Free tools Windows power users keep installed
One-click scans. No signup required.
Passkeys generally protect better against phishing than authenticator-app codes or ordinary push approvals. A passkey uses FIDO/WebAuthn authentication tied to the legitimate website or service, so a lookalike site cannot simply collect a reusable code. “Authenticator app” can mean either a one-time password (OTP) or a push prompt, however, and the risks differ. If passkeys are unavailable, choose the strongest supported alternative and make a recovery plan.
Why passkeys are harder to phish
A passkey is a FIDO credential used through an authenticator associated with a device, such as a phone or computer, or through a separate roaming authenticator such as a hardware security key. In a FIDO/WebAuthn sign-in, the authentication is bound to the legitimate relying party—the service the user intends to access. A fraudulent lookalike site therefore cannot simply capture a passkey response and replay it as if it were a code typed into a form.
As an Amazon Associate I earn from qualifying purchases.
CISA identifies FIDO/WebAuthn as phishing-resistant. Its phishing-resistant MFA fact sheet describes it as the only widely available phishing-resistant authentication method. This is a claim about resistance to phishing, not a guarantee against every account compromise: device compromise, account recovery weaknesses, and other attack paths are separate concerns.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How authenticator-app codes and push prompts compare
Authenticator apps can provide materially different sign-in methods. An OTP is a short-lived code the user enters; a push prompt asks the user to approve or deny a sign-in request. Neither should be treated as equivalent to a passkey for phishing resistance.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Method | What the user does | Phishing risk |
|---|---|---|
| Passkey (FIDO/WebAuthn) | Approves authentication with a device or security key, usually after unlocking it. | Designed to bind authentication to the legitimate service; CISA classifies FIDO/WebAuthn as phishing-resistant. |
| Authenticator-app OTP | Types a time-limited code into the sign-in page. | A phishing site can trick the user into entering the code while it is valid. CISA classifies app-based OTP as vulnerable to phishing. |
| Ordinary app push | Approves or denies a sign-in notification. | Users can approve a deceptive or unexpected request; repeated prompts can contribute to push bombing. |
| Number-matching app push | Matches a number shown during sign-in with the number in the app prompt. | Helps resist push bombing by making blind approval harder, but does not make app-based authentication phishing-resistant. |
CISA’s MFA guidance distinguishes these app-based methods and treats app authentication as vulnerable to phishing. Number matching is a useful improvement over a simple approve/deny prompt, but it does not provide the relying-party binding that makes FIDO/WebAuthn resistant to phishing.
What to choose when a service offers multiple methods
- Use a passkey when the service supports it and you have a reliable way to recover access if the device becomes unavailable.
- Consider a hardware security key if the service supports FIDO2/WebAuthn and you want a separate physical authenticator. Check compatibility with your devices, including USB ports or NFC support, and register a backup or another recovery method where the service allows it. A hardware key is not automatically the same thing as a synced passkey.
- If passkeys and security keys are unavailable, use an authenticator app. Prefer number-matching push over ordinary push if both are offered. If the app offers OTP rather than push, OTP is still preferable to weaker text or email-code fallbacks in CISA’s comparison, but it can be phished.
- Use text or email codes only when stronger supported options are unavailable. CISA’s guidance ranks them below app-based methods and security keys.
CISA describes security keys as providing the best phishing protection among the MFA options it lists. That recommendation is conditional on the account supporting the method and on the user being able to keep a backup or recover access. You do not need to buy a key if your accounts do not support it or a passkey already meets your needs.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Check portability and recovery before relying on a passkey
Passkeys do not all behave alike when a user changes or loses devices. Some are synced across a user’s devices through a platform or provider; others may be device-bound. Synchronization and recovery depend on the service and platform, so check the current instructions for the account rather than assuming a passkey exists only on one device—or that every provider syncs credentials in the same way.
- Confirm whether the service lets you register more than one passkey or authenticator.
- Check how you can regain access if your phone, computer, or security key is lost or damaged.
- For a physical key, consider a second registered key or another provider-approved recovery method.
- Keep recovery options protected: an easy-to-phish fallback can undermine the protection of a stronger sign-in method.
CISA’s federal hybrid identity guidance discusses platform and roaming authenticators, as well as the value of multiple registered authenticators or a mix of types to mitigate recovery risks. Its deployment requirements are federal and assurance-level specific; they are not universal rules for personal accounts. For an individual account, follow the provider’s current passkey and recovery documentation.
Quick Recap
Best Value
- Ultra-Compact FIDO2 Security Key – Plug-and-stay or carry on a keychain. This USB-C hardware security key offers portable, always-on protection for desktop and mobile use.(Item Size: 0.73 X 0.60 X 0.30 inches)
- USB-C Hardware Key for All Devices – Works with USB-C ports on PC, Mac, Android, and USB-C iPhones. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key – Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey – Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication – Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
