PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA stolen password can still open an account if it has no multifactor authentication (MFA), if the attacker has also obtained the second factor, or if a weak sign-in or recovery method can be phished or abused. But a password alone does not automatically bypass MFA: the attacker must also satisfy the additional check.
When a stolen password is enough—and when it is not
If an account has no MFA, a valid password may be enough to sign in. With MFA enabled, the password is only one part of the sign-in; an attacker who has only that password should be blocked if they cannot provide the other factor. CISA makes that qualification explicit in its October 2022 guidance on phishing-resistant MFA.
As an Amazon Associate I earn from qualifying purchases.
MFA does not guarantee that an account is safe. An attacker may have stolen or intercepted the second factor, tricked the user into providing it, or persuaded them to approve a sign-in prompt. The outcome depends on the account’s methods and recovery options, not just whether a setting labeled “MFA” is turned on.
How attackers get past the additional check
They steal more than the password
A phishing attempt can capture both a password and a one-time code. An attacker may also target a phone number through SIM swapping or other telecommunications attacks to receive SMS or voice codes. Push bombing works differently: repeated sign-in prompts pressure a user to approve one, sometimes by mistake. CISA describes these as risks associated with some MFA methods.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
They exploit weaker MFA or fallback methods
MFA methods do not offer equal protection. CISA says SMS is not phishing-resistant and recommends against SMS-based MFA for highly targeted accounts. Authenticator-app codes are a better choice than SMS in CISA’s guidance, but they can still be phished. A service may also rely on SMS during account recovery even if the user selected a different MFA method for routine sign-ins.
They try the password on other services
Credential stuffing means testing usernames and passwords exposed from one system against other services. If you reused a password, a breach elsewhere can put additional accounts at risk. MFA can make those credentials insufficient when the attacker cannot provide the required second factor, but it is still important to replace exposed and reused passwords. CISA describes credential stuffing in its MFA guidance for administrators.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to do if you think someone has your password
If you suspect that someone has already accessed an account, start with that service’s official compromised-account recovery process. Recovery steps and available controls differ by service, so there is no single sequence that works for every account. Once you regain control, review its active sessions, recovery methods, and sign-in options.
Recommended Free Tools
Replace exposed and reused passwords
- Change the password for the affected account.
- Change any other password you reused on another service. Give every account a distinct password.
- Use long, random passwords. A password manager can generate and store them; CISA notes that some password managers also flag weak, reused, or leaked passwords.
See CISA’s password guidance for advice on using strong, unique passwords and password managers.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Strengthen sign-in and recovery options
- For valuable accounts, prefer FIDO-based authentication where the service supports it. Options include a compatible hardware security key or a passkey.
- Check both routine sign-in and account recovery. If the service lets you remove SMS as a fallback after you establish a stronger method, consider doing so while preserving a recovery route you can use safely.
- Review enrolled devices, active sessions, recovery phone numbers and email addresses, and any unfamiliar authentication methods through the service’s official settings and recovery pages.
CISA describes FIDO authentication as phishing-resistant and recommends it for valuable accounts, including Microsoft, Apple, and Google accounts. Its guidance treats hardware keys as the most effective option where feasible and passkeys as an acceptable alternative. A key can strengthen future sign-ins only if the service supports it and you enroll it; it does not, by itself, recover an account that may already be compromised. See CISA’s implementation guidance and mobile communications guidance, current as of December 18, 2024.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What MFA can—and cannot—tell you
Seeing MFA enabled is useful, but it does not reveal whether the method is resistant to phishing, whether weaker recovery options remain available, or whether someone has already gained access. Nor does the fact that a password was exposed prove that an attacker entered the account. The sources cited here do not quantify how often an attacker with a password still succeeds; the answer for a particular account depends on its sign-in controls, recovery flow, and what else the attacker obtained.
Quick Recap
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
