees on the wallet’s trusted display. Exchange MFA cannot protect a transaction you approve on a compromised computer or against a malware-replaced address.
How to choose between them
Choose a hardware key when these conditions apply
- The bank or exchange explicitly supports FIDO2, WebAuthn, U2F, or an external authenticator for the actions you care about.
- You face targeted phishing, manage large balances, administer a business account, or can tolerate carrying a small physical device.
- You can buy and enroll a second compatible key before making the key your only factor.
- Your computers and phones have the required USB connector, NFC capability, browser, and operating-system support.
Choose an authenticator app when these conditions apply
- The institution does not support security keys.
- You need access from several devices or need to share operational access through a service’s documented multi-user process.
- You can maintain secure backups and accept that a code may be phished.
- You need a low-cost method immediately while you arrange a key-supported account or backup plan.
Use both when the service allows it
A layered setup is often the most resilient: use a hardware key for normal sign-in and sensitive actions, keep a TOTP app or offline recovery codes for emergencies, and enroll a second key stored in a separate secure location. Do not leave an unused, weaker factor enabled without understanding whether an attacker could choose it instead of the key.
Step-by-step enrollment and recovery plan
- Inventory support. On every bank, exchange, and email account, open Security settings and record which options are available. Search the provider’s help center for the exact terms “security key,” “FIDO2,” “WebAuthn,” “U2F,” and “passkey.”
- Secure the account first. Change a reused password, update the recovery email and phone, and scan the device for malware before enrolling a new factor.
- Enroll the primary factor. For a key, select Add security key or the equivalent, insert or tap it, create the requested PIN, and touch the device. For TOTP, scan the enrollment QR code only in the official app or website, then enter the displayed code.
- Add the backup. Register a second key immediately, or enroll a second device only through the app vendor’s documented secure transfer or synchronization process. Generate recovery codes if offered.
- Test before retiring anything. Use a private browser window or a second device to sign in with each factor. Confirm that the bank or exchange requests the factor for withdrawals, transfers, security changes, and other high-risk actions, not just the initial login.
- Store recovery material offline. Print or write recovery codes and store them where a phone thief or malware infection cannot reach them. Do not photograph them or leave them in an unencrypted cloud note.
- Document the loss procedure. Write down the provider’s official steps for a lost phone, lost key, changed phone number, or suspected compromise. Keep the old factor active until this procedure is understood and the replacement works.
- Revoke compromised factors. If a phone, key, password, or recovery code may have been exposed, use a trusted device to remove it, rotate passwords, invalidate sessions, and contact the institution through a verified channel.
What happens if you lose the key or phone?
Lost hardware key
If a backup key is enrolled, sign in with it, remove the missing key from the account, and register a replacement. If the lost key was protected by a PIN and you believe the PIN remains secret, the immediate risk is lower, but treat the loss as a security event. If it was the only factor, recovery depends on the provider’s identity checks; support cannot be assumed to bypass a phishing-resistant credential.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Lost or replaced phone
A TOTP account may be recoverable through a second enrolled device, an encrypted vendor backup, printed recovery codes, or the institution’s recovery process. Without one of those, the provider may require manual identity verification. Push approval accounts also require you to revoke the old phone so an unauthorized person cannot approve prompts.
Before deleting a factor
Keep the old phone or key active until the replacement has completed a real sign-in and, for crypto, a test of the security controls around withdrawals and account changes. Deleting the old factor first can turn a routine replacement into a lockout.
Quick Recap
Common failure modes and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| The TOTP code is rejected | Phone clock is out of sync, wrong account entry, or code entered after its time window. | Enable automatic date and time, confirm the correct account entry, and enter a fresh code. Do not repeatedly submit codes to an unfamiliar page. |
| The key is not detected | Unsupported browser, connector, NFC setting, USB adapter, or protocol. | Use the provider’s supported browser and operating system, try the other connector or NFC, and confirm whether the service requires FIDO2 rather than legacy U2F. |
| A push prompt arrives unexpectedly | Someone may have your password or is trying to fatigue you into approving. | Deny every unexpected request, change the password from a trusted device, revoke sessions, and contact the provider if the attempts continue. |
| Recovery codes are missing | They were never generated, were stored only on the lost device, or were already consumed. | Sign in with a working factor and generate a new set. If locked out, use only the institution’s official recovery channel. |
| Crypto withdrawal still succeeds after MFA | MFA protected login but not the destination, API key, email, or device used to approve the transaction. | Review API keys, email security, address whitelists, team approvals, active sessions, and the transaction details on a trusted device. |
Questions to ask before enrolling
- Does the service support an external FIDO2/WebAuthn key, or only a synced passkey?
- Which actions require the factor: login, withdrawals, transfers, adding addresses, changing the password, or changing permissions?
- Can two keys be enrolled, and can each team member have an individual credential?
- What is the official lost-factor recovery process, and how long can it take?
- Are recovery codes one-time, regenerable, and suitable for offline storage?
- Can weaker methods such as SMS remain enabled as an attacker-selectable fallback?
Bottom line for different readers
- Maximum phishing resistance: Use two enrolled FIDO2/WebAuthn hardware keys.
- Bank that offers only app MFA: Use a TOTP app, protect the phone, and store offline recovery codes.
- Crypto exchange supporting keys: Use the key for login and every sensitive action, then separately secure email, withdrawal controls, and any hardware wallet.
- Shared or multi-person access: Prefer individual keys or app enrollments supported by the service rather than sharing one code or device.
- Any setup: Test recovery before you need it and never approve an unexpected prompt or enter a code into a page reached from an unverified message.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
