Recommended Free Tools
A passkey is a cryptographic sign-in credential, not a password saved under another name. A website keeps a public key; your authenticator uses the matching private key to answer a one-time challenge. WebAuthn is the web standard that lets a site ask the browser and authenticator to do this. Whether a passkey follows you to a replacement phone depends on whether it is synced through a provider or bound to a single device.
How do passkeys work?
A passkey uses a public–private key pair. When you register one, the authenticator creates or manages the pair for a particular website or service. The service stores the public key, while the private key remains with the authenticator. At sign-in, the service sends a challenge; after you approve, the authenticator signs it with the private key. The service checks that signature against the public key associated with your account. It does not receive a reusable password or the private key. W3C Web Authentication Level 3 and the FIDO specifications describe this model.
As an Amazon Associate I earn from qualifying purchases.
WebAuthn is the web API through which a website asks the browser to create or use a public-key credential. The browser mediates access to the authenticator, which might be built into a phone or computer or be a separate security key. As W3C puts it, “The user agent mediates access to authenticators and their public key credentials in order to preserve user privacy.”
Your fingerprint or face scan is generally an approval gesture handled on your device, not biometric information sent to the website. A passkey can also be approved another way, depending on the authenticator. The term does not mean that every passkey lives on a phone or uses biometrics.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why are passkeys resistant to phishing?
A passkey is scoped to the website’s relying-party identity. The browser and authenticator use that identity in the credential flow, so a passkey for the genuine site is not a secret you can simply type into a lookalike page. That domain binding is the central phishing-resistance feature: unlike a password, the credential is not a reusable string for a scammer to collect and replay.
FIDO describes passkeys as phishing-resistant whether or not they are hardware-bound. Syncing and phishing resistance solve different problems: syncing affects which devices can access a credential, while relying-party binding protects the sign-in interaction from a counterfeit site. FIDO’s passkeys overview explains both credential types.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
“Phishing-resistant” does not mean every route to account takeover is impossible. It describes protection against the credential being used on the wrong site; it does not, by itself, settle risks involving a compromised device, account recovery, social engineering, or a service’s account processes.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCan I move my passkeys to a new phone?
It depends on the type of passkey. A synced passkey may be available on another device through the same passkey provider. A device-bound passkey stays with its authenticator and does not automatically transfer to replacement hardware. There is no universal, provider-independent export or migration process established for every passkey.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| What to compare | Synced passkey | Device-bound passkey |
|---|---|---|
| Access on another or replacement device | May be available through the same provider’s sync service; behavior depends on the provider and your account and devices. | Does not automatically move with the authenticator. |
| If one device is lost | Sync may provide another way to access the credential, subject to provider and account access. | You need another registered authenticator or the service’s account-recovery process. |
| What access depends on | The provider’s availability and your access to its account. | The physical or device authenticator, plus the service’s account-recovery options. |
| Phishing resistance | FIDO describes passkeys as phishing-resistant. | FIDO describes passkeys as phishing-resistant; hardware binding is not required for that protection. |
A useful way to picture the difference is a credential that is backed up through a credential provider versus one that stays on a particular device or physical key. A FIDO2 security key is one example of a physical authenticator that can hold device-bound passkeys; it is optional, not a requirement for using passkeys.
What happens if I lose my phone?
If the passkey was synced, access on another device may depend on signing in to the same provider account and on that provider’s sync and recovery arrangements. If it was device-bound to the lost phone, the credential itself will not follow you. You will need another authenticator already registered with the service or the service’s account-recovery process.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before relying on a device-bound passkey, register a second authenticator where the service allows it and learn how that service handles account recovery. W3C’s WebAuthn guidance warns that single-device credentials are not resilient to losing that device and points to additional authenticators or recovery as ways to plan for the risk.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Does signing in on a new device move the passkey?
No. Signing in from a new device with a nearby phone or security key is a cross-device sign-in flow, not necessarily a transfer of the credential onto the new device. FIDO describes this as a separate flow involving CTAP and Bluetooth proximity verification. The authenticator can approve the sign-in while remaining the device that holds the passkey. Whether the credential itself becomes available on the new device depends on its type and provider.
Best Value
- FIDO2/Passkey Authentication – Secure, passwordless login with supported platforms. Check if your intended service supports hardware keys before purchase. Works with Gmail, Facebook, GitHub, Dropbox, and more.
- Enhanced Multi-Factor Authentication (MFA): Strengthen account security using either FIDO2.0 authentication or TOTP/HOTP codes, providing flexible options for added protection.
- Universal Connectivity: Features USB-A and NFC compatibility, making it easy to use across various devices including PCs, Macs, iPhones, and Android phones for seamless integration.
- Durable & Portable Design: Built with a 360° rotating metal cover for extra durability. Compact and lightweight, it easily attaches to a keychain for on-the-go convenience. No batteries or network required, ensuring dependable use anywhere.
- FIDO Certified & Business-Ready: Certified for FIDO standards and supported by a range of management software suites, ideal for both individual users and enterprise deployment.
What is WebAuthn’s current standards status?
As of 5 October 2026, W3C identifies Web Authentication Level 3 as a Recommendation, published on 25 August 2026. The Level 4 page identifies it as a First Public Working Draft dated 15 September 2026, not a Recommendation. These are standards milestones, not a guarantee that every site, browser, or authenticator implements every feature in the same way. See the Level 3 Recommendation and W3C’s Level 4 draft.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
