Free tools Windows power users keep installed
One-click scans. No signup required.
Turn on multi-factor authentication (MFA) from each service’s Account, Profile, Privacy, or Security settings. Choose a FIDO2/WebAuthn security key when available, otherwise use an authenticator app; keep SMS or email codes as a fallback only. Protect your primary email first, then banking, payment, credit-card, and social-media accounts, and save recovery codes before you sign out.
What multi-factor authentication does
MFA requires at least two different kinds of proof before an account grants access. The first factor is usually something you know, such as a password. The second may be something you have, such as a registered phone, authenticator app, or hardware security key, or something you are, such as a fingerprint or face scan.
As an Amazon Associate I earn from qualifying purchases.
A stolen password alone therefore should not be enough to enter an MFA-protected account. MFA does not make phishing, malware, account-recovery fraud, or an already unlocked device harmless, but it substantially reduces the damage caused by password reuse and credential theft. Microsoft says almost every online service, including banks, personal email, and social networks, supports adding a second authentication step in account settings.
The Cybersecurity and Infrastructure Security Agency (CISA) describes FIDO/WebAuthn as “the only widely available phishing-resistant authentication.” For accounts that support it, a security key or passkey is the strongest choice. An authenticator app is the practical alternative for most people.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Which accounts to secure first
Start with accounts that can reset or financially affect your other accounts. The Federal Trade Commission recommends beginning with your bank, credit cards, email, social media, tax-filing website, and payment apps.
- Primary email: It commonly receives password-reset links and verification codes for other services.
- Banking and payment accounts: These can expose money, identity information, and transaction controls.
- Credit-card and investment accounts: Protect accounts that can create charges or move funds.
- Social-media accounts: They contain private conversations and can be used to impersonate you or attack your contacts.
- Tax, government, health, shopping, and work accounts: Enable MFA wherever the provider offers it.
Do not use an email account as the only recovery path for itself. Add an independent recovery method, such as a second authenticator device or a securely stored hardware key, when the provider permits it.
Choose the right MFA method
| Method | How it works | When to choose it | Important limitation |
|---|---|---|---|
| FIDO2/WebAuthn security key | You insert, tap, or wirelessly present a registered physical key during sign-in. | Best protection against phishing when the service supports security keys. Register a spare key if allowed. | You must keep the key available and protect the backup; losing every registered key can trigger account recovery. |
| Authenticator app with number matching | The app displays a number and you select or enter the same number in the sign-in prompt. | Strong general-purpose option when a security key is unavailable. | Never approve a prompt you did not start; an attacker may be trying to fatigue you into accepting one. |
| Authenticator app one-time code | The app generates a new time-based code, commonly changing every 30 seconds. | Useful fallback and works when cellular service is unavailable. | You must transfer or re-enroll the tokens when replacing a phone unless the provider supports a secure backup. |
| Passkey or biometric unlock | A device unlocks a cryptographic credential with a fingerprint, face scan, PIN, or local gesture. | Convenient on supported phones, computers, and managed accounts. | Keep another recovery method in case the device is lost, reset, or unavailable. |
| SMS or email code | The service sends a short code to your phone number or another email address. | Use only when stronger methods are not offered, or as a carefully protected fallback. | CISA considers text and email codes the weakest listed protection because of phishing, mailbox compromise, and SIM-swap exposure. |
Enabling two methods is usually safer than depending on one. A security key plus an authenticator app, or an authenticator app plus offline recovery codes, gives you a way back in if one method is lost.
Prepare before you enroll
- Use the provider’s address typed into your browser or its official mobile app. Do not begin from a link in an unsolicited email, text, direct message, or advertisement.
- Have the phone, authenticator app, or security key you intend to register with you.
- Make sure your account password is unique and not already exposed elsewhere. MFA is an additional barrier, not a substitute for a strong password.
- Arrange a secure place for single-use recovery codes. An encrypted password manager or a printed copy stored somewhere private is preferable to an unprotected screenshot in your photo library.
- Check that you can access an independent recovery method before removing an old phone or changing your number.
Enable MFA on your primary email
Secure email before other accounts because it is often the recovery channel for them. After enrollment, review signed-in devices, recovery addresses, forwarding rules, and third-party app access. Remove anything you do not recognize.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Google Account used by Gmail
- Sign in to Gmail, select your profile picture, and choose Manage your Google Account.
- Open Security, then find 2-Step Verification under the section for signing in to Google.
- Select Get started and confirm your password or existing sign-in check.
- Choose an authenticator app, passkey, security key, or another method offered for your account. Follow the on-screen enrollment and complete the test prompt.
- Open the recovery-code option and save the single-use codes offline. Add a second method before relying on one phone.
- Return to Security and inspect Your devices, recovery phone, recovery email, and third-party access. Sign out of unfamiliar sessions and update anything outdated.
Google’s labels and available methods can vary by account type, device, administrator policy, and country. If your Gmail address is managed by an employer or school, the administrator may control which factors are permitted.
Microsoft account used by Outlook.com
- Open your Microsoft account security page from Outlook.com by selecting your account menu and choosing the security or account-management link, or type the official Microsoft account address yourself.
- Choose Advanced security options or the equivalent Manage how I sign in area.
- Select Add a new way to sign in or verify, then choose Microsoft Authenticator, a passkey or security key, an authenticator code, or another available method.
- Complete the registration in the Authenticator app or with the hardware key. If number matching appears, approve only the number generated by the sign-in you started.
- Download or display recovery codes and store them offline. Add a second method before deleting an old phone or authenticator entry.
- Review recent activity, trusted devices, recovery addresses, and app passwords. Revoke sessions or credentials you do not recognize.
Work and school Microsoft accounts may show different labels or require administrator approval. Follow the organization’s security policy and do not remove a required work method.
Enable MFA on social-media accounts
Social platforms generally place the control under Security, Login, Password and security, or Two-factor authentication. CISA’s social-media guidance notes that Facebook, Twitter, and LinkedIn allow authenticator-app MFA through account settings. Instagram and many other platforms use similar menus.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- Open Settings & privacy, then Settings.
- Choose Accounts Center, followed by Password and security and Two-factor authentication.
- Select the account, choose an authenticator app or security key when offered, and follow the enrollment prompts.
- Save recovery codes, add a backup method, and review where you are logged in. End sessions you do not recognize.
- Open your profile, select the menu, and enter Accounts Center.
- Choose Password and security, then Two-factor authentication.
- Select your Instagram account and enroll an authenticator app, security key, or another available method.
- Store the recovery codes and inspect login activity. Remove unfamiliar devices before you finish.
- Select your profile picture, open Settings & Privacy, and choose Sign in & security.
- Open Two-step verification and select Set up or Turn on.
- Choose an authenticator app or another method offered for your account, verify it, and save the recovery information.
- Review active sessions and sign out of browsers or devices you cannot identify.
Menu wording changes as social apps redesign their interfaces. If you cannot find the setting, search the provider’s own help center for “two-factor authentication” from inside the signed-in account, rather than following a third-party link.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Enable MFA on banking, credit-card, and payment accounts
Banks and payment companies use different names and may apply stronger verification automatically for high-risk actions. Use the institution’s official website or app, not a message link. Never disclose a one-time code to a caller or support representative who contacted you first.
- Sign in through the address you typed yourself or the official app.
- Open Security, Login, Profile, Privacy, or a similarly named settings area.
- Look for Multi-factor authentication, Two-factor authentication, Two-step verification, Login verification, or Security key.
- Choose the strongest supported method. If the bank supports a security key, passkey, or authenticator app, prefer it over SMS. If it supports only text messages, enable that rather than leaving MFA off.
- Confirm alerts for new-device sign-ins, password changes, new payees, transfers, and card-not-present transactions where the institution provides them.
- Save recovery codes or the bank’s emergency recovery instructions. Keep a recovery route that does not depend solely on the same phone you could lose.
- Review devices, trusted browsers, linked apps, and contact details. Remove unfamiliar access and update an old phone number immediately.
A bank may require an additional verification step when you enroll a new factor or change contact information. That protects the account but can delay recovery, so keep your customer-service details and identity documents available through official channels.
How to use an authenticator app safely
Enrollment
During setup, the service displays a QR code or an alphanumeric setup key. Add it in the authenticator app, verify the current six-digit code, and finish enrollment before closing the provider’s page. If the service offers an encrypted cloud backup, understand what account protects that backup and secure that account with MFA too.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Number-matching prompts
A push notification may show a number that must be selected or entered. Compare the number and the service name with the sign-in you initiated. Reject and report any prompt that appears while you are not signing in. Repeated unsolicited prompts can indicate that someone already knows your password; change it and review sessions instead of approving one to make the notifications stop.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Time-based codes
Enter the current code before it expires, and make sure the phone’s date and time are set automatically. If codes fail repeatedly, check that you enrolled the correct account, that the device clock is synchronized, and that you are using the newest code rather than one already replaced. Do not send a code to anyone by phone, email, or chat.
Recovery: prevent a lockout
MFA is only as resilient as its recovery plan. Complete these tasks immediately after enrollment:
- Save recovery codes: Each code is normally single-use. Store them offline in a secure place and mark which account they belong to.
- Register a spare factor: A second security key or an authenticator on another controlled device can prevent a lost-phone lockout.
- Keep recovery independent: Do not make the same lost phone, compromised email inbox, or one device the only route back in.
- Test deliberately: Use a private browser or another device to confirm the new method works while your current session remains available.
- Update changes promptly: When you change phone numbers, replace a phone, reset a device, or leave an organization, add the new factor before deleting the old one.
- Record provider procedures: Some services require identity checks, a waiting period, or support contact when every factor is lost.
Do not store recovery codes in a public notes app, an unprotected document, or a message thread. Anyone who obtains them may be able to bypass the normal second-factor prompt.
After setup: audit the account
- Open the account’s signed-in-device or recent-activity page.
- Revoke devices, browsers, sessions, app passwords, and connected applications you do not recognize.
- Check recovery email addresses, phone numbers, forwarding rules, and authorized payment or transfer destinations.
- Confirm that security alerts go to an address or device you actively monitor.
- Repeat the audit after a suspected phishing attempt, password change, lost device, or unexpected MFA prompt.
Common problems and fixes
The MFA option is missing
Look in Account, Profile, Privacy, Security, Login, or Password settings. Search the provider’s official help center while signed in. A managed work, school, child, or regional account may have administrator or age restrictions.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
The QR code cannot be scanned
Choose the manual setup-key option, or display the code on another trusted screen. Never photograph or share the setup key; it can generate future authentication codes.
You lost the phone with the authenticator
Use a registered spare factor or a recovery code. If none is available, use the provider’s official account-recovery process from a familiar device and network. After regaining access, revoke the lost device and register a replacement.
You receive an unexpected approval request
Deny it, change the account password from a trusted device, inspect active sessions, and contact the provider if the requests continue. An unexpected prompt is not a harmless notification.
SMS codes never arrive
Check the number on file, cellular coverage, message filtering, and whether the carrier recently transferred the number. Use an authenticator app, security key, recovery code, or the provider’s official recovery route instead of repeatedly requesting codes. Contact the carrier and account provider through verified channels if you suspect a SIM swap.
You are asked for a code by a caller or message
Refuse. Legitimate support should not need a code that proves your identity to an unsolicited caller. End the conversation, open the service yourself, review activity, and report the attempt.
Security habits that make MFA effective
- Use a different, long password for every important account and keep passwords in a reputable password manager.
- Install operating-system, browser, and app updates so security fixes are applied.
- Use device screen locks and full-device encryption where available.
- Inspect the domain and app publisher before entering a password or MFA code.
- Do not approve a login merely because a prompt is repeated or appears urgent.
- Review account activity after travel, device repair, a number change, or a suspected phishing message.
The practical order of operations
If you want a short implementation plan, follow this sequence:
- Secure your primary email with a security key or authenticator app and save recovery codes.
- Secure banking, credit-card, payment, and tax accounts through their official apps or typed web addresses.
- Secure social-media accounts and review active sessions.
- Add a spare factor to every service that permits one.
- Replace SMS-only protection with a stronger method whenever the provider adds support for it.
- Schedule periodic checks of devices, recovery information, and MFA methods.
The strongest broadly available protection is FIDO/WebAuthn. Where a service does not offer it, an authenticator app is generally the next practical choice. SMS or email codes are still better than password-only access, but they should not be your preferred method when a stronger option is available.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
