Free tools Windows power users keep installed
One-click scans. No signup required.
Use a password manager to create a different password for every account that still requires one, and protect the manager with a strong master passphrase and multifactor authentication (MFA) where available. Add passkeys to important accounts that support them, and make sure you understand how to recover access if you lose a device or vault.
Secure the accounts that can unlock the others first
Start with the email account you use to reset passwords: someone who controls it may be able to take over other accounts. Then protect financial and other high-impact accounts. Turn on MFA wherever it is offered. CISA recommends MFA for email, financial, social, online-store, gaming and streaming accounts, and identifies FIDO/WebAuthn authentication as phishing-resistant. CISA’s MFA guidance
As an Amazon Associate I earn from qualifying purchases.
When a service supports passkeys or another FIDO/WebAuthn sign-in, prefer that phishing-resistant option over less robust methods where practical. MFA methods differ: an SMS code, for example, is more exposed to interception or relay than FIDO/WebAuthn authentication. If the service does not offer a passkey or security key, use the strongest MFA option it does provide.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Set up a password manager for accounts that still use passwords
- Choose a reputable manager. Check that it supports the devices you use, offers MFA for the vault, and has a recovery process you understand.
- Create a long, memorable master passphrase. This is the credential protecting the vault, so do not reuse a password from another account. Enable the manager’s MFA if it is available.
- Replace reused passwords. Generate a unique password for each account that still requires one. NIST’s consumer guidance, updated August 20, 2025, recommends at least 15 characters when you must create a password. NIST password guidance
- Keep the vault recovery route current. Review the manager’s recovery options before you depend on it. Losing access to the vault can affect many accounts, and recovery designs vary by provider.
Add passkeys where services support them
A passkey is a cryptographic credential associated with a service. You unlock it locally, often with a device PIN, pattern or biometric, rather than memorizing and entering a site password. Passkeys are designed to resist phishing: authentication is tied to the legitimate service rather than relying on a password that can be typed into a lookalike page. NIST describes passkeys as a phishing-resistant option. NIST password guidance
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Open the account’s sign-in or security settings and look for an option to create or add a passkey.
- Choose where to save it, such as a device platform or compatible password manager, and note which account or device holds it.
- Check that the passkey can be used on your other devices, if needed. The sign-in flow depends on the service, device and credential manager.
- Test the passkey and confirm you retain an alternate sign-in or recovery method before removing any existing access method.
Passkeys are not supported by every site or app, so keep a password-manager-generated unique password for accounts that still require passwords. Google documents saving passkeys with Google Password Manager or compatible third-party managers on Android; exact support varies by service. Google’s passkey guidance
Plan for recovery and backup before you need them
Recovery is part of account security, not an afterthought. Keep each account’s recovery email or phone number current, and learn what happens if you lose the device or vault that stores your credentials. NIST notes that properly implemented syncable authenticators can support cross-device use and simplify recovery, while also warning that password-vault recovery can introduce risk. NIST guidance on syncable authenticators
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
If you use a physical security key, check that your important accounts support it and consider registering a compatible backup key. Google recommends primary and backup security keys for users of its Advanced Protection program. Its guidance says users who still have account access can add a replacement key and remove a lost one; those without access must use account recovery. Google Advanced Protection security-key guidance
Test an alternate sign-in and recovery route while you can still access the account. Recovery steps differ by provider, so verify the procedure for each important account rather than assuming one service’s process applies everywhere.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose the sign-in method that fits each account
| Method | Best fit | Trade-off to check |
|---|---|---|
| Password manager with unique passwords | Accounts that have not added passkey support | Vault access and recovery affect many logins; protect the vault with a strong passphrase and MFA where available. |
| Passkey | Services that support it and devices or managers where you can reliably access it | Confirm where it is saved, whether it works across your devices, and what recovery options remain. |
| FIDO/WebAuthn security key | Accounts that support phishing-resistant hardware authentication | Compatibility varies; register a backup key where appropriate and keep it secure. |
| Other MFA, such as SMS | Accounts without stronger supported options | It provides an additional check but is more exposed to interception or relay than FIDO/WebAuthn. |
These approaches can work together: a passkey for an account that supports it, unique manager-generated passwords for the rest, and a recovery plan for both the vault and individual services.
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
