Use passkeys or FIDO/WebAuthn security keys on important accounts wherever they’re supported, starting with your primary email and accounts that can reset other passwords. Then check the account’s recovery methods: adding a passkey does not necessarily remove SMS, email, or other fallback routes that may be easier to exploit.
Why passkeys help against phishing
A passkey is a cryptographic credential associated with a particular website or app. The service stores a public key; the private key stays with your device or passkey provider. Your device’s PIN or biometric authorizes use of the credential locally—it is not biometric data sent to the website. Because authentication is tied to the legitimate service, a lookalike site cannot simply collect a reusable passkey secret.
As an Amazon Associate I earn from qualifying purchases.
CISA says, “The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.” CISA’s MFA guidance distinguishes FIDO authentication from SMS codes, authenticator codes, and push approvals, which can improve security over no MFA but are not phishing-resistant.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Which accounts to secure first
Prioritize accounts by how much damage someone could do with access—and by whether they can be used to regain access to other accounts.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Primary email and identity-provider accounts: secure the mailbox and accounts such as Google, Apple, or Microsoft that may control sign-in or password resets elsewhere.
- Financial accounts: protect banking, payment, and investment access.
- Cloud storage, social profiles, and work accounts: secure valuable files, public identities, and workplace access.
CISA recommends identifying valuable accounts and using FIDO-based authentication for key accounts where feasible. An inventory helps reveal accounts you might otherwise overlook, including an old email address still used for password recovery.
Choose a passkey or another MFA method
| Method | Phishing resistance | Portability and recovery | When it makes sense |
|---|---|---|---|
| Synced passkey | Phishing-resistant when correctly implemented | Can sync across supported devices; recovery depends in part on the passkey provider and its account protections. | A convenient choice for many personal accounts if you understand how the provider restores access. NIST says correctly implemented syncable authenticators can provide phishing resistance along with recovery and cross-device benefits: NIST’s April 23, 2024 announcement. |
| Device-bound passkey on a FIDO2 security key | Phishing-resistant when correctly implemented | Stays with the physical key; a spare key or the service’s recovery route matters. | Useful if you want a separate physical credential or need to use different devices. Confirm each service supports the key. |
| Authenticator-app code or number-matching push | Not phishing-resistant according to CISA | Depends on the app, device, and recovery options. | An interim choice when FIDO is unavailable. Do not approve unexpected prompts. |
| SMS code | Not phishing-resistant; vulnerable to phishing and risks such as SIM swapping or telecom interception | Depends on continued access to the phone number and the service’s recovery rules. | Use only when stronger methods are unavailable, and remove it as a fallback only after safer recovery is verified. |
FIDO Alliance describes passkeys as phishing-resistant and explains the difference between synced and device-bound credentials in its passkey overview. FIDO recommends retaining an alternative authentication or recovery method even when using synced credentials. Its consumer use-case page reports passkey sign-ins are “up to 75% faster” and “20% more successful” than passwords or passwords plus a second factor such as SMS OTP; the page does not state the underlying study details, so treat those as FIDO’s reported figures rather than a universal result: FIDO Alliance consumer passkey use cases.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Set up passkeys without creating a lockout
- Open the account’s security or sign-in settings. Look for labels such as “Passkeys,” “Security keys,” “FIDO,” “WebAuthn,” “MFA,” or “two-step verification.” Names and options vary by service.
- Choose a personal device or compatible security key. Do not create a passkey on a shared device. Follow the provider’s verification flow and check that the new method appears in the account’s security settings.
- Enroll a backup or confirm recovery. Add another passkey or spare key when practical, or confirm how the passkey provider’s recovery process works. Keep a physical spare separate and secure.
- Review fallback methods and account access. Check recovery email and phone, backup codes, active sessions, and fallback MFA. Do not delete the only recovery route until you have confirmed another works. If the service permits, disable SMS fallback once a safer alternative has been tested.
- Repeat for the next high-impact account. Work down your inventory, including accounts that can reset credentials or authenticate you to other services.
Google documents passkey support for recent Windows, macOS, ChromeOS, Android, and iOS devices, but device and browser requirements can change. Check the service’s current requirements before setup. Google also says a passkey can replace the second step on a Google Account with 2-Step Verification, while creating one does not remove existing authentication or recovery factors. Check the account’s settings rather than assuming enrollment disables SMS or other fallbacks: Google Account Help on passkeys.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Plan for a lost device or security key
A device-bound passkey may be unavailable if its device or physical key is lost. A spare credential or the service’s recovery route can restore access, but the exact process varies. Synced passkeys can be available on supported devices through the provider, so recovery also depends on protecting that provider account.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Recovery can have different requirements from ordinary sign-in. For example, Apple’s documentation describes iCloud Keychain recovery that may involve an Apple Account password, a registered phone number, and a device passcode. That is Apple’s process, not a universal passkey rule; check your provider’s current recovery instructions and keep its contact details current: Apple Support on iCloud Keychain security.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when a service does not support passkeys
Enable the strongest MFA the service offers. If FIDO/WebAuthn is unavailable, an authenticator-app code or number-matching push is a better interim choice than plain SMS under CISA’s guidance, but neither is phishing-resistant. Treat unexpected push prompts as suspicious and never share a one-time code with someone who contacts you. Use SMS only when stronger methods are not offered.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A hardware security key is optional, not a prerequisite. It can provide phishing-resistant authentication and act as a spare credential on compatible services, but check support and enroll a backup or recovery method before relying on it. CISA names YubiKey as an example of a security key; the example is not an endorsement: CISA’s MFA options and guidance.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
