If a website or app does not support passkeys, use a unique password generated and stored by a password manager, turn on the strongest second factor the service offers, and secure your recovery options. A security key helps only when that service explicitly supports security-key sign-in.
Use a unique password stored in a password manager
Start from the service’s official app or type its web address yourself rather than following an unexpected sign-in link. If it requires a password, generate a different, strong password for that account with a password manager and use the manager’s autofill feature. Reusing a password means a breach at one service could put accounts elsewhere at risk.
As an Amazon Associate I earn from qualifying purchases.
NIST advises using a password manager for accounts that require passwords. Its SP 800-63-4 implementation FAQ says verifiers should allow password managers and autofill. If a sign-up or password-change form blocks autofill, check whether the service offers another way to set or update the password.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallProtect the password manager’s own sign-in, too. Use a strong, unique master password and enable the manager’s MFA if it offers it. Your stored credentials are only as safe as access to the vault.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Turn on MFA, choosing from the methods the service actually supports
In the account’s security settings, enable multi-factor authentication (MFA) if available. MFA adds a check beyond the password, but methods differ in phishing resistance, compatibility, and what happens if you lose access to a device.
| Method | What to consider |
|---|---|
| Password alone | NIST classifies passwords as not phishing-resistant. Use a unique password and add MFA when the service permits it. |
| SMS text code | Convenient when offered, but NIST describes text codes as particularly vulnerable compared with some alternatives. Prefer a stronger available option. |
| Other one-time passcodes | Common OTP methods are not phishing-resistant, according to NIST. They can still add a second check; use the service’s available options and account for recovery if the device is lost. |
| FIDO security key or another phishing-resistant method | Use it only if the particular service offers or accepts that method. Check compatibility with the service and the browser or operating system you use. |
These choices are not interchangeable, and a method’s availability varies by service. NIST’s current authenticator examples distinguish phishing-resistant methods from passwords and common OTP methods. No MFA method guarantees that an account cannot be compromised.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Know when a security key will—and will not—work
A physical FIDO security key is not a universal workaround for a service that lacks passkeys. FIDO describes external authenticators used with FIDO2-enabled browsers and operating systems, but the service must also support the relevant sign-in method. Look in the service’s security settings or help pages for explicit security-key support before relying on a key.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If the service offers a phishing-resistant option, consider using it. NIST identifies FIDO2 passkeys with user verification as phishing-resistant, but that does not mean every service that lacks passkeys accepts a security key.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Prepare recovery before you need it
Review the service’s account-recovery settings while you can still sign in. Keep recovery contact details current, and understand how to regain access if you lose your phone, authenticator, or key. Recovery methods and procedures differ by service.
If the service issues recovery codes, store them somewhere secure and, where practical, separate from the device you use to sign in. NIST defines a recovery code as a secret that can help a subscriber regain an account when unable to authenticate. Treat the codes as sensitive credentials: someone who obtains them may be able to use them to recover the account.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A practical setup checklist
- Open the official app or type the service’s address yourself.
- Set a unique password with a password manager; do not reuse another account’s password.
- Enable MFA in the service’s security settings and choose a stronger supported method over SMS when available.
- Use a security key only after confirming the service supports security-key authentication.
- Update recovery details and secure any recovery codes the service provides.
- Protect your password-manager account and enable its MFA if offered.
NIST’s current digital identity standard, SP 800-63B-4, was published on July 31, 2025, and supersedes the prior SP 800-63B. Its guidance and related resources can help explain authentication terminology, but the options you can use still depend on the individual service.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
