What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Passkeys and two-factor authentication (2FA) protect accounts in different ways. A passkey replaces the password sign-in step with a FIDO2 credential unlocked on your device, while “2FA” describes an extra check added after a password. A passkey that verifies you with a PIN, fingerprint or face recognition can provide multi-factor assurance by itself, and FIDO2 is designed to resist phishing. SMS codes, authenticator-app codes and approval prompts are still useful, but they do not provide the same protection. The practical answer is to use a passkey or another FIDO authenticator whenever a service supports it, then keep a strong unique password and the strongest available second factor for services that do not.
This guide explains what each method proves, where recovery and cross-device sign-in fit, and how to choose a safe fallback.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →At a glance
| Name | Best for | Key spec | Platforms | Checked |
|---|---|---|---|---|
| Passkey (FIDO2 credential) | Phishing-resistant everyday sign-in | Public/private-key authentication; unlocked locally with PIN or biometric | Supported websites and apps on compatible phones, computers or credential managers | November 2026 |
| FIDO2 hardware security key | High-value, administrator or regulated accounts | Separate physical authenticator; requires possession and compatible connector/service | Services that support FIDO2 security keys on USB, NFC or other supported interfaces | November 2026 |
| Authenticator-app code | Accounts without passkey support | Time-based one-time code entered after a password | Services with app-based 2FA and a compatible phone or tablet | November 2026 |
| Push approval | Convenient second step when carefully configured | Approve or deny a sign-in request after a password | Services offering push-based authentication on a registered device | November 2026 |
| SMS code | Last-resort 2FA where no stronger option exists | One-time code sent to a phone number | Services that support text-message verification and a reachable mobile number | November 2026 |
The table ranks methods by the protection they can provide, not by convenience. Availability, recovery options and the account’s own implementation can change, so check the service’s current security settings.
What is a passkey?
A passkey is a FIDO2 credential built from a public/private key pair. During registration, the authenticator keeps the private key and the service receives the matching public key. At sign-in, the service sends a one-time challenge; after you unlock the credential locally, the authenticator signs that challenge. The service verifies the signature with the public key.
Popular on Amazon
Your private key is not typed into a website. It remains in a device’s secure storage, a credential manager or a hardware authenticator. The passkey is also bound to the service where it was registered. A fraudulent look-alike site therefore cannot simply collect the passkey and replay it as it could a password or manually entered code. The UK National Cyber Security Centre (NCSC) explains passkeys for consumers, while its technical comparison of traditional credentials and FIDO2 describes the underlying authentication properties.
“Passkey” is a user-facing term rather than a single storage design. A credential can be device-bound, meaning the private key stays on one physical device or hardware key, or synced, meaning an encrypted copy is made available on other trusted devices through a credential provider. Both use the FIDO2 protocol; their availability and recovery behavior differ.
How is a passkey different from 2FA?
Passkeys usually replace the password step. Traditional 2FA keeps the password and adds a second factor, such as a texted code, an authenticator code, a push approval or a security key. The phrase “2FA” therefore says how many checks are involved, not how resistant the account is to phishing.
A passkey can itself satisfy multi-factor requirements when it verifies the user before authentication. The NCSC states that “a passkey or other FIDO2 credential that verifies the user prior to authenticating is equivalent to two-factor authentication” in its personal-use comparison. In practice, unlocking a passkey with a device PIN or biometric combines possession of the authenticator with a local user-verification factor. A service may still ask for additional steps because of its own policy or risk controls.
What each method asks you to prove
| Method | Typical sign-in action | Phishing resistance | Main dependency |
|---|---|---|---|
| Passkey | Choose the credential and unlock it with a PIN, fingerprint or face recognition | Designed to resist credential harvesting and adversary-in-the-middle phishing because it is tied to the registered service | Compatible service, device or credential manager, and a workable recovery path |
| FIDO2 hardware key | Insert, tap or otherwise use the key, then complete any required local gesture | FIDO authentication is phishing-resistant when the service and key are correctly used | Physical key, connector/interface compatibility and replacement or backup planning |
| Authenticator code | Read a time-based code from an app and type it after the password | Better than SMS in CISA’s guidance, but still vulnerable to phishing | Registered phone/tablet and the service’s recovery process |
| Push approval | Review and approve a sign-in notification | Approval prompts can be abused through repeated or misleading requests; they are not equivalent to FIDO2 | Registered device, notification delivery and careful request verification |
| SMS code | Type a code sent to the enrolled phone number | Not phishing-resistant in CISA’s comparison | Phone-number access and whatever fallback the service permits |
CISA’s mobile communications guidance recommends FIDO authentication for phishing resistance, describes authenticator codes as better than SMS but still phishable, and advises moving away from SMS for high-risk accounts where possible.
Also popular on Amazon
Why are passkeys harder to phish?
A password or one-time code is information a fake site can ask you to type. A FIDO2 passkey instead signs a challenge for the site origin for which it was created. The fake site does not receive a reusable secret, and a captured signature is not useful for a different service or a later challenge. This is why FIDO2 credentials are considered phishing-resistant in the NCSC comparison.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →That protection does not make every part of an account unbreakable. An attacker who takes over the email address, credential-provider account or device-management account used for recovery may still create problems. Services can also weaken an otherwise strong setup with an insecure account-recovery path. Review recovery methods rather than judging security only by the sign-in button.
What is the difference between synced and device-bound passkeys?
Synced passkeys favor availability. An encrypted credential can appear on other trusted devices through the provider, so replacing a lost phone may be easier and a new device can often sign in after you authenticate to the provider. Device-bound passkeys favor custody: the private key remains on one device or hardware authenticator and is not copied through a sync service.
| Choice | Advantages | Trade-offs to plan for |
|---|---|---|
| Synced | Works across trusted devices; can reduce lockout after losing one device | The sync-provider account, its recovery process and the devices authorized to use it become part of the security boundary |
| Device-bound | Tighter control over where the private key exists; useful for strict custody policies | Loss, damage or replacement requires another registered authenticator or a service recovery process |
Neither choice is automatically right for every account. A personal account may benefit from a reputable built-in credential manager’s syncing, while an organization with strict key-custody rules may require device-bound credentials or hardware keys. Record which devices and backup authenticators are registered before removing an old one.
Can I sign in on a device that does not have my passkey?
Yes, when the service supports cross-device FIDO sign-in. You can begin on the computer or phone without the credential, select the passkey option, and use a nearby device that holds it. The NCSC describes a QR-code and Bluetooth-proximity flow in which the private key stays on the credential-holding device; the other device receives the authentication result rather than the key.
Free tools Windows power users keep installed
One-click scans. No signup required.
Also popular on Amazon
Cross-device sign-in depends on the service, browser, operating system and proximity permissions. If the QR flow fails, update the devices, enable the requested Bluetooth or local-network permission, keep them nearby and try the service’s alternate “use another device” option. Do not scan an unexpected QR code from an unsolicited message.
How do I set up a passkey safely?
You need an account that offers passkeys, a compatible phone, computer or hardware authenticator, and at least one recovery method you can actually use. Before deleting a password or old 2FA method, add and test the passkey and a backup authenticator.
- Open the account’s security settings. Look for labels such as Passkeys, FIDO2, WebAuthn, Security keys or Sign-in methods. Service labels vary.
- Choose “Add passkey” or the equivalent. Follow the operating system or credential-manager prompt. Confirm the account and service name before approving.
- Complete local user verification. Use the device PIN, fingerprint or face recognition requested by the authenticator. This unlocks the passkey; it does not send your biometric data to the website.
- Name the credential. Use a label that identifies the device or key, such as “personal phone” or “office security key.” This makes later removal safer.
- Test a fresh sign-in. Sign out, select the passkey option and confirm that the expected device prompt appears. Keep the password or existing second factor until the test succeeds.
- Add a recovery route. Register another trusted device or a second hardware key if the service supports it. Store recovery codes offline when offered, and check whether weaker SMS recovery can be disabled.
- Review the account’s registered devices. Remove credentials belonging to devices you sold, lost or no longer control.
Built-in phone and computer credential managers can handle passkeys; buying a separate product is not a prerequisite. A physical FIDO2 security key is an optional choice for people who want a removable hardware authenticator or need a policy-controlled key. Check the service’s supported FIDO2 options and the key’s connector, NFC or other interface before purchasing.
What should I do if passkeys are not available?
Use a strong, unique password stored in a password manager and enable the strongest second factor the service offers. Prefer a FIDO2 security key or another FIDO option; if that is unavailable, use an authenticator-app code; treat SMS as a last resort, particularly for valuable accounts.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Create a different long password for every account. A password manager can generate and fill these without requiring memorization.
- Turn on two-step verification in the account’s security settings.
- Select a FIDO option first, then an authenticator app, then SMS only if no stronger method is offered.
- Save recovery codes in a protected offline location. Do not store them in the same account they recover.
- Inspect fallback settings. A service that allows anyone with a phone number or email link to bypass 2FA may reintroduce a weaker route.
- After enrollment, disable SMS fallback if the service allows it and you no longer need it.
This approach follows NCSC consumer guidance and CISA’s recommendation to migrate away from SMS for high-risk accounts. Authenticator codes improve on SMS but remain phishable, so verify the address bar and never disclose a code to someone who contacts you.
Also popular on Amazon
How should I plan recovery and account changes?
Recovery is the part most likely to be overlooked. A passkey can be highly resistant to phishing during normal sign-in while the recovery path still accepts a weaker method. Map every route that can add a new credential, reset a password or change the enrolled phone number.
- Keep two independent authenticators where appropriate. A second trusted device or hardware key reduces dependence on one handset.
- Protect the sync-provider account. Use its strongest available authentication and review active sessions and devices.
- Store recovery codes securely. Keep an offline copy in a location protected from casual access, fire and device loss.
- Revoke lost devices quickly. Remove their passkeys from the service and from the credential manager when possible.
- Plan before replacing a phone. Register the new device while the old one still works, then verify sign-in and recovery.
- Separate work and personal credentials. Follow an employer’s rules for hardware keys, device-bound credentials and administrator accounts.
Are passkeys worth enabling now?
For a service that supports them, passkeys are generally the strongest and simplest sign-in option described by the NCSC and CISA because they remove the password from the phishing conversation and can provide two-factor-level assurance through local verification. Their value is greatest on email, financial, work-administration and other accounts that unlock access to many services.
Enable them without abandoning recovery discipline. A synced passkey improves availability but makes the sync-provider account important; a device-bound credential limits copying but demands backup planning. Keep a password-and-2FA fallback for services that have not adopted passkeys, and prefer FIDO authentication over codes whenever possible.
What does current adoption look like?
The FIDO Alliance reported in 2024 that 53% of surveyed people had enabled passkeys on at least one account, while 22% said they had enabled them on every account where they could. These are commissioned survey results, not a census of all users, and adoption varies by service, country and device ecosystem. Service support and recovery behavior continue to change.
Microsoft’s Entra ID passkey documentation describes FIDO2 authentication methods for organizational accounts. The specific controls available to an administrator or consumer depend on the service’s current implementation and policy.
Also popular on Amazon
How to choose for different accounts
| Account situation | Recommended order | Reason |
|---|---|---|
| Email, financial or primary identity account | Passkey or FIDO2 hardware key; add a second recovery authenticator | These accounts can reset or expose many other services, so phishing resistance and recovery resilience matter most |
| Work administrator or regulated account | Follow organizational policy, commonly a device-bound FIDO2 credential or approved hardware key | Central policy may require tighter custody, auditability and controlled replacement |
| Everyday account with passkey support | Synced or device-bound passkey, plus tested recovery | Choose the storage model that matches your availability and custody needs |
| Service with no passkey support | Unique password plus FIDO2, then authenticator code, then SMS | The second-factor method determines how much phishing resistance you gain |
How we picked the methods
The ordering uses the NCSC’s and CISA’s published security criteria: resistance to phishing, whether the credential replaces a password or adds to it, recovery and availability implications, and compatibility requirements. It does not represent an independent performance test or a claim that every service implements each method identically.
Frequently Asked Questions
Do passkeys work without an internet connection?
The local unlock step can occur on the device, but the account service still has to receive and verify the signed authentication response. Whether an offline or temporarily disconnected workflow is possible depends on the specific app and service; do not assume a passkey makes an account usable without network access.
Can I use the same passkey on multiple websites?
A passkey is registered to a particular service and is not a universal password. The same device or credential manager can hold many separate passkeys, but each site receives its own public key and cannot use another site’s credential.
What happens to my passkeys if I lose my phone?
A synced passkey may be available on another trusted device after you recover the credential-provider account. A device-bound passkey requires another registered authenticator or the service’s recovery process, so add a backup before loss occurs and revoke the missing device promptly.
Are biometrics sent to the website when I use a passkey?
No. The fingerprint or face check normally unlocks the authenticator locally. The service receives a cryptographic proof from the passkey, not a copy of the biometric template.
