iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Passwords alone are not enough for important accounts. Use a different, long password for every account, then add the strongest second sign-in method the service supports. Prefer a passkey or physical security key; use an authenticator app when those are unavailable, and treat SMS or email codes as fallback protection.
Secure your primary email, banking, payment, tax, and social accounts first. Email deserves special priority because whoever controls it may be able to reset many of your other accounts.
Why a strong password still falls short
A unique password reduces the risk of guessing and password-reuse attacks, but it does not make an account phishing-resistant. A fake login page can capture a password as you type it, malware can steal credentials from a device, and a password exposed in one breach can be tried against other services if you reused it.
The National Institute of Standards and Technology (NIST) states plainly in its final Digital Identity Guidelines: Authentication and Authenticator Management (SP 800-63B-4, July 2025): Passwords are not phishing-resistant.
That is a statement about the security property of passwords, not a claim that passwords are useless. They remain an important part of account security, especially when they are unique and hard to guess, but a second factor limits what an attacker can do with a stolen password.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For systems covered by NIST’s guidance, a password used as the only authentication factor must be at least 15 characters. A verifier may allow a password used only as part of multifactor authentication (MFA) to be shorter, but not below eight characters. These are requirements for systems that follow the standard; consumer websites do not all enforce them.
Do not interpret length as a substitute for uniqueness. A 20-character password reused on several sites can still expose all of those accounts after one breach. Generate a separate password for every service and store it in a reputable password manager if remembering them all is impractical.
Passkeys, security keys and two-factor codes: what changes?
MFA requires two or more different types of evidence, such as something you know (a password), something you have (a security key or phone), or something you are (a biometric unlock on a device). The methods are not equally resistant to attack.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Passkeys
A passkey is a FIDO credential based on public-key cryptography. Your device or credential manager keeps the private key; the service stores a public key. During sign-in, the service verifies a cryptographic response rather than receiving a reusable password. Because the credential is bound to the legitimate website or app, a convincing copycat site cannot normally use it.
FIDO2 combines WebAuthn with CTAP. External authenticators can communicate over USB, near-field communication (NFC), or Bluetooth Low Energy; platform passkeys may be unlocked with a device PIN or biometric. The exact sign-in flow depends on the operating system, browser, account, and credential manager.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Some passkeys are syncable: an encrypted credential can become available on several trusted devices. NIST’s April 2024 supplement explains that correctly implemented syncable authenticators can provide phishing resistance, cross-device support, simpler recovery, and convenient device authentication. Other credentials are device-bound and stay on one authenticator. Check how a particular service handles backup and recovery rather than assuming every passkey is portable.
Physical security keys
A physical security key is a separate FIDO authenticator that you carry. It can provide phishing-resistant sign-in and is useful as a primary factor or a backup to a platform passkey. Compatibility matters: confirm that the account supports security-key sign-in and that your key and device share a connector or protocol such as USB, NFC, or Bluetooth Low Energy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep a safe recovery plan. A lost key can lock you out if it is your only method, so enroll an additional key or another service-approved recovery option before relying on it.
Authenticator apps
An authenticator app generates a time-based one-time password (OTP), usually a six-digit code. It is generally safer than SMS against SIM-swap attacks and safer than email codes when the email account could itself be compromised. The Federal Trade Commission (FTC) advises choosing an authenticator app or security key when available.
An OTP is not phishing-proof. NIST explains that a manually entered code can be relayed: an attacker captures it on a fake site and submits it to the genuine service before it expires. Treat an authenticator app as a strong fallback, not as equivalent to a passkey or security key.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
SMS and email codes
Text messages can be intercepted after a SIM swap, and an email code is only as secure as the email account receiving it. Both are still usually better than password-only access and may be the only option a service offers. Use them when stronger methods are unavailable, then upgrade if the service adds passkeys, security keys, or app-based MFA.
| Method | What it does well | Limitations and practical checks |
|---|---|---|
| Passkey | Strong phishing resistance; convenient sign-in; may work across trusted devices when syncable | Availability, syncing behavior, and recovery differ by service and credential manager |
| Physical security key | Strong phishing resistance and a separate physical factor | Requires supported connectors or protocols; keep a backup or recovery route |
| Authenticator app | Usually resists SIM-swap attacks and is widely offered | Manually entered OTPs can still be phished or relayed; protect the app and its backup |
| SMS or email code | Accessible fallback and better than password-only sign-in | Vulnerable to SIM swaps, email takeover, and phishing |
| Password alone | Simple; a unique long password limits guessing and reuse damage | Does not stop phishing or use of a stolen credential |
Which accounts should get MFA first?
Start with accounts that can unlock other accounts or expose money and identity information. The FTC specifically lists banking, credit cards, email, social media, tax filing, and payment apps as sensitive targets.
- Primary email: attackers who control it may request password resets elsewhere and read security notifications.
- Banking and credit-card accounts: unauthorized access can directly move money or expose financial records.
- Payment services and digital wallets: protect stored payment methods and transaction history.
- Tax and government-service accounts: these contain identity and filing information that is difficult to replace.
- Social-media accounts: takeover can spread scams to contacts and provide personal information for further attacks.
- Work, school, and cloud-storage accounts: follow your organization’s required method, especially where shared files or administrative privileges are involved.
After those, enable MFA on shopping, travel, forums, gaming, and other accounts according to the value of the data and the harm an attacker could cause. CISA’s business guidance ranks physical security keys above authenticator apps with number matching, then apps that generate one-time codes, with text or email codes as the weakest of those listed choices. That ordering is useful for comparing methods, not a personalized consumer risk score.
How to turn on the strongest available protection
Account labels vary, but the process is similar. MFA is often not enabled by default, so look for it deliberately.
- Inventory high-impact accounts. Write down your primary email, financial, payment, tax, social, work, and cloud accounts. Do the email account first because it can reset others.
- Open the security settings. Look for labels such as Passkey, Two-factor authentication, Two-step verification, or Multifactor authentication. Use the service’s current help page if the setting is not obvious.
- Choose a passkey or security key. Follow the enrollment prompt, unlock the device or key when requested, and record which devices or keys are registered. Verify that the account supports your connector or NFC/Bluetooth method.
- If neither is offered, enroll an authenticator app. Scan the setup QR code, enter the displayed OTP to confirm enrollment, and keep the app protected by the device’s screen lock. If the service offers number matching or push approval, check the sign-in details before approving an unexpected request.
- Use SMS or email only as a fallback. Add it when necessary, but do not mistake accessibility for phishing resistance. Secure the receiving phone number and email account separately.
- Replace reused passwords. Generate a unique password for each account and save it in a password manager. A password manager helps with uniqueness and storage; it does not remove the need for phishing-resistant MFA.
- Set up recovery before you need it. Download or write down recovery codes, enroll an additional approved method, or register a backup key according to the service’s instructions. Store the only copy somewhere separate from the account it recovers.
- Test the plan. Sign out and confirm that your passkey, key, app, or recovery code works. Check that you can still sign in if your usual phone is lost, replaced, or offline.
Never give a verification code to someone who contacts you unexpectedly. The FTC warns that scammers specifically ask for these codes; a legitimate support representative should not need you to read one back to them.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How phishing resistance affects real attacks
Stolen password and fake login page
With password-only sign-in, a criminal can reuse a captured password immediately. An OTP may stop the attempt unless the attacker relays the code in real time. A passkey or security key normally refuses to authenticate to the wrong site because the credential is tied to the legitimate origin.
Password reuse after a breach
If one service is breached, attackers test the exposed password on other sites. Unique passwords limit the blast radius; MFA adds another barrier even when a password is known.
SIM swap or phone-number takeover
An attacker who convinces a carrier to move your number can receive SMS codes. Authenticator apps, passkeys, and security keys do not depend on that text-message channel, although an attacker who controls your email may still exploit email-based recovery.
Code-relay scams
A caller or fake support page may ask for the OTP sent to your phone or generated by your app. Giving it away can complete the attacker’s login. Stop the interaction, open the service yourself, and review recent security activity.
Recovery is part of authentication security
A method is only practical if you can recover the account without weakening it. Before deleting an old phone, resetting a device, or replacing a security key, add the new method and test it. Keep recovery codes in a protected location separate from the device and account they are meant to restore; a printed copy in a secure place can be useful if your devices are unavailable.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Syncable passkeys can simplify cross-device use, but syncing and recovery are implemented differently across platforms. A passkey may be available on another trusted device, or it may require the original device, a cloud credential manager, or an account-specific recovery process. Read the service’s current instructions and maintain at least one backup route.
Common mistakes and the fix for each
- Using one password everywhere: replace it with unique generated passwords.
- Assuming an OTP is phishing-proof: remember that codes can be relayed; prefer a passkey or security key.
- Leaving MFA disabled because setup is inconvenient: enable the strongest available option now and improve it later.
- Relying on one device or key: enroll an approved backup method before the primary one fails.
- Keeping recovery codes only inside the account: store them separately so they remain available during lockout.
- Approving an unexpected push or sharing a code: deny it, end the contact, and start a sign-in from the official app or website.
- Assuming every passkey behaves the same: check whether it is syncable or device-bound and how the service handles replacement and recovery.
What the standards recommend
NIST’s 2025 guidance sets the password thresholds noted above and explicitly says passwords are not phishing-resistant: NIST SP 800-63B-4, Authentication and Authenticator Management. Its April 2024 supplement discusses the security and usability properties of syncable authenticators such as passkeys: NIST supplement on syncable authenticators.
The FTC’s consumer guidance recommends turning on two-factor authentication and choosing an authenticator app or security key when available: Use Two-Factor Authentication To Protect Your Accounts. FIDO’s specifications explain the public-key foundation and external-authenticator protocols behind passkeys and security keys: FIDO User Authentication Specifications. For organizational MFA planning, CISA provides a method comparison and phishing-resistant MFA guidance: Require Multifactor Authentication.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe practical decision
For a valuable account, keep the unique password, then add a passkey or physical security key if the service supports one. Choose an authenticator app when it does not. Use SMS or email codes when they are the only available protection, while treating them as a step toward better security rather than the final goal. Register recovery methods before a device is lost, and review the account’s supported options whenever its platform or security settings change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
