Free tools Windows power users keep installed
One-click scans. No signup required.
Set up a passkey or a second sign-in factor in each account’s security settings, then add and test a recovery option before you lose access to your phone or key. These are related but different protections: adding a passkey does not always turn on a separate second step, and using a passkey may replace a password and bypass a separate code prompt.
Passkeys and two-factor authentication are not the same thing
A passkey is a sign-in credential based on public-key cryptography. The account service stores a public key; the matching private key remains protected by your device or credential provider. You unlock the passkey locally, often with your device passcode, fingerprint, or face recognition. Because a passkey is associated with the service’s domain, it is designed to resist phishing.
As an Amazon Associate I earn from qualifying purchases.
Two-factor authentication (2FA) means proving your identity with two different types of evidence—for example, something you know, such as a password, and something you have, such as a security key or phone. Providers may call this “two-step verification.” A passkey is not a one-time code sent by text or email. Depending on the provider’s design, signing in with a passkey can replace the password and satisfy the possession and local-unlock checks without asking for another factor. So, “add a passkey” does not necessarily mean “turn on a second code.”
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf you continue to sign in with a password, enabling 2FA adds a further check. The available options vary by service, device, and account type.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose a sign-in method that fits your account
| Method | Phishing resistance | What to consider |
|---|---|---|
| Passkey | Designed to resist phishing because it is tied to the service’s domain. | Requires a supported service and a compatible device or credential provider. Recovery depends on how the passkey is stored and how you recover that provider account. Microsoft’s FAQ confirms that passkeys are phishing-resistant: Passkeys frequently asked questions. |
| FIDO security key | Designed to resist phishing. | Requires account enrollment and compatible connection support, such as USB or NFC. A spare key or another sign-in method can help if the key is lost. |
| Authenticator app or sign-in prompt | Varies by implementation; these methods are not all phishing-resistant. | Use them when offered and practical, and configure account recovery separately. |
| SMS code or phone call | Weaker against interception or relay than passkeys and FIDO keys. | Use only when stronger options are unavailable or as a fallback. CISA recommends migrating away from SMS-based MFA: Mobile Communications Best Practice Guidance. |
Prepare recovery before changing sign-in settings
Do not make a single phone, passkey provider, or physical key your only route into an important account. Before relying on a new method, add and test another option where the service supports it. That could be a second security key, a trusted phone number, a recovery contact, or another provider-approved method. Keep a spare key somewhere separate from your everyday key, and make sure your recovery contact details are current.
For synced passkeys, recovery may depend on regaining access to the account or service that syncs them. A physical key can be lost or damaged. Keep an existing sign-in method until you have confirmed that the new one works and that recovery is available; do not remove old access first.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Turn on Google Account 2-Step Verification
- Open your Google Account and go to Security & sign-in.
- Under How you sign in to Google, select Turn on 2-Step Verification.
- Follow the on-screen instructions to choose and enroll the options available for your account. Google’s current instructions are at Turn on 2-Step Verification.
- Add another sign-in or recovery option before depending on a single device or key.
Google distinguishes password sign-ins from passkey sign-ins: a password sign-in can require a second step, while a passkey sign-in can bypass that separate step because the passkey verifies possession of the device. Setting up 2-Step Verification therefore does not guarantee that every sign-in flow will ask for a separate code. See Google’s instructions for signing in with a passkey instead of a password.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Using a security key with Google
Enroll a compatible security key in your account and use it when prompted at sign-in. Google says FIDO1 or FIDO2 keys can serve as a second step; creating a passkey on the key requires a FIDO2-capable key. Check that the key works with your account, device, browser, and available port or connection. Google advises adding another way to prove it is you in case the key is lost: Use a security key for 2-Step Verification.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Google’s help guidance says a newly added key may take up to seven days to become trusted. It also says account recovery can take three to five business days when you cannot provide another second step or have forgotten your password. These are Google-specific timings and may change; consult the current account recovery instructions before relying on them.
Check Apple Account two-factor authentication
Apple says an Apple Account using iCloud Keychain requires two-factor authentication. When you sign in to a new device for the first time, Apple may ask for the account password and a six-digit verification code shown on a trusted device or sent to a trusted phone number. Apple also says that a person trying to register a passkey without two-factor authentication will be prompted to set it up. The exact prompts can depend on the device and software version, so use the security settings and current instructions for your Apple Account. Apple explains the passkey model in About the security of passkeys.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For Microsoft work or school accounts, follow organization policy
Microsoft 365 sign-in options may be controlled by your employer or school. Microsoft says an administrator must enable MFA before users can register a method for an organizational account. Depending on the organization’s policy, available methods may include an authenticator, passkey, SMS, phone call, or token. Follow your organization’s enrollment prompts; if an option is missing or enrollment is blocked, contact the administrator rather than trying to bypass the policy.
For a personal Microsoft account or another service, open that provider’s official security settings and help page to check which passkey and 2FA options are supported. Menu names and availability differ, and may change.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Verify the setup before you need it
- Test the passkey or second factor by signing out or using a private browser window, if practical, while keeping a working recovery route available.
- Confirm that you can access the email address and phone number listed for account recovery.
- For a hardware key, confirm it works on the devices you actually use and enroll a backup method or spare key where supported.
- Do not discard your old phone or remove your existing factor until the replacement method and recovery path both work.
- If an account is managed by work, school, or another organization, ask its administrator about its enrollment and recovery rules.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
