Free tools Windows power users keep installed
One-click scans. No signup required.
Use a FIDO2/WebAuthn hardware security key whenever the account supports one. It provides the strongest broadly available fallback to a passkey because the login uses cryptography and is designed to resist phishing. If security keys are unavailable, use a unique password stored in a password manager and add the strongest second factor offered—prefer an authenticator app or number-matched push approval over SMS. Keep recovery codes and a second recovery method ready before you lose access.
Choose the strongest method the account actually supports
Passkeys are not the only way to secure an account, but the alternatives differ sharply in how they handle phishing, stolen phones, lost devices and account recovery. The practical order is:
As an Amazon Associate I earn from qualifying purchases.
- FIDO2/WebAuthn hardware security key, if the service supports security-key enrollment.
- Another cryptographic authenticator, such as a platform authenticator built into a supported phone or computer.
- Authenticator-app TOTP or a well-designed push approval, when cryptographic options are unavailable.
- Password manager plus a unique password for the account, protected with strong vault security.
- SMS or voice codes only when no stronger method is available.
Recovery codes are important alongside these methods, but they are emergency credentials, not a daily sign-in factor. Your choice is constrained by the website, its account edition, the browser, your device and any required USB or NFC connection.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to check what an account supports
Do not assume that “passkeys unavailable” means “no phishing-resistant option.” Services sometimes expose security keys under a separate label.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Sign in and open Account settings, Security, or Privacy and security.
- Open Two-factor authentication, MFA, Login methods, or Security keys.
- Look for labels such as FIDO2, WebAuthn, hardware key, USB key, or NFC security key. A button that says “add security key” is usually separate from a passkey menu.
- Check whether the service requires a particular browser, mobile operating system, connector type or administrator policy.
- Before changing your only factor, confirm that the account offers recovery codes or another method you can use if the first device is lost.
If the service offers only passwords, authenticator codes, push prompts, SMS or email links, select the strongest combination available rather than enabling every method indiscriminately. Additional weak fallbacks can become the easiest way for an attacker to bypass a stronger primary factor.
FIDO2/WebAuthn hardware security keys
Why a security key is the preferred fallback
A FIDO2/WebAuthn key creates a cryptographic credential for the specific website. During sign-in, the key verifies the site’s origin instead of asking you to type a reusable secret into a page. That origin binding is why NIST’s February 2024 guidance describes FIDO authenticators paired with WebAuthn as widely available phishing-resistant authenticators. CISA likewise identifies a physical security key, such as a YubiKey, as an MFA option and describes it as offering the best phishing protection among the choices in its guidance.
A fake login page can still persuade someone to type a password or read a one-time code aloud. It generally cannot make a WebAuthn key produce a valid response for the attacker’s different domain. This protects against ordinary credential phishing and many real-time relay attacks.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Compatibility and daily-use trade-offs
- The account must implement FIDO2/WebAuthn security-key enrollment; a password-only service cannot be upgraded from your side.
- Your browser and operating system must support the service’s implementation.
- The key may connect through USB, NFC or another interface. A phone without the right connector may need NFC or an adapter.
- You must carry the key or keep it where you can reach it. That small inconvenience is the trade-off for stronger protection.
- Some services ask for a PIN or a touch on the key, while others combine it with a password.
Enroll two keys, not one
Register a primary key and a second key while you are still signed in. Keep the spare in a separate secure location, such as a locked drawer or another physical site. If the service allows multiple credentials, give each a recognizable name and record where it is stored. A second key prevents a single lost, damaged or forgotten device from becoming an account-lockout event.
Recovery precautions
Save the service’s recovery codes before removing an old factor or changing phones. Test the spare key and the recovery route deliberately, using a private browser window or another device if the service permits it. Do not store the only copy of recovery information in the same bag as the key it is meant to replace.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Platform authenticators and other cryptographic options
A platform authenticator uses the secure hardware or operating-system features already built into a phone, tablet or computer. When it is implemented through FIDO/WebAuthn, it has the same phishing-resistant property as a separate key. The user experience is usually easier: unlock the device with a fingerprint, face scan or device PIN rather than insert a token.
The limitation is portability and recovery. A credential tied to one device may not be available on a replacement device, and a broken or wiped device can remove your only sign-in route. Enroll a second supported authenticator, a hardware key, or another approved recovery method before relying on it as your sole factor. Device backup and synchronization behavior varies by service and operating system; do not infer that a credential will automatically appear on a new device.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Authenticator-app TOTP codes
What TOTP improves
Time-based one-time passwords (TOTP) are generated by an authenticator app from a secret enrolled with the account. Each code expires quickly, so a stolen code is less useful later than a stolen password. TOTP is broadly supported and is generally a better choice than SMS when a security key is not available.
Why TOTP is not phishing-resistant
You manually read the code from the app and type it into a website. NIST warns that manually entered OTPs are not phishing-resistant because an impostor verifier can relay the code to the real service in real time. A convincing fake page can request the current six-digit value and pass it through immediately.
Use TOTP as a meaningful improvement over password-only access, but do not treat it as equivalent to WebAuthn. Never enter an authenticator code into a page reached through an unsolicited email, text or pop-up. Open the service from a saved bookmark or type its known address yourself.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Back up the authenticator safely
- Use the provider’s supported encrypted backup or transfer feature if one exists.
- Keep recovery codes offline in a protected location.
- When the service permits several authenticators, enroll a second device before replacing the first.
- Check that your phone’s time is set automatically; substantial clock drift can make valid TOTP codes fail.
- Do not photograph setup QR codes or leave the enrollment secret in an unprotected notes app.
Push approvals and number matching
Push MFA sends an approval request to an enrolled app. It is convenient, but its security depends on the provider’s controls. Repeated unexpected prompts can lead to “push fatigue,” where a tired or hurried user eventually approves one.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPrefer a service that displays a number on the login screen and asks you to select or enter the same number in the app. Number matching gives you a useful signal that the request you are approving corresponds to your current sign-in. It does not make every push system phishing-proof, so reject prompts you did not initiate and report a suspicious burst of requests.
Keep another factor enrolled. A push-only account can become inaccessible when the phone is lost, reset or offline, and an attacker who obtains the phone’s unlock access may be able to approve prompts.
Password manager plus a unique password
Why this is the baseline for password-only services
When a service supports no stronger factor, create a random, unique password and store it in a reputable password manager. NIST’s password guidance highly recommends password managers for accounts that require passwords. Unique generated passwords prevent a breach at one service from unlocking another account through password reuse.
NIST also states that passwords are not phishing-resistant. A password manager reduces typing and reuse, but it cannot change the fact that a user can be tricked into submitting a password to a fraudulent site. Use the manager’s domain matching or autofill warning features, and avoid pasting credentials into pages whose address you have not verified.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Protect the vault
- Choose a long, memorable master passphrase that you do not use anywhere else.
- Turn on MFA for the password-manager account, using a security key or authenticator app when supported.
- Secure recovery information separately from the device that normally unlocks the vault.
- Keep the manager and its browser extension updated through the vendor’s normal update channel.
- Plan for a lost phone or computer so you can reach the vault without weakening its master protection.
Vault compromise has a large blast radius: an attacker who gains access can read many stored credentials. That is why vault MFA, a strong master passphrase and careful recovery planning matter as much as the individual website password.
SMS and voice one-time codes
SMS or voice OTP is common because almost every account can send a message or call. It is the lowest-ranked fallback in this guide, not because it offers no benefit, but because the phone number and delivery channel can be attacked. Number-porting fraud, SIM-swap attacks, intercepted messages, malware on the phone and poor cellular coverage can all interfere with the process.
NIST classifies PSTN-based out-of-band authentication as restricted. Treat it as a temporary or last-resort method when the service offers nothing stronger. If SMS is your only option, use it rather than leaving the account unprotected, then check periodically whether the service has added security-key, authenticator-app or push support.
Do not disclose a received code to someone who calls or messages claiming to be support. Legitimate support should not need the one-time value generated for your login.
Recovery codes: an emergency path, not a second daily password
Recovery codes are one-time secrets issued by the service. They can restore access when a key, phone or authenticator is unavailable, but anyone who obtains an unused code may be able to bypass your normal factor. Generate them from the account’s security page, download or print them, and store them offline where unauthorized people cannot read them.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Keep the codes separate from your everyday phone and from a hardware key’s carrying case.
- Do not store the only copy inside the account it is meant to recover.
- Mark a code as used immediately after a recovery event and regenerate the set if the service supports that option.
- Replace the set after a suspected disclosure, lost wallet or shared-device exposure.
Comparison of passkey alternatives
| Method | Phishing protection | Compatibility | Recovery and usability |
|---|---|---|---|
| FIDO2/WebAuthn hardware key | Highest among broadly available fallbacks; cryptographic and phishing-resistant | Requires account, browser and connector support for security keys | Carry the key; enroll a second key and save recovery codes |
| Platform or other cryptographic authenticator | Phishing-resistant when implemented through FIDO/WebAuthn | Depends on the service and device | Easy daily use; device loss requires a backup route |
| Authenticator-app TOTP | Better than password-only access, but manually entered codes can be phished | Widely supported; needs an enrolled app and usable device clock | Back up the app where supported and retain recovery codes |
| Push approval | Varies by provider; stronger with number matching and anti-fatigue controls | Service-specific | Convenient; reject unexpected prompts and keep a backup factor |
| Password plus password manager | Unique passwords reduce reuse and breach impact, but passwords are not phishing-resistant | Nearly universal where passwords are accepted | Protect the vault with a long master passphrase and MFA |
| SMS or voice OTP | Lowest fallback choice; PSTN authentication is restricted by NIST | Very common | Exposed to phone-number and delivery risks; use only when stronger methods are absent |
| Recovery codes | Emergency recovery secret, not a routine login method | Only where the service issues them | Store offline and protect from unauthorized access |
Recommended setup when passkeys are unavailable
- Inventory the account’s methods. Write down whether it offers security keys, another WebAuthn option, TOTP, push, SMS, email recovery and recovery codes.
- Enroll two hardware keys if available. Register both during the same signed-in session, test each, and keep them in separate secure places.
- Otherwise create a unique password. Generate it in your password manager rather than adapting a familiar phrase.
- Add the strongest second factor. Choose a cryptographic authenticator first, then TOTP or number-matched push, and SMS only if those are absent.
- Generate recovery codes. Save them offline before removing an old phone, deleting an authenticator or changing the password.
- Test recovery without destroying your access. Confirm that the spare key, backup authenticator or recovery-code flow is visible and usable. Do not sign out of every device until you know the fallback works.
- Review weaker fallbacks. Disable SMS, voice or email sign-in only after confirming that another recovery route remains. Some services silently require a weaker method for account recovery, so check the consequences first.
What to do when a factor is lost or compromised
You lose a hardware key
Sign in with the spare key or another enrolled factor, remove the missing key from the account’s security settings, and register a replacement. If you cannot sign in, use an unused recovery code or the service’s documented identity-recovery process. Do not leave a lost key enrolled merely because it was protected by a PIN; assume it could eventually be found and attacked.
You lose or replace your phone
Use a second authenticator, a hardware key or a recovery code to sign in before wiping the old device. Re-enroll the new phone, verify that push notifications and TOTP codes work, and then revoke the old device session. If the old phone may be in someone else’s possession, change the account password and revoke its sessions as soon as possible.
Your phone number is transferred or stops working
Use a non-SMS factor to access the account, replace the number-based method and contact the carrier through its official channel. Review other accounts that use the same number for authentication. A phone-number takeover can affect several services, so do not wait for every SMS code to fail before acting.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsYou approve an unexpected push or enter credentials on a fake page
Stop approving prompts, change the affected password from the genuine service, revoke active sessions, remove unknown authenticators and regenerate recovery codes. If a security key is enrolled, use it for the next sign-in. Check email-forwarding rules, recovery addresses and recent account activity for changes an attacker may have made.
Common mistakes that weaken the fallback
- Enrolling only one factor: A perfect method still fails if its only device is lost. Add a spare before you need it.
- Leaving every fallback enabled: An attacker may choose the weakest route. Keep a recovery path, but remove methods you no longer need when the service allows it.
- Reusing a password around MFA: A reused password can open another account where the attacker has a different or weaker second factor.
- Approving an unexpected notification: Push fatigue turns convenience into a liability. Reject and report unrequested prompts.
- Storing recovery codes in the account itself: That does not help when the account is locked. Keep an offline copy.
- Assuming TOTP is phishing-proof: A current code can still be relayed. Verify the site before entering it.
- Failing to test a backup: Discovering that a spare key, backup app or recovery code is unusable during an emergency is too late. Test while your primary method works.
How to decide for different account types
High-value email, financial and administrator accounts
Use two hardware keys or a hardware key plus another cryptographic authenticator when supported. Email accounts deserve particular care because control of an inbox can enable password resets for other services. Review recovery addresses, active sessions and forwarding rules after any security incident.
Everyday services with TOTP support
Use a unique password from your manager, enroll TOTP and store recovery codes offline. Upgrade to a security key if the service later adds WebAuthn support.
Legacy services that offer only SMS
Use a unique password and SMS rather than password-only access, but treat the account as having a weaker security boundary. Avoid reusing that password elsewhere, keep the phone number under carrier account protection, and check for stronger methods after major service updates.
Bottom line
For an account without passkeys, a FIDO2/WebAuthn hardware key is the best alternative when the service supports it. Enroll a second key and preserve recovery codes. If the account cannot use a security key, combine a password-manager-generated unique password with an authenticator app or number-matched push approval. Use SMS or voice codes only as a last resort, and keep a tested recovery path for every factor you depend on.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
