For most personal accounts that offer them, use a passkey as your primary sign-in method. Properly configured WebAuthn passkeys are phishing-resistant because the cryptographic response is bound to the legitimate website’s domain. Keep a recovery method, and use an authenticator app when a service does not support passkeys or requires it as a fallback. A FIDO2/WebAuthn security key is another strong option when the account supports USB or NFC authenticators.
Passkeys and authenticator apps at a glance
Both methods add more than a password, but they protect against different parts of the attack chain. A passkey uses public-key cryptography and answers a website challenge locally. An authenticator app creates a temporary one-time password (TOTP) that you type into the login form.
As an Amazon Associate I earn from qualifying purchases.
| Decision point | Passkey | Authenticator-app code (TOTP) |
|---|---|---|
| What you do at sign-in | Approve a prompt or unlock the credential with a device PIN, fingerprint, face scan or another local check. | Open the app, read the current code and type it into the service’s login screen. |
| How the service verifies you | A WebAuthn challenge is answered with a cryptographic signature tied to the authenticated verifier domain. | The service checks a time-based code generated from a shared secret. |
| Phishing resistance | Yes, when WebAuthn is correctly implemented and the authenticator verifies the real domain. | No for manually entered OTPs. NIST classifies them as not phishing-resistant because an impostor site can relay the code. |
| Replay resistance | Yes. The response is made for a fresh challenge. | Yes. A valid TOTP is time-dependent and intended for one use, although that does not stop real-time phishing. |
| Moving to another device | Syncable passkeys may appear on multiple devices; device-bound passkeys require another enrollment or a recovery route. | Enroll the new authenticator and invalidate the old one. Some implementations support exporting or syncing the secret under applicable requirements. |
| Main trade-off | Sync improves convenience but makes the sync service and account-recovery process part of your security model. | Broad compatibility and familiarity, but the code-entry step can be captured and relayed. |
How each method works
Passkeys: a domain-bound cryptographic response
When you create a passkey, the authenticator generates a key pair. The private key remains protected by the authenticator; the service stores the corresponding public key. During sign-in, the service sends a fresh challenge. Your device verifies the site’s identity, asks for local user verification when configured, and signs that challenge. The service validates the signature with the stored public key.
Free tools Windows power users keep installed
One-click scans. No signup required.
The important property is verifier-name binding. The credential is associated with the authenticated domain, so a copycat site cannot normally obtain a response that is valid for the real service. NIST describes WebAuthn as an example of a standard providing phishing resistance through verifier-name binding: “WebAuthn [WebAuthn], which is used by authenticators that implement the Fast Identity Online 2 (FIDO2) specifications [FIDO2], is an example of a standard that provides phishing resistance through verifier name binding by choosing an authenticator secret based on the authenticated domain name of the verifier.”
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A passkey is not a password stored in a different place. There is no secret for you to read or dictate to a website. You generally unlock the credential with a local device check, while the private key performs the cryptographic operation invisibly.
Authenticator apps: a shared secret and a typed code
When you enable an authenticator app, the service and app establish a shared secret, commonly by scanning a setup QR code. The app combines that secret with the current time to calculate a one-time password. You type the displayed value into the service’s login flow.
Each code is short-lived and intended to prevent reuse. That gives TOTP replay resistance: an intercepted code should not remain useful indefinitely. However, the code is not cryptographically tied to the website session. A phishing site can ask for your current code and immediately forward it to the genuine service. That is why NIST’s implementation guidance labels a TOTP smartphone app as replay-resistant but not phishing-resistant.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Why phishing resistance is the key difference
What a passkey blocks
A properly configured WebAuthn passkey checks the verifier’s domain as part of the authentication ceremony. A fraudulent domain cannot simply collect a passkey response and reuse it against the legitimate domain. The challenge-response exchange also prevents an attacker from reusing an old cryptographic response.
This protection depends on the service actually using WebAuthn correctly and on you completing the browser or operating-system prompt for the intended account. Passkeys do not make every part of an account invulnerable: a compromised recovery email, a stolen device session, malicious software, or a weak support process can still create risk. The passkey protects the authentication ceremony itself.
Why a TOTP code can still be phished
A TOTP code can be perfectly valid and still be entered into the wrong site. In a real-time relay, the attacker’s page collects your username, password and current code, then submits them to the genuine service before the code expires. The service sees a correct code and may approve the login.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This is not the same as saying TOTP is useless. It is substantially better than a password alone and remains a practical fallback for services without passkeys. Treat it as a second factor with replay resistance, not as a phishing-proof factor.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Syncable versus device-bound passkeys
Syncable passkeys
A syncable passkey can be available on more than one device through a credential-management or platform sync service. That can make a new phone easier to use and can provide a recovery path when one device is lost.
The convenience changes what must be protected. Unauthorized sharing, compromise of the sync fabric, and access to the account that controls synchronization can affect the credential set. NIST recommends encrypted private-key storage, strong access controls, visibility into sharing, recovery safeguards and multiple bound authenticators. A syncable passkey is therefore not automatically equivalent to a single, isolated hardware key; its security depends on the implementation and the controls around it.
Device-bound passkeys
A device-bound credential stays on one authenticator rather than syncing as a usable key across devices. This reduces exposure to sync-related sharing or compromise, but losing the device can make recovery harder. Before relying on a device-bound passkey, register another authenticator or confirm the service’s recovery process.
Which method fits your account?
Everyday personal accounts
Choose a passkey first when the service offers one and you can explain how it will be backed up or recovered. Register a second passkey on another device, or retain the service’s permitted fallback. Keep an authenticator app available for accounts that still require TOTP.
High-value accounts
Email, financial, identity and administrator accounts deserve a recovery plan before you remove an older factor. Use the strongest authenticator the service accepts, review recovery channels, and register more than one authenticator where policy permits. A physical FIDO2/WebAuthn security key can be useful when you need a credential that is separate from your phone or computer.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Managed work or government accounts
Follow the organization’s approved authenticator and recovery policy. NIST notes that agencies select authenticators according to their risks, threats and usability requirements. A passkey that is appropriate for a personal account may not meet a particular employer’s enrollment, device-management or audit rules.
Accounts without passkey support
Use an authenticator app rather than falling back to a password alone. Save the service’s emergency recovery codes in a secure location, enroll a replacement authenticator before changing phones, and remove old authenticators after the new one works.
How to set up a passkey safely
Labels vary by service, but the sequence is usually similar. Do not delete your existing recovery method until you have tested the new credential.
- Confirm support. Open the account’s security or sign-in settings and look for “Passkey,” “Passkeys,” “Security key” or “FIDO2.” The exact label and available platforms differ by service.
- Start enrollment from the genuine service. Navigate there using your normal bookmark or a manually verified address, not a link in an unexpected message.
- Choose where to store it. Select the platform credential manager, a device-bound option, or a compatible external security key offered by the service.
- Complete local verification. Approve the browser or operating-system prompt with your device PIN, fingerprint, face scan or other supported user-verification method.
- Name the credential if the service allows it. A label such as “personal laptop” or “USB key” helps you identify an authenticator later.
- Test another sign-in. Sign out or open a private window, then verify that the passkey appears and unlocks successfully.
- Add recovery before retiring anything. Register a second passkey, keep an allowed authenticator app, or confirm recovery codes and account-recovery contacts.
For a syncable passkey, protect the account that controls synchronization with its own strong authentication and recovery settings. For a device-bound passkey, keep the second authenticator or recovery route physically and logically separate from the first.
How to set up an authenticator app safely
- Open the account’s security settings. Select the option usually labeled “Authenticator app,” “Two-step verification” or “TOTP.”
- Verify the setup page is genuine. Start from the service directly and check the domain before scanning anything.
- Scan or enter the secret. Use the app’s QR scanner, or enter the setup key manually if scanning is unavailable. Treat the secret as a password: anyone who obtains it may generate valid codes.
- Enter the current code to confirm enrollment. The service normally requires one code before activating the factor.
- Store recovery codes. Keep them offline or in a protected password manager location separate from the phone.
- Enroll a replacement before changing phones. If the service permits multiple authenticators, add the new phone first, test it, then remove the old enrollment.
- Revoke lost devices. If the phone is lost or the setup secret may have been exposed, remove that authenticator and create a new secret rather than relying on the old one.
What happens if you lose your phone or computer?
Lost device with a syncable passkey
Sign in from another device that is already authorized for the sync service, or use the account’s documented recovery route. Then review active sessions and registered passkeys, remove the lost device where the service offers that control, and confirm that your remaining authenticators work.
Lost device with a device-bound passkey
The credential may be unrecoverable from the lost hardware. Use a second registered authenticator, recovery codes or the service’s identity-recovery process. This is why a backup authenticator should be enrolled before the loss occurs.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Lost phone containing a TOTP app
Use a recovery code or another registered factor to access the account. Enroll the new phone and invalidate the old authenticator. If you cannot prove control through an existing factor, only the service’s support or recovery process can restore access; there is no universal method that safely reconstructs every TOTP secret.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Where a physical security key fits
A roaming FIDO2/WebAuthn authenticator is a physical token that connects by USB or NFC. CISA describes security keys as a strong MFA choice and recommends checking whether the particular account supports them. You also need a compatible connector or NFC capability on the device you plan to use.
Security keys are useful when you want a credential separate from a phone, when an organization requires hardware-backed authentication, or when you want a backup to a platform passkey. Register a second key or another accepted authenticator where the service allows it; otherwise, loss of the only key can trigger a difficult recovery process.
What the standards say about assurance
NIST’s classifications separate two properties that are often conflated. Manually entered OTPs are not phishing-resistant, while TOTP remains replay-resistant. FIDO2 passkeys with user verification are listed as both replay-resistant and phishing-resistant. These are capabilities of the authenticator and protocol, not a guarantee that every website offers the same enrollment, recovery or implementation quality.
NIST’s April 2024 supplement says properly configured syncable authenticators can satisfy AAL2 use cases when they include local user verification or another authenticator, encrypted private-key storage and strong controls for keys held in a sync fabric. That is standards guidance, not a blanket approval for every passkey product or account configuration.
Recommended Free Tools
Common mistakes and fixes
- Deleting the old factor immediately: Keep it until a new sign-in and recovery test succeed.
- Assuming every service syncs passkeys: Check whether the credential is syncable or device-bound and read that service’s recovery instructions.
- Using TOTP codes on an unexpected page: Stop, close the page and reopen the service from a trusted bookmark.
- Leaving an old phone enrolled: After a phone change, review authenticators and active sessions, then revoke the old device.
- Storing the TOTP setup secret in a screenshot: Delete exposed copies and re-enroll the factor if the image may be accessible to others.
- Registering only one authenticator: Add a second passkey, security key or permitted fallback before an emergency.
- Assuming a passkey replaces account recovery: Secure recovery email, phone, backup codes and support-verification processes because attackers may target those paths instead.
A practical decision checklist
- Does the service offer a passkey or FIDO2/WebAuthn security key?
- Is the passkey syncable, device-bound, or selectable between both?
- What local user-verification method protects it?
- Can you register a second authenticator?
- What happens if your phone, computer or security key is lost?
- Does your employer, school or regulator require an approved authenticator type?
- If only TOTP is available, have you saved recovery codes and planned a phone-change procedure?
If the answers are clear, use a passkey where available, retain a tested recovery route, and use an authenticator app for services that do not yet support passkeys. That combination gives you phishing-resistant sign-in where possible without making a single lost device the only way back into your accounts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
