Recommended Free Tools
Start with your email and other high-impact accounts: turn on multifactor authentication (MFA), then choose a passkey or another phishing-resistant FIDO/WebAuthn option when the service offers one. If it does not, use the strongest available alternative and check the service’s official recovery instructions before changing or replacing devices.
Why MFA matters—and what it can and cannot do
MFA requires two or more different authenticators to verify a sign-in. Adding a second factor can frustrate someone who has obtained your password, because the password alone is no longer enough to access the account. MFA is an extra layer, not a guarantee: account security still depends on the methods a service offers and how you protect your sign-in and recovery options. CISA explains MFA in its phishing-resistant MFA guidance.
As an Amazon Associate I earn from qualifying purchases.
Secure important accounts first
Prioritize accounts that could help someone take over other services or expose sensitive information. Start with your primary email, then secure financial services, social accounts, online stores, and gaming or streaming accounts. Email deserves early attention because it is often involved in account recovery elsewhere.
- Sign in to the account and open its security settings.
- Look for “MFA,” “two-factor authentication,” or “two-step verification.” Services may use different labels.
- Turn on the feature and choose the strongest method the service supports and you can use reliably.
- Follow that service’s official instructions for recovery before changing devices or removing an authentication method.
CISA’s consumer guidance, “More than a Password,” recommends using MFA on accounts and describes common options.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose the strongest method the service supports
When available, prefer a passkey or another FIDO/WebAuthn method. CISA says FIDO can prevent a user from being tricked into authenticating on a fake website. That phishing resistance does not make every kind of account attack impossible. If a service does not offer phishing-resistant sign-in, use its best available alternative rather than leaving MFA off.
| Method | How to think about it |
|---|---|
| Passkey or other FIDO/WebAuthn authentication | Prefer it where supported. CISA identifies FIDO as phishing-resistant; it does not prevent every possible account compromise. |
| Physical security key | A strong optional hardware authenticator. Check that both the account and your device support the key before buying or relying on it. CISA names YubiKey as an example, not as a requirement. |
| Number-matching prompt in an authentication app | A useful fallback or interim improvement when phishing-resistant authentication is unavailable. CISA identifies number matching as preferable to ordinary push approval in that situation. |
| App-generated one-time code | CISA’s business guidance places app-generated codes above text or email codes in its method ordering. Follow the service’s setup and recovery instructions. |
| Biometric authentication | An option CISA lists; biometrics are usually device-specific, so a local biometric unlock should not be assumed to work as a universal sign-in method across services. |
| Text or email code | Use it if stronger choices are unavailable, but recognize it as a weaker option in CISA’s ordering. |
The ordering in this table reflects CISA’s business MFA guidance, not a universal ranking for every configuration. CISA’s “Require Multifactor Authentication” guidance discusses physical security keys, number matching, app-generated codes, biometrics, and text or email codes. Availability and setup vary by service, so check the choices offered in that account’s security settings.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Passkeys, security keys, and your account recovery plan
A passkey is a sign-in option in the FIDO/WebAuthn family. It is not the same thing as buying a physical security key: use a passkey if the service offers it, and consider a physical key only if it fits your account and device setup. CISA and the FBI call for phishing-resistant MFA in their January 2025 product security guidance.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Before you switch phones, replace a device, or remove an old sign-in method, read the account provider’s current recovery instructions. Enrollment, synchronization, device replacement, and recovery steps are provider-specific; do not assume that a method available on one service works the same way on another. If you are considering a hardware key, verify compatibility with both the service and your device before purchasing it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If a passkey is not available
Turn on MFA anyway. Choose number matching in an authentication app if offered; otherwise, use an app-generated code or another available method ahead of text or email codes when the service permits. CISA identifies number matching as a possible interim improvement over ordinary push approval and SMS-based attacks. The available options and their protections depend on the service.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
