The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use a FIDO2/WebAuthn hardware security key when the account supports one. It is the strongest broadly available fallback because it uses cryptography and is designed to resist phishing. Register a second key or another recovery method at the same time. If security keys are unavailable, use a unique password stored in a password manager and add the strongest second factor the service offers—prefer an authenticator-app code or number-matched push approval over SMS. Keep recovery codes offline before changing or removing any sign-in method.
What to use when passkeys are unavailable
Passkeys are FIDO credentials stored on a phone, computer or security key. An account that has not implemented passkey sign-in may still support part of the same standard under a different label: security key, FIDO2 key or WebAuthn authenticator. Check for that option first. A physical key gives you phishing-resistant cryptographic authentication without requiring the website to call the feature a passkey.
When no FIDO/WebAuthn option exists, combine two controls:
- A long, unique password generated and stored by a password manager.
- The strongest second factor offered by the service, usually an authenticator-app one-time password (TOTP) or a number-matched push approval.
Use SMS or voice codes only when stronger methods are absent. NIST classifies PSTN (telephone-network) out-of-band authentication as restricted. Recovery codes are not a daily login method; they are emergency credentials that should be protected like cash.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How the alternatives compare
| Method | Phishing protection | Compatibility | Daily use and recovery |
|---|---|---|---|
| FIDO2/WebAuthn hardware key | Highest among broadly available fallbacks; cryptographic and phishing-resistant | The account, browser, connector and USB or NFC interface must support security keys | Carry the key; enroll a second key and save recovery codes |
| Platform or other cryptographic authenticator | Phishing-resistant when implemented as FIDO/WebAuthn | Depends on the service and device | Easier daily use; losing the device requires a backup path |
| Authenticator-app TOTP | Better than a password alone and generally preferable to SMS, but manually entered codes can be phished | Widely supported; requires an enrolled app and a device with accurate time | Back up the app where the provider supports it and save recovery codes |
| Push approval | Convenient; protection depends on anti-fatigue controls and number matching | Service-specific | Keep a backup factor and reject unexpected prompts |
| Password plus password manager | Unique passwords reduce reuse and breach impact, but passwords are not phishing-resistant | Works almost anywhere passwords are accepted | Protect the vault with a long master passphrase and MFA; vault compromise has high impact |
| SMS or voice OTP | Lowest fallback choice; NIST treats PSTN out-of-band authentication as restricted | Very common | Exposed to phone-number and message-delivery risks; use only when stronger methods are unavailable |
| Recovery codes | Emergency recovery secret, not a normal sign-in method | Available only when the service issues them | Store offline and prevent unauthorized access |
1. FIDO2 or WebAuthn security keys
Why this is the best fallback
A security key performs a cryptographic challenge-response with the legitimate website. The key verifies the website origin before releasing a response, so a look-alike login page cannot simply collect a reusable code. NIST’s February 2024 guidance identifies FIDO authenticators paired with WebAuthn as widely available phishing-resistant authenticators. CISA likewise describes a physical security key, such as a YubiKey, as the strongest anti-phishing choice among common MFA options.
The key is separate from your phone or computer, which limits the damage from a lost device. It does introduce a physical-object problem: a key left at home is unavailable when you travel, and a lost key must be replaced through another enrolled factor.
What must be supported
- The account must offer security-key, FIDO2 or WebAuthn enrollment; a generic “USB token” setting may be a different technology.
- Your browser and operating system must support the standard.
- Your device needs the connection the key uses: USB-A, USB-C or NFC.
- The account’s recovery process must be usable if every enrolled key is lost.
Enrollment procedure
- Open the account’s security, sign-in or multifactor-authentication settings.
- Choose Add security key, FIDO2 key or WebAuthn.
- Complete the account’s current password or existing MFA challenge.
- Insert the key or hold it near the device’s NFC reader, then touch or otherwise activate it when prompted.
- Give the credential a name that identifies its location, such as “desk key” or “travel key.”
- Repeat enrollment with a second key, or add another supported authenticator before leaving the page.
- Generate and save the service’s recovery codes offline.
Do not enroll only one key if the account protects irreplaceable data. Two keys let you keep one in a secure location while using the other. A key is an authentication factor, not a backup by itself; the backup is the second key or a documented recovery route.
Recommended Free Tools
2. Platform authenticators and other cryptographic methods
Some services support a cryptographic authenticator built into a phone, tablet or computer even when their interface does not use the word “passkey.” If the enrollment flow invokes WebAuthn and asks you to approve with the device’s biometric sensor, screen lock or hardware-backed credential, it is operating in the phishing-resistant FIDO family.
This option is easier than carrying a USB key and normally makes daily sign-in quick. Its weakness is recovery: losing, resetting or replacing the device can remove the authenticator. Before relying on it, confirm that the service lets you enroll a second device, a hardware key or recovery codes. Do not assume that a device backup automatically restores every credential; the service’s own recovery documentation controls what is possible.
3. Authenticator-app TOTP
What it improves
Time-based one-time passwords (TOTP) are generated by an authenticator app from a shared secret and the current time. They are substantially better than a password alone and are generally preferable to SMS. A stolen password cannot be used without the current code.
Why it is not phishing-resistant
NIST notes that manually entered OTPs are not phishing-resistant. An impostor verifier can ask for the current six-digit code and relay it to the real service before it expires. Treat every unexpected request for a code as suspicious, even when the number appears to be changing normally.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Setup and backup
- In the account’s security settings, select Authenticator app or Time-based one-time password.
- Display the enrollment QR code only on the legitimate account site. If the service provides a setup key, keep it private.
- Scan the code with the authenticator app and enter the current code to confirm enrollment.
- Save the account’s recovery codes offline before closing the setup page.
- Use the app’s supported backup or transfer feature if the provider offers one. Verify that a restored copy can generate valid codes before wiping the old device.
- Keep the phone or tablet clock set automatically. A large time drift can make every code fail.
Do not photograph QR codes or setup keys into an unprotected photo library. Anyone who obtains the shared secret can generate future codes. If the secret may have been exposed, remove that authenticator from the account and enroll a new one.
4. Push approvals and number matching
Push MFA sends a sign-in request to an enrolled device. It is convenient because you approve instead of transcribing a code, but the security depends on how the service handles unsolicited prompts. Repeated approval requests can wear users down, a tactic commonly called MFA fatigue.
Number matching is stronger than a simple “Approve” button: the website displays a number and the app requires you to select or enter the same number. It gives you context to distinguish your own sign-in from an attacker’s request. Still, never approve a prompt you did not initiate. Reject it, change the password if you suspect it was exposed, and review recent account activity.
Push should not be your only recovery path. Keep a hardware key, TOTP authenticator or offline recovery codes enrolled, and test that backup while you still have access to the account.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems5. Passwords managed correctly
Use a different generated password for every account
A password manager can create long random passwords and fill them only on the saved website address. Unique passwords prevent a breach at one service from unlocking another. NIST’s password guidance says that for accounts requiring passwords, experts highly recommend using a password manager.
Passwords still have a fundamental limit: NIST states that passwords are not phishing-resistant. A malicious site can persuade you to type the password into a convincing imitation. The manager’s domain matching and autofill behavior can reduce mistakes, but they do not turn a password into a cryptographic sign-in.
Protect the vault
- Choose a long master passphrase that is not reused anywhere else.
- Enable MFA on the password-manager account, preferably with a security key or authenticator app.
- Keep an offline emergency record of the recovery information required by the provider, stored where unauthorized people cannot reach it.
- Review active sessions and connected devices after any suspected compromise.
Because the vault contains many credentials, a vault takeover has high impact. A password manager is therefore the foundation for password-only accounts, not a substitute for a second factor.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
6. SMS and voice codes: a last resort
SMS and voice one-time passwords are common because almost every account can send them, but they provide the weakest protection in this list. NIST classifies PSTN-based out-of-band authentication as restricted. Phone-number control, message delivery and carrier processes can all become failure points, and a code sent to a phone may arrive late or not at all.
If SMS is the only method, use it rather than leaving the account unprotected, but keep looking for a stronger option. Add a security key, platform authenticator or TOTP as soon as the service supports one. Do not disable SMS until you have verified another login and recovery method; removing the only working factor can lock you out.
7. Recovery codes and account recovery
Save codes before you need them
Recovery codes are usually one-time secrets issued when MFA is enabled. They are designed for a lost phone, damaged key or unavailable authenticator, not for routine sign-in. Download or copy them during enrollment, print them or write them down, and store them offline in a place protected from visitors and unauthorized household access.
Keep recovery from becoming the weakest link
- Do not store the only copy inside the account that the codes recover.
- Do not email codes to yourself or leave them in an unprotected notes app.
- After using a code, mark it as consumed and generate a fresh set if the service allows it.
- Update the codes when you replace a security key, phone or authenticator.
- Read the provider’s identity-verification process before an emergency. Some services require a waiting period or human review.
Knowledge-based questions are not a strong recovery substitute. NIST says that asking for information presumed known only by the claimant does not constitute an acceptable secret for digital authentication. Recovery should rely on previously enrolled authenticators or service-issued codes, not facts that may be guessed or found online.
Choose a configuration by account risk
For email, cloud storage and financial accounts
Use two FIDO2/WebAuthn keys when available, with recovery codes stored offline. If keys are unsupported, use a unique password in a manager plus TOTP or number-matched push, then add every recovery method the service documents. These accounts can reset other accounts, so do not rely on SMS alone.
For work or school accounts
Follow the organization’s approved enrollment and recovery policy. Ask administrators whether security keys, platform authenticators or number matching are supported. Keep a personal record of which factor is registered, but do not copy employer recovery secrets to an unmanaged device.
For low-risk services
A unique password and authenticator-app MFA may be proportionate when the account contains little sensitive data. Still enable MFA if offered, because attackers often use low-value accounts to reach reused passwords or recovery email addresses.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For accounts used while traveling
Carry a primary and backup authenticator separately. A hardware key avoids dependence on mobile reception, while TOTP works without a network after enrollment. Keep recovery codes offline and do not place both keys or every device in the same bag.
Step-by-step hardening checklist
- Open the account’s security settings and list every available sign-in and recovery method.
- Select FIDO2, WebAuthn or security-key enrollment if it is present.
- Enroll two keys, or a key plus a supported platform authenticator.
- If no cryptographic method is available, change the password to a unique generated value saved in your password manager.
- Enable TOTP or number-matched push. Prefer TOTP over SMS when push lacks number matching or anti-fatigue controls.
- Generate recovery codes and store them offline.
- Test a backup sign-in in a private window or on a second device without deleting the primary factor.
- Review active sessions, remembered devices and connected applications; revoke anything unfamiliar.
- Only after the backup works, consider disabling weaker fallback methods.
Troubleshooting common failures
The security-key option is missing
Search the account’s security page for “security key,” “hardware key,” “FIDO2” or “WebAuthn.” Some services hide enrollment until an existing password or MFA challenge is completed. Try a current browser and another supported USB port or NFC reader. If the service genuinely offers no cryptographic option, move to a password manager plus TOTP or push.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The key is detected but enrollment fails
Confirm that the key is activated when prompted, that the browser has permission to use it and that the account is not being opened inside an embedded app browser. Try the other connector type or a different supported browser. Do not repeatedly reset the key unless you understand that reset can erase credentials for other accounts.
TOTP codes are rejected
Set the device’s date, time and time zone to automatic, then wait for a new code. Verify that you selected the correct account entry and that the enrollment QR code was not scanned twice into conflicting entries. If the service offers a resynchronization control, use it. Otherwise, use recovery codes and enroll a fresh authenticator.
Push prompts never arrive
Check that the app is signed in, notifications are enabled and the device has network access. Do not approve a delayed prompt that you did not initiate. Use the enrolled backup factor, then review sessions and re-enroll the push device if necessary.
You lost the only key or phone
Use the second enrolled key, authenticator backup or an unused recovery code. After signing in, revoke the lost credential, change the password if it may be exposed, enroll a replacement and generate new recovery codes. If no backup exists, follow the service’s documented account-recovery process; support may not be able to bypass its verification requirements.
What not to do
- Do not reuse one password because an account lacks passkeys.
- Do not treat a six-digit TOTP as phishing-proof.
- Do not approve an unexpected push request to make it disappear.
- Do not keep the only recovery codes inside the account they unlock.
- Do not remove your old factor until a new factor and its recovery path have been tested.
- Do not publish setup keys, QR codes or recovery codes in screenshots, tickets or chat.
Bottom line
A missing passkey button does not mean you must settle for a password alone. Choose a FIDO2/WebAuthn hardware key whenever the account supports security keys, enroll a spare and store recovery codes offline. Otherwise, use a password manager for a unique password and add TOTP or number-matched push; reserve SMS for situations where no stronger factor exists. The safest setup is the one with a phishing-resistant primary method and a recovery plan you have tested before an emergency.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
