Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use a hardware security key when your bank or exchange supports FIDO2, WebAuthn, U2F, or passkeys. It provides the strongest practical protection against phishing because the credential is cryptographically tied to the legitimate website. Use a TOTP authenticator app when a provider does not accept a key, when several people need shared access, or when portability and easier recovery outweigh maximum phishing resistance. Whichever method you choose, enroll a backup key or document an offline recovery route before removing your existing factor.
What you are comparing
“Authenticator app” covers two different mechanisms. A TOTP app stores a shared secret and generates a short, time-based one-time password, usually a six-digit code. A push authenticator sends an approval request that you accept or deny on the phone. They have different failure modes, so do not treat every app-based method as equivalent.
A hardware security key uses FIDO2/WebAuthn or the older U2F standard. During enrollment, the key creates an asymmetric credential for a particular service. During sign-in, the service sends a challenge; the key signs it and returns the result. The browser and key verify the legitimate website origin, rather than asking you to type a reusable code.
Recommended Free Tools
NIST describes WebAuthn’s “verifier name binding” as the reason it is phishing-resistant: the authenticator chooses its secret for the authenticated domain name of the verifier. A fake site can copy the appearance of a bank’s login page, but it cannot obtain a valid signature for the bank’s origin. CISA therefore ranks physical security keys above number-matching prompts, authenticator-app one-time codes, biometrics, and text or email codes.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
CISA’s ordering says a security key “provides the best protection against phishing and is easy to use.”
TOTP authenticator apps
When you enroll a TOTP app, the service displays a QR code containing a shared secret. The app and service use that secret and the current time to calculate the same temporary code. You type the code into the service’s official app or website. Coinbase says any TOTP-compatible application should work; Fidelity lists Google Authenticator, Microsoft Authenticator, and Apple Passwords as examples.
TOTP is substantially safer than password-only or SMS-only login, but it is not phishing-proof. A criminal can run a real-time proxy, ask for your password and current six-digit code, and relay both to the legitimate service before the code expires. Malware or a malicious browser extension can also read a code while you are entering it. Push approval removes typing but introduces approval fraud: an attacker who repeatedly sends prompts may eventually persuade a tired or hurried user to tap Allow.
FIDO2, WebAuthn, and U2F keys
A security key does not display a code for an attacker to copy. It signs a challenge only for the enrolled relying-party domain, with a physical action required to release the signature. FIDO2 keys are cryptographic hardware; Microsoft’s mapping to NIST classifications treats them as multi-factor cryptographic authenticators when the key and its local activation requirement are used together.
The protection is conditional on support. The account must offer “security key,” “FIDO2,” “WebAuthn,” “U2F,” or “passkey” enrollment, and the key must match your devices’ connector or NFC capabilities. Losing the only enrolled key can lock you out, so a backup is part of the design rather than an optional accessory.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Security and usability comparison
| Factor | TOTP authenticator app | Hardware security key |
|---|---|---|
| Phishing resistance | Codes can be captured and relayed; push requests can be socially engineered. | Highest among the options compared here because WebAuthn binds the credential to the legitimate origin. |
| Service compatibility | Broad support; Coinbase says any TOTP-compatible app should work, and Fidelity documents app enrollment. | Only services implementing FIDO2/WebAuthn, U2F, or passkeys can use it. Bank support varies. |
| Recovery after loss | Often easier when the provider supports multiple devices, backup codes, or a documented re-enrollment process; a lost phone still requires account recovery. | Enroll a second key and store recovery codes offline. Without either, recovery depends on the provider’s identity checks. |
| Portability | Convenient on a phone; moving secrets between devices must use the app vendor’s documented secure process. | Portable between compatible computers and phones; connector and NFC choices matter. |
| Exposure to phone malware | The secret and displayed code are on the phone; a compromised device or cloud backup becomes part of the threat model. | The private credential remains in the key, reducing exposure to phone malware, although the account, browser, and recovery channels still matter. |
| Setup friction | Scan a QR code, confirm a code, and protect the phone with a passcode or biometric lock. | Enroll each key, confirm that every device can use its connector or NFC, and test the backup before relying on it. |
| High-risk actions | Only as strong as the service’s policy; a phished code may authorize a transfer if the same factor covers it. | Some services require a physical key for withdrawals, transfers, settings, or permission changes. |
| Cost | Usually no separate hardware purchase; any backup or cloud-sync arrangement has its own security trade-offs. | Requires a one-time hardware purchase; a resilient setup normally buys two compatible keys. The cited guidance does not state a universal price. |
There is no directly comparable consumer percentage showing that one method prevents a specific share of banking or crypto losses. The defensible distinction is qualitative: CISA places keys first, and NIST explains the technical origin binding that makes WebAuthn resistant to ordinary credential-phishing pages.
Which banking and crypto services support each method?
Compatibility is the first decision point. Security keys cannot be enabled on an account whose provider offers only app codes or SMS, so check the provider’s own security documentation rather than assuming that a popular bank or exchange supports the same factors as another.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Provider or service | Documented options | What that means for your choice |
|---|---|---|
| Coinbase retail | Documentation lists SMS, authenticator application, and security-key methods. Coinbase says TOTP-compatible apps should work. | Use a key or passkey when available; keep an authenticator method or the provider’s recovery path until the key has been tested. |
| Coinbase Prime | Coinbase states that the account owner and designated teammates must use a YubiKey or another physical security key for sign-in, withdrawals, transfers, settings, and permission changes. | A physical key is a requirement for these Prime operations, not merely an optional upgrade. |
| Binance | Its documentation covers authenticator apps and passkeys, including hardware authenticators, with controls for login, assets, account settings, and security management. | Review which controls your account exposes to the selected factor and enable the strongest available option for withdrawals and account changes. |
| Fidelity | The cited banking guidance documents authenticator-app enrollment and names Google Authenticator, Microsoft Authenticator, and Apple Passwords as examples. It warns users to enter codes only in the official Fidelity app or website. | An app may be the available choice; follow the official-domain warning every time you enter a code. |
| Chase | The cited security page documents passkey support. | Passkey availability illustrates why bank capabilities differ; inspect your own account’s enrollment screen for the exact options. |
How to choose for your situation
Choose a hardware key first when phishing is your main concern
Use a FIDO2/WebAuthn key for accounts that hold substantial cash or digital assets, administer business permissions, or can change withdrawal destinations. The key’s origin binding prevents the most common fake-login workflow: a criminal cannot simply collect a valid six-digit code from a convincing copy of the site.
Choose an authenticator app when the provider does not support keys
Many banks still document app-based MFA without offering direct FIDO2 enrollment. In that case, TOTP is the practical secure upgrade over password-only or SMS-only login. Use it even though it is not equivalent to a phishing-resistant key.
Use an app when several people must access one account
Shared access is easier to arrange with a provider that supports multiple authenticator devices or a controlled recovery process. Sharing one physical key is poor accountability: you cannot tell which person approved an action, and a lost shared key affects everyone. For business services that support individual hardware keys, issue one key per person instead.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Favor a key for high-value, infrequent actions
A key is especially useful for an account where you rarely sign in but occasionally approve a withdrawal, add a bank instruction, or change permissions. The physical-presence step slows an attacker even if a password has been exposed. Confirm that the service actually requires the key for those sensitive actions; some services protect only login.
Favor an app when portability and recovery dominate
A phone is often easier to replace than a sole hardware key, particularly when the service offers backup codes or multiple-device enrollment. That convenience is safe only when the app’s secret is backed up through the vendor’s documented protected process and the phone itself has a strong passcode or biometric lock.
Set up a hardware key correctly
- Inspect the account’s security page. Search the provider’s help center and enrollment screens for “security key,” “FIDO2,” “WebAuthn,” “U2F,” or “passkey.” Do not buy a key until you know which standard and connector the service and your devices accept.
- Choose compatible hardware. Match USB connector and NFC capability to the computers and phones you will use. If you sign in from both a laptop and a phone, verify that the same key can work with both or select a model that covers both connection methods.
- Enroll a primary and a backup key in one session. Add the first key, then immediately add the second. Label them without recording account passwords on the label; store the spare in a separate secure location.
- Test both keys before changing anything else. Sign out and back in with each key. If the service offers a test for withdrawals, settings, or permission changes, verify those workflows as well, using a safe account state where possible.
- Save recovery codes offline. Print or write them and store them where fire, theft, and unauthorized household access are considered. Do not leave the only copy in the same bag as the key.
- Keep the old factor until testing is complete. Remove an old phone number or authenticator only after both keys work and you understand the institution’s recovery process. Removing the old factor first can turn a setup mistake into a lockout.
Set up and protect a TOTP authenticator app
- Install a reputable TOTP app from the official app store. Avoid an unverified clone. The provider’s instructions should identify the app category or accepted standard.
- Start enrollment from the official account site or app. Open the account’s security settings, choose authenticator-app MFA, and scan the QR code. If scanning is impossible, use the manual secret only on the genuine service and genuine app.
- Confirm the first code. Enter the displayed six-digit code in the official service window, not in a link supplied by an unsolicited email, text, phone call, or direct message.
- Secure the phone. Use a strong device passcode and enable the phone’s biometric lock if appropriate. Keep the operating system and authenticator app updated.
- Back up only through documented protections. If the app offers encrypted synchronization or an export, read how its keys are protected before enabling it. An unencrypted screenshot, email, or cloud note containing the secret lets anyone who obtains it generate future codes.
- Store the service’s recovery codes offline. A TOTP backup is not the same as a screenshot of the QR code; preserve the provider-issued recovery material separately and test the recovery instructions before an emergency.
Plan for loss, theft, and lockout
If you lose the only security key
Use the enrolled backup key or an offline recovery code. If neither exists, follow the provider’s account-recovery process; expect identity checks and delays, and do not assume support can bypass the factor instantly. Once access is restored, revoke the missing key and enroll two replacements.
If your phone is lost or replaced
Use a second enrolled device, the provider’s recovery codes, or its documented re-enrollment procedure. Contact the mobile carrier and secure the email account associated with the financial account, because email recovery can undermine otherwise strong MFA.
If a key or phone is stolen
Sign in with the remaining factor, revoke the stolen credential, change the account password if it may have been exposed, and review recent sign-ins, security-setting changes, withdrawal addresses, and beneficiaries. For a crypto account, check pending withdrawals and API or trading permissions immediately.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do not remove the old factor prematurely
Keep the existing factor until the replacement has been used successfully on every device and for every sensitive action you need. A successful login test alone does not prove that withdrawals, transfers, or permission changes will accept the new factor.
Banking-specific precautions
Bank websites often separate login MFA from payment authorization. A bank may support an authenticator app for sign-in but use a separate confirmation step for a new payee, wire, or transfer. Read the security page and the confirmation screen to learn exactly what the factor protects.
Enter an app code only after navigating to the bank’s address yourself or opening its official app. Fidelity’s guidance explicitly warns users to enter codes only on the official Fidelity app or website. A caller who says a code is needed to “stop fraud” is asking you to authorize the attack; end the call and contact the bank through a trusted number.
For a bank that supports passkeys or security keys, enroll the key on every relevant profile and browser, then make a small, low-risk change to confirm that the account recognizes it. Keep recovery codes offline and ensure a trusted co-owner or estate plan can reach the recovery instructions without possessing your everyday login password.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesCrypto-specific precautions
Exchange MFA protects the exchange account; it does not approve every transaction safely. Separately protect the email account used for recovery, the exchange login, withdrawal controls, API keys, and any hardware wallet. Review the destination address and network on the exchange’s own confirmation screen before approving a withdrawal.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Use the strongest factor available for withdrawal-address changes, transfers, permission changes, and security-setting edits. Coinbase Prime’s documented policy requires a physical key for sign-in and these sensitive actions. Binance documents controls that can apply to login, assets, account settings, and security management; inspect your account’s exact settings rather than assuming every action has identical protection.
Do not share one key among a team when the platform supports individual users. Individual enrollment preserves accountability and lets you revoke one person’s access without replacing everyone else’s keys. If a service offers only one shared login, document who holds the backup key and how an emergency recovery will be authorized.
Common mistakes and how to fix them
- Buying a key before checking support: Confirm FIDO2/WebAuthn, U2F, or passkey support and the required connector first. If the provider supports only TOTP, use an app instead.
- Keeping only one key: Enroll a second compatible key before making the first one mandatory.
- Storing recovery codes with the device: Keep offline recovery material in a separate secure location so one theft does not remove both options.
- Approving an unexpected push: Deny it, change the password from the official site, review sessions, and contact the provider through a trusted channel.
- Typing a code into a link from a message: Close the link and open the official app or type the known address manually.
- Assuming a passkey protects withdrawals: Verify which actions require it. Login protection may not cover payment instructions or transfer approvals.
- Synchronizing secrets without understanding the protection: Read the authenticator vendor’s documentation and avoid unencrypted exports or screenshots.
- Using account MFA as a substitute for transaction review: Inspect addresses, amounts, recipients, and networks every time, particularly for crypto transfers.
Cost, maintenance, and total ownership
An authenticator app normally avoids a separate hardware purchase. Its less visible costs are recovery planning, secure device replacement, and the effort of protecting synchronized secrets. A hardware-key setup requires buying at least two compatible keys; the cited guidance does not establish a universal retail price, so compare the actual model price, connector options, and support life before purchase.
Maintenance is simple but deliberate: keep two keys enrolled, replace a damaged or missing key promptly, review account sessions after travel or a phone change, and regenerate recovery material when the provider allows it. For apps, test restoration before replacing a phone and verify that the new device generates accepted codes before wiping the old one.
A practical decision checklist
- Does the account offer FIDO2, WebAuthn, U2F, or passkeys? If yes, prefer a hardware key.
- Can you buy and enroll two compatible keys? If not, keep a second recovery method and do not remove the existing factor.
- Does the service protect withdrawals, transfers, payee changes, and permission edits with the same factor? Check each action.
- If only app MFA is available, can you protect the phone, back up the secret through a documented secure method, and store recovery codes offline?
- Will multiple people need access? Prefer individual keys where supported; otherwise document shared-app access and recovery responsibilities.
- Have you tested the replacement factor and recovery route before an emergency?
Verdict
For banking and crypto accounts that support it, a hardware security key is the better primary factor because FIDO2/WebAuthn binds authentication to the legitimate site and resists phishing. A TOTP authenticator app remains the broadly compatible fallback and is clearly preferable to password-only or SMS-only login, but its code can be captured or relayed. The resilient arrangement is not “key versus app” in isolation: use a primary key, enroll a backup key, keep offline recovery codes, and retain an app or other documented recovery method until every account’s recovery path has been tested.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
