Free tools Windows power users keep installed
One-click scans. No signup required.
For a personal Google Account, turn on two-step verification (2SV) from Google Account → Security & sign-in → How you sign in to Google → Turn on 2-Step Verification. Then add a passkey separately at Google’s passkey settings using a device you personally own and can unlock. Keep at least one recovery method—such as backup codes, another signed-in device, a second phone, or a spare security key—before depending on one phone or key.
2SV protects password sign-ins with an additional challenge. A passkey uses your device unlock—such as a fingerprint, face scan, PIN, or pattern—to prove possession of the device and can bypass the separate second step for that sign-in. Adding a passkey does not delete your existing password, recovery methods, or other authentication factors.
As an Amazon Associate I earn from qualifying purchases.
What 2-Step Verification and passkeys do
Two-step verification adds a check after your password when Google decides one is required. Depending on the sign-in context and the methods available on your account, that check can be a Google prompt, a code, a security key, or another challenge. The extra step makes a stolen password less useful on its own.
Recommended Free Tools
A passkey changes the sign-in flow rather than simply adding another code. Google verifies that you have the device holding the passkey and that you can unlock it. For that sign-in, Google says passkey authentication bypasses the separate second-authentication step normally used after a password. Your other sign-in and recovery options remain on the account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use a passkey only on a personal device that you control. Anyone who can successfully unlock that device may be able to use its passkey to access the account. Never create a passkey on a shared or publicly accessible computer.
Before you begin
- Sign in to the Google Account you want to protect.
- Have access to a phone, computer, authenticator app, security key, or other verification method that Google offers during setup.
- Make sure the device you will use for a passkey has screen lock enabled.
- Prepare a recovery route before changing sign-in settings. A second signed-in device, another phone number, a saved backup-code set, a passkey on another personal device, or an already-added hardware key can prevent lockout.
- If the account belongs to a company, school, or other organization, be prepared for administrator-controlled settings or a different setup path.
You do not need to buy a physical security key to use 2SV or device-based passkeys. A key is an optional method for people who specifically want a separate physical credential.
How to turn on 2-Step Verification
- Open your Google Account.
- Select Security & sign-in.
- Under How you sign in to Google, choose Turn on 2-Step Verification.
- Follow the on-screen prompts. Google will show the verification methods available for your account and may ask you to confirm an existing sign-in method before completing setup.
- After setup, review the available second steps and recovery options in the same security area. Add more than one route before signing out of devices you may need for recovery.
Once enabled, password-based sign-ins can require the additional verification step. Google chooses the challenge according to the sign-in situation, account settings, and methods you have enrolled, so the prompt may not look identical every time.
Google’s guidance says: If you choose not to sign in with a passkey, we recommend you use Google prompts as your second step.
— Google Account Help, “Turn on 2-Step Verification.”
Choose the right second step
| Method | Good fit | Important considerations |
|---|---|---|
| Passkey | Anyone who wants a device-unlock sign-in with phishing resistance | Passkey sign-in bypasses the separate second step for that sign-in. Use only a device you personally control; somebody who can unlock it may be able to access the account. |
| Google prompt | People who sign in with a password and have an eligible signed-in phone | Prompts arrive on eligible Android phones or iPhones with supported Google apps. Google recommends prompts instead of codes when you are not using a passkey. |
| FIDO2 security key | People who want a physical second step or a key-based passkey | Check FIDO2 support for passkey creation and verify the key’s connector and compatibility with each device. A spare stored securely can provide a fallback. |
| Authenticator app | People who need time-based codes without mobile service or text delivery | Google says these codes can be generated without an internet connection or mobile service. Keep another recovery route in case the phone is lost. |
| SMS or voice code | People who need a familiar phone-number-based option | Google warns that text and call codes can be vulnerable to phone-number-based attacks. Delivery can also vary by carrier and location. |
| Backup codes | People who need an offline recovery method | Each code works once. Creating a new set of 10 codes invalidates the previous set. Store the codes privately and never share them. |
How to create a passkey
- On a device you personally own, open Google Account passkey settings.
- Choose Create a passkey.
- Follow the prompts from your operating system or browser.
- Unlock the device with its screen lock—such as a fingerprint, face recognition, PIN, or pattern—to finish creating the passkey.
- Repeat the process on other personal devices if you want more than one passkey. Multiple passkeys reduce dependence on a single phone or computer.
On supported devices, biometric information is processed by the device. Google’s passkey guidance says biometric data “stays on your device and is never shared with Google.” The biometric check unlocks the local credential; Google does not receive the fingerprint or face data itself.
Passkeys can coexist with your password, prompts, codes, keys, and recovery methods. Creating one does not automatically enroll every other device, so add passkeys separately to the personal devices you expect to use.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Passkey requirements and compatibility
Google lists the following minimum operating-system, browser, and hardware requirements in its current passkey guidance:
| Component | Google-listed requirement |
|---|---|
| Windows computer | Windows 10 or later |
| Mac computer | macOS Ventura or later |
| Chromebook | ChromeOS 109 or later |
| Android phone or tablet | Android 9 or later |
| iPhone or iPad | iOS 16 or later |
| Hardware security key | FIDO2 protocol support is required to create a passkey on the key |
| Chrome | Version 109 or later |
| Safari | Version 16 or later |
| Microsoft Edge | Version 109 or later |
| Firefox | Version 122 or later |
- Screen lock must be enabled on the device that stores the passkey.
- To use a phone’s passkey to sign in on another computer, Bluetooth must be enabled so the devices can establish the required nearby-device connection.
- Apple devices require iCloud Keychain for passkey storage and synchronization.
- Some operating systems or browsers may not offer passkeys in Incognito mode.
- These are Google’s stated minimums, not a guarantee that every account policy, browser configuration, or device will present the same prompts. Keep the operating system and browser current.
Hardware compatibility is separate from software version. A security key may have USB-A, USB-C, NFC, or another connector, and a connector that does not fit your computer or phone can prevent use even when the key supports FIDO2. Check the devices on which you expect to sign in before choosing a key.
Signing in after setup
Using a passkey
At a Google sign-in page, choose the passkey option when it is offered, then unlock the device that stores the credential. If you are signing in on a different computer with a phone passkey, keep Bluetooth enabled and follow the nearby-device instructions.
Because the passkey itself verifies possession of the device and its local unlock, Google does not need to ask for the separate 2SV challenge for that passkey sign-in. This does not disable 2SV for password sign-ins or remove the account’s other credentials.
Using a password and a second step
Enter your password first. If Google requests 2SV, complete the prompt, code, security-key action, or other method shown on screen. The exact challenge can vary with the device, browser, location, and account-risk signals.
Returning to another sign-in method
If a passkey is unavailable or you prefer a different method, select Try another way on the sign-in screen. Google will show the alternative options that remain available for the account.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Recovery planning: prevent a lockout
Set up recovery before losing your primary phone, deleting an authenticator app, replacing a computer, or removing a security key. Google lists several possible alternatives:
- Another phone that is already signed in to the account
- Another phone number added to 2-Step Verification
- A saved backup code
- A hardware security key already added to the account
- A passkey stored on another personal device
- Google’s account-recovery process when the normal methods are unavailable
Think of recovery as redundancy, not as a single emergency number. A passkey on a phone that is left at home does not help when you are traveling unless another enrolled method is available. Likewise, storing backup codes only on the phone protected by 2SV defeats their purpose if that phone is lost. Keep at least one recovery option physically or digitally separate from your primary sign-in device.
Use backup codes correctly
Backup codes require 2-Step Verification to be enabled. Google provides a set of 10 codes; each used code becomes inactive. If you generate a new set, all codes from the previous set stop working. Print or write the current set and store it with other important documents in a private, secure place.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Never send a backup code to another person. Google says it will not ask for one except during sign-in. Treat an unused code like a password: do not post it in notes that sync to a shared account, and replace the set if you suspect someone has seen it.
Keep a spare physical key when appropriate
A FIDO2 security key is optional; you can enable 2SV and create device-based passkeys without buying hardware. If you choose a physical key, verify FIDO2 support for passkey creation, check the connector or wireless compatibility for your devices, and consider enrolling a spare that is stored securely and separately from the primary key.
Troubleshooting common problems
The passkey option does not appear
- Confirm that screen lock is enabled on the device.
- Check that the operating system and browser meet Google’s listed minimum versions.
- On Apple hardware, confirm that iCloud Keychain is enabled.
- If you are using a phone passkey on another computer, turn on Bluetooth on the devices.
- Try a normal browser window if you are in Incognito mode.
- Review the Skip password when possible setting in Google Account sign-in options. If passkey behavior is not what you expect, choose Try another way to use an available alternative.
Labels can change as Google updates its account pages. If the wording differs slightly, look for the current Security & sign-in, passkey, or sign-in-options controls rather than assuming the feature has been removed.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
You lost the phone that holds your passkey
Sign in from another device, then remove the lost phone’s credential from your Google Account and add a replacement passkey. If you still have access through another signed-in phone, backup code, security key, or passkey, use that route first. If no enrolled method works, follow Google’s account-recovery process.
You lost a security key
Use another enrolled method to sign in, remove the missing key from the account, and add a replacement. A spare key that was enrolled in advance can make this process much easier. Do not leave a lost key listed as an active credential when you can remove it.
You did not receive a verification code or prompt
- Choose Try another way and use a different enrolled method.
- Check whether another signed-in phone can receive a Google prompt.
- For SMS or voice delivery, remember that carrier and location can affect delivery.
- If you use an authenticator app, generate the code on the enrolled phone; an internet connection or mobile service is not required for the code itself.
- Do not repeatedly request codes and never share a code with anyone.
Google prompts are sent to eligible signed-in Android phones or to iPhones with supported Google apps. If a phone was signed out, reset, or replaced, it may no longer qualify as the prompt device until you sign in again and enroll another route.
Your organization account has different options
Work, school, and other group accounts can have administrator-controlled security policies. If the Turn on 2-Step Verification path is missing or a passkey is blocked, contact the organization’s administrator rather than trying to bypass its policy. An administrator may require a particular method, limit passkeys, or provide a separate enrollment process.
You use Advanced Protection
Advanced Protection can restrict available sign-in and recovery alternatives. Check the program’s specific Google recovery guidance before removing a device, key, or other credential. A method that is available on an ordinary account may not be available under the program’s stricter controls.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSecurity and privacy pitfalls to avoid
- Do not enroll shared devices. A passkey belongs on a device whose unlock you control. A family, library, hotel, or workplace computer can expose the account to the next person who can unlock it.
- Do not rely only on SMS. Google warns that text and voice codes can be vulnerable to phone-number-based attacks. Use prompts, an authenticator app, a security key, or passkeys where those options fit your situation.
- Do not remove the old method too early. Add and test a replacement passkey or key before deleting the credential for a phone or computer you are retiring.
- Do not share prompts or codes. A caller or message asking you to read a code or approve an unexpected prompt may be attempting to take over the account.
- Do not confuse a passkey with an extra password step. For a passkey sign-in, Google may bypass the separate 2SV challenge. Keep other recovery routes because the flow is different from password-plus-2SV.
A practical setup checklist
- Turn on 2-Step Verification from Security & sign-in.
- Prefer Google prompts over SMS or voice codes when you are signing in with a password and a prompt-capable phone is available.
- Create a passkey on each personal device you trust and can unlock.
- Generate and securely store the current set of 10 backup codes.
- Add a second recovery route, such as another signed-in device, phone number, passkey, or security key.
- Test Try another way before you need it, so you know which alternatives remain available.
- Remove credentials for devices or keys that are lost, sold, or no longer under your control.
- Keep browsers and operating systems updated, especially when a passkey prompt is missing.
Frequently Asked Questions
How do I sign in with a passkey instead of a password?
At the Google sign-in page, choose the passkey option when it appears and unlock the device that stores the passkey. If you use a phone to sign in on another computer, enable Bluetooth and follow the nearby-device instructions. Google verifies the device and its local unlock, so that sign-in can bypass the separate 2SV challenge.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
What if I lose my phone?
Use another signed-in phone, a saved backup code, an enrolled security key, or a passkey on another personal device. Once you regain access, remove the lost phone’s credential and add a replacement. If no enrolled method works, use Google’s account-recovery process.
Why didn’t I get a verification code?
Select Try another way and choose another enrolled method. SMS and voice delivery can vary by carrier and location. Authenticator-app codes do not require internet or mobile service, but the app must be on the enrolled phone. Never share a code.
Can I use a security key?
Yes. A FIDO2-compatible security key can serve as a 2SV method and, where supported, can hold a passkey. Check FIDO2 support and make sure the key’s connector or wireless capability matches your devices. Consider enrolling a spare and storing it securely.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Do I need to buy a security key to use passkeys?
No. You can create device-based passkeys on supported Windows, Mac, Chromebook, Android, and Apple devices without buying hardware. A physical key is optional and is useful when you want a separate credential or an additional fallback.
Does creating a passkey turn off two-step verification?
No. A passkey changes the flow for the sign-in where it is used and can bypass the separate second step. Password sign-ins can still require 2SV, and your other authentication and recovery methods remain on the account.
Can I use passkeys on an organization account?
Possibly, but work, school, and other group accounts can have administrator-controlled policies. If the passkey or 2SV option is missing, contact the organization administrator for its approved setup path.
The Bottom Line
Turn on 2-Step Verification in Security & sign-in, then create passkeys only on personal devices you can unlock. Prefer Google prompts to SMS or voice codes when using a password, and keep independent recovery options—especially a current set of 10 backup codes, another signed-in device, or a spare enrolled key. Remove credentials for devices you lose or no longer control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
