Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Passkeys are generally the stronger primary defense against phishing. They use public-key cryptography and are bound to the legitimate website or app identity, so a look-alike domain cannot obtain a valid sign-in assertion. Password managers solve a different problem: they generate and store unique, long passwords, reducing reuse and breach damage, but those passwords can still be typed or autofilled into a convincing phishing site. For most people, the safest practical setup is to use a passkey wherever a service supports one and keep a password manager for accounts that still require passwords. Secure the recovery methods for both, and consider a device-bound FIDO2 security key for especially important accounts.
What is the difference between a passkey and a password manager?
A passkey is a phishing-resistant sign-in credential. A password manager is an encrypted vault and password-generation tool. They are complementary rather than interchangeable: passkeys protect supported accounts with cryptographic website binding, while password managers provide secure coverage for the many accounts that still use passwords.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute| Security question | Passkeys | Password managers |
|---|---|---|
| Phishing resistance | Strong when the service, browser and device support passkeys; the credential is bound to the legitimate site or app identity. | Not inherent. A password can still be entered or autofilled into an attacker-controlled site. |
| Credential reuse | Each service has its own public/private-key credential, so there is no password to reuse. | Generates a different password for every account and stores it in an encrypted vault. |
| What a breach exposes | The service normally stores a public key, not the private key. Protection still depends on the passkey provider and recovery design. | A compromised vault or stolen master secret can expose many stored passwords and require them to be replaced. |
| Device loss | Synced passkeys can be recovered through the sync fabric; device-bound passkeys require another enrolled authenticator or the service’s recovery process. | Restore the encrypted vault on another device using the manager’s account, master passphrase and any required second factor. |
| Cross-device convenience | Synced passkeys are designed to work across a user’s devices. Device-bound credentials deliberately limit that portability. | Cloud or local vault access can provide broad portability, subject to the manager’s security controls. |
| Fallback risk | A service may fall back to a password, email link, or another weaker recovery method when the passkey is unavailable. | The password remains the primary secret unless the service adds another factor, and traditional factors can still be phished. |
The comparison is therefore not “one tool for every account.” Passkeys are the better answer to phishing on accounts that support them; password managers remain the practical answer for password-only services and for creating unique credentials everywhere else.
How do passkeys stop a phishing site?
Passkeys use public-key cryptography. During registration, the device or passkey provider creates a key pair. The service receives the public key, while the private key remains protected by the user’s device or passkey provider. At sign-in, the service sends a challenge and the device signs it after the user completes a local unlock.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The browser and operating system enforce the relationship between that credential and the website or app identity that created it. A passkey made for the real domain is not presented to a look-alike domain, even when the fake page copies the real site’s branding and sign-in form. The attacker therefore cannot collect a reusable passkey secret by persuading the victim to type it into the wrong page.
Microsoft describes this as proving possession of the private key, and Google explains that the identity binding is enforced by the browser and operating system. The FIDO Alliance classifies passkeys—both synced and device-bound—as phishing-resistant credentials.
What the attacker still might target
Phishing resistance protects the credential exchange, not every part of an account. An attacker can still impersonate support staff, target a recovery email account, steal an already-unlocked device, or trick someone into approving an unrelated action. A service that offers a weak password or email recovery path can also undermine the protection of an otherwise strong passkey. Review those paths instead of assuming the passkey makes the entire account invulnerable.
Are synced passkeys as secure as device-bound passkeys?
Both types provide strong phishing resistance, but they make different trade-offs. A synced passkey is backed up across a user’s devices by a sync provider. A device-bound passkey stays on one device or on a hardware security key and is not copied through that sync system.
| Characteristic | Synced passkey | Device-bound passkey |
|---|---|---|
| Convenience | Usually easier to use on a replacement or additional device because the credential can be restored through the sync fabric. | Requires access to the enrolled device or security key, or a separately enrolled backup. |
| Control boundary | The sync provider’s account, recovery and device-authorisation controls become part of the security model. | The credential remains within a narrower device or key boundary. |
| Recovery | Recovery depends on the provider’s backup, authentication and account-recovery design. | Recovery depends on another authenticator or the service’s account-recovery process; losing the only device can be disruptive. |
| Best fit | Broad user populations that need practical multi-device access. | High-value accounts or organisations that require a strict device boundary. |
The UK National Cyber Security Centre’s personal-use assessment says both forms offer strong phishing resistance while noting that sync implementations differ in multi-factor protection, recovery, availability and protection of the underlying credential store. Microsoft recommends device-bound credentials when strict device boundaries are required and synced passkeys for broader populations. Choose based on the consequence of device loss and the amount of control you need over where the credential can exist.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What does a password manager protect me from?
Password managers improve password hygiene in several important ways. NIST says they can generate long, complex and unique passwords for each account, then store them in a local or cloud-based encrypted vault. That makes it practical to avoid repeating a password across email, shopping, work and financial services.
- Credential reuse: A breach at one service does not automatically reveal the password used at another service when every login has a different generated value.
- Weak human-created passwords: Random generation removes the temptation to use names, dates, familiar phrases or small variations of an old password.
- Memory pressure: You only need to remember the manager’s long master passphrase and the recovery details you deliberately maintain.
- Account inventory: A vault can make it easier to find old accounts, replace reused passwords and identify services that still lack stronger sign-in options.
These benefits reduce the impact of password leaks and make password-only accounts substantially safer than accounts protected by short or repeated passwords. They do not change the underlying password protocol into a phishing-resistant one.
What are the password manager’s own risks?
The vault is a high-value target. NIST warns that compromise of the master secret can expose the information stored inside and may require every password in the vault to be recreated. Use a long, unique master passphrase and enable multi-factor authentication where the manager supports it. Keep recovery information available without storing it in the same place as the only copy of the vault.
Also check what the manager does before autofilling. A manager that recognises the legitimate domain can help you notice a mismatch, but a password can still be captured if you manually paste it, type it, or approve autofill on a malicious page. Treat autofill as a convenience and warning aid, not as a cryptographic guarantee.
Can a password manager stop phishing?
Not reliably. A password manager can prevent reuse and may decline to autofill when the domain does not match, but the password itself remains a transferable secret. A convincing fake site can capture it if you provide it, and an attacker can use the stolen password against the real service.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This distinction matters when comparing marketing claims with the security mechanism. Passkeys prove possession of a private key without revealing that key to the site. Password managers protect the storage and creation of passwords; they do not make a password-based login resistant to a malicious website.
Is traditional multi-factor authentication enough against phishing?
Traditional second factors reduce some account-takeover risk but are still phishable. In its 2025 phishing guidance, the FIDO Alliance classifies passwords, SMS and email codes, authenticator-app one-time passwords, TOTP, push approvals and recovery codes as phishable methods. A victim can disclose a code or approve a prompt while interacting with an attacker-controlled flow.
The NCSC similarly concludes that traditional MFA methods remain inherently phishable, while FIDO2 credentials, including passkeys, are as secure or more secure than traditional MFA against common credential attacks observed in the wild. This does not make a password plus SMS useless: it is generally better than a password alone when a passkey is unavailable. It does mean you should understand the residual phishing risk and choose the strongest available option.
How should I set up passkeys and a password manager together?
Use the two technologies for different coverage. Start with accounts whose compromise would let an attacker reset other accounts or cause direct financial, professional or personal harm.
- List your high-value accounts. Begin with your primary email, financial services, cloud storage, work identity, social accounts used for recovery and any service holding sensitive personal data.
- Enroll a passkey wherever the service offers one. Open the account’s Security, Sign-in or Authentication settings, choose the passkey option, and complete the device’s local unlock. Confirm that the passkey appears in the account’s enrolled-authenticator list before removing an older sign-in method.
- Keep a password manager for unsupported services. Create a unique random password for every account that still requires one. Do not copy a password from one service to another merely because both appear low risk.
- Harden the vault. Choose a long master passphrase that is not used elsewhere, enable the manager’s MFA, update the manager and browser, and review active sessions or logged-in devices.
- Audit recovery routes. Check which email address, phone number, backup code or support process can regain access when the passkey or vault is unavailable. Strengthen the recovery account and store backup codes in a separate, protected location.
- Add a backup authenticator for critical accounts. If the service supports it, enroll a second passkey or a FIDO2 hardware security key before you need it. Verify that the browser, connector, operating system and service all support the key.
- Remove obsolete credentials deliberately. After confirming that the new passkey and backup work, delete unused passkeys, old security keys and passwords only if the service’s recovery design leaves you a safe way back in.
Do not wait until a lost phone or locked vault forces a rushed recovery decision. The backup should be tested while you still have a working primary authenticator.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should I do if I lose my phone or replace a device?
The answer depends on the credential type and the service’s recovery policy. A synced passkey may reappear after you authenticate to the sync provider on a replacement device. A device-bound passkey will not automatically transfer; you need another enrolled device or security key, or you must use the service’s recovery process.
Before wiping or selling a device, sign in to each important account and confirm that another authenticator is listed. Keep the old device available until the replacement has been tested. If the lost device could still be unlocked, use the service’s device-management page to revoke its sessions or remove its passkey. If recovery falls back to email or a password, secure that fallback first and expect additional identity checks.
When is a FIDO2 security key worth adding?
A FIDO2 security key is a device-bound FIDO credential that can serve as a backup or as the preferred authenticator for a high-value account. It is especially useful when you need a strict boundary around where the credential exists, or when you want a separate authenticator that is not dependent on a phone’s battery, biometric sensor or sync account.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCheck compatibility before buying or enrolling one. The account must support security keys, and the connector or wireless method must work with your computer or phone and browser. Enroll two keys when the service permits it, store the spare separately, and confirm the account’s recovery process. A security key is not a substitute for recovery planning: losing the only key can leave you dependent on the same weaker fallback you were trying to avoid.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which approach fits common account situations?
| Situation | Recommended approach | Reason |
|---|---|---|
| Primary email or identity account supports passkeys | Use a passkey, enroll a backup authenticator, and secure the account’s recovery email and phone. | Email often controls password resets for other services, so phishing resistance and recovery strength both matter. |
| Financial or workplace account supports passkeys | Use a passkey; consider a device-bound key if policy or risk requires a strict boundary. | The consequences of takeover are high, and a separate backup limits dependence on one device. |
| Service supports only passwords | Generate a unique random password in a manager and enable the strongest available MFA. | The manager addresses reuse, while MFA adds a second barrier even though traditional factors remain phishable. |
| Several family members share an account | Use the service’s supported individual passkeys or delegated access where available; avoid sharing a master password. | Individual credentials make revocation and accountability possible without distributing one secret. |
| Strictly managed business devices | Prefer device-bound credentials when the organisation requires a defined device boundary; use synced credentials where broad access is the priority. | The choice is a control-versus-convenience decision, not a claim that one type is universally safer. |
What mistakes weaken an otherwise strong setup?
- Leaving a weak fallback enabled: A passkey does not help if an attacker can simply choose “use password” or take over an unprotected recovery email.
- Keeping only one authenticator: A single phone or security key can become a single point of failure.
- Reusing the vault master passphrase: The master secret must not appear on another site or in an old password list.
- Approving unexpected prompts: Push approvals and recovery codes are phishable; reject requests you did not initiate and investigate the account afterward.
- Assuming every passkey sync is identical: Providers differ in authentication, recovery and protection of the synced credential store.
- Removing old access too early: Test the new passkey and backup before deleting the only working method.
- Ignoring account and browser support: A passkey or security key must be supported by the specific service, browser, operating system and connector combination you use.
What is the bottom-line choice?
Choose passkeys first for phishing protection, especially on email, financial, cloud, work and recovery-critical accounts. Keep a password manager because many services still require passwords and because unique random passwords sharply reduce reuse and breach exposure. Protect the manager with a long master passphrase and MFA, examine every recovery route, and add a device-bound FIDO2 security key when the value of the account justifies tighter control. This layered arrangement uses each technology where its security properties are strongest instead of asking either one to solve every problem.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Frequently Asked Questions
Do passkeys work if I use more than one browser or operating system?
They can, but the experience depends on whether the credential is synced and whether the service supports the browser, operating system and passkey provider you are using. A device-bound credential may require the enrolled device or a security key, while a synced credential may be available after you authenticate to the same sync ecosystem.
Are passkeys tied to my fingerprint or face?
The passkey is the cryptographic credential; a fingerprint, face scan or device PIN is a local unlock method for the device or provider. The service receives a signed response, not your biometric template. The exact unlock choices depend on the device and operating system.
Recommended Free Tools
What happens when a website offers a passkey but still asks for my password?
Many services retain passwords as a fallback, during enrollment, or for account recovery. Review the account’s authentication settings and recovery options rather than assuming the passkey has replaced every weaker method. Removing a fallback can be unsafe if you have not enrolled another authenticator.
Should I store backup codes in my password manager?
A manager can protect backup codes from casual loss, but storing the only copy in the same vault that you may be unable to open creates a dependency. Keep a second protected copy through a separate recovery method, and treat the codes as phishable secrets that should never be disclosed to unsolicited support contacts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
