Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For a personal Google Account, open Security & sign-in, select Turn on 2-Step Verification under How you sign in to Google, and complete the prompts. Add a passkey separately at Google’s passkey settings using a device you personally own and can unlock. Keep at least one independent recovery method before depending on a single phone, computer or security key.
What 2-Step Verification and passkeys do
Two different protections are involved:
- 2-Step Verification (2SV) adds another check after a password when Google requests it. Depending on the sign-in context, that check can be a Google prompt, a one-time code, a security key or another challenge.
- A passkey changes the sign-in flow. Instead of entering a password and then completing a separate second step, you approve the sign-in by unlocking a device or hardware key. Google says a passkey verifies possession of that device and bypasses the separate second authentication step for that sign-in.
Creating a passkey does not delete your password, existing 2SV methods or recovery information. You can keep both protections available and choose another sign-in method when a passkey is unavailable. Because a passkey follows the device’s unlock protection, create one only on a phone, computer or key that you personally control. Anyone who can unlock that device may be able to access the account.
These methods protect different sign-in situations. A password sign-in can trigger a prompt or code, while a passkey can let you approve the sign-in directly with your device’s local unlock. A passkey is therefore not an extra code that you type after every password; it is an alternative credential that can replace the password-and-second-step sequence on a compatible sign-in.
Check compatibility before you start
Google’s published minimums, as listed in its account guidance accessed on October 13, 2026, are below. They describe supported platform versions, not a guarantee that every account policy, browser configuration or sign-in screen will offer the same flow.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Component | Google’s listed requirement | Important condition |
|---|---|---|
| Windows computer | Windows 10 or later | Screen lock must be enabled. |
| Mac | macOS Ventura or later | Screen lock must be enabled. |
| Chromebook | ChromeOS 109 or later | Screen lock must be enabled. |
| Android phone or tablet | Android 9 or later | Use a device you own and can unlock. |
| iPhone or iPad | iOS 16 or later | iCloud Keychain is required for Apple passkeys. |
| Browser | Chrome 109+, Safari 16+, Edge 109+ or Firefox 122+ | Keep the browser current; some browsers or systems may not support passkeys in Incognito mode. |
| Hardware security key | FIDO2 protocol support | Check the key’s connector and compatibility with each device. |
| Phone used across devices | Bluetooth enabled | Bluetooth is needed when a phone passkey approves a sign-in on another computer. |
Turn on the device’s screen lock before starting passkey setup. A PIN, password, fingerprint or face unlock is handled locally by the operating system; Google does not receive the biometric data. Google’s account guidance states that biometric data “stays on your device and is never shared with Google.”
Update the operating system and browser before troubleshooting. The listed versions are minimums, and an organization’s policy, an unusual browser configuration or a device-management restriction can still change which controls appear. If a passkey prompt does not appear in a private or Incognito window, retry in a normal browsing window.
How to turn on 2-Step Verification
- Sign in to the Google Account you want to protect.
- Open Security & sign-in.
- Under How you sign in to Google, select Turn on 2-Step Verification.
- Follow the on-screen setup prompts. Google will show the verification methods available for your account and devices.
- Complete the test or confirmation step, then review the recovery options shown in your account.
After 2SV is enabled, a password sign-in can require an additional verification challenge. Google chooses the challenge according to the sign-in context, device and account settings, so the prompt you see may differ from the one another person sees. Interface wording can change; if a label is slightly different, use the current Security & sign-in screen and the prompt that describes 2SV.
Some work, school and other organization accounts do not expose the same controls. An administrator can require, restrict or disable particular methods. If the setup option is missing on a managed account, contact the organization’s administrator rather than trying to change the policy yourself.
Enabling 2SV does not mean every future sign-in will always show the same second step. Google may remember a trusted session, assess the device and location, or ask for a challenge when it considers one necessary. Continue to keep your registered methods current even if prompts are infrequent.
Choose a second-step method when you use a password
Google supports several ways to complete 2SV. You do not need to buy a physical key to enable the feature or to create device-based passkeys.
| Method | Best fit | Limitations and safety notes |
|---|---|---|
| Google prompt | People who sign in with a password and have an eligible, signed-in phone. | Google recommends prompts over codes when you are not using a passkey. Prompts arrive on eligible signed-in Android phones or on iPhones with supported Google apps. Approve only a sign-in you initiated; an unexpected prompt can indicate that someone knows your password. |
| Authenticator app | People who need time-based codes without mobile service or text delivery. | Codes can be generated without an internet connection or mobile service. Keep another recovery route in case the phone is lost. |
| FIDO2 security key | People who want a physical second step or a key-based passkey. | Confirm FIDO2 support, connector type and device compatibility. A spare key stored securely can prevent a lockout. |
| SMS or voice code | People who need a familiar phone-number-based option. | Google warns that text and call codes can be vulnerable to phone-number-based attacks. Delivery depends on the carrier and location. |
| Backup codes | People who need an offline route when their normal device is unavailable. | Each code is single-use. Generating a new set of 10 invalidates the previous set. Store the codes privately and never share them. |
Google’s stated recommendation is: If you choose not to sign in with a passkey, we recommend you use Google prompts as your second step.
This does not make prompts mandatory; it identifies Google’s preferred alternative to codes for password-based sign-ins.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prompts are convenient, but they are not an invitation to approve every alert. Read the account and device information shown on the phone. If you receive an unsolicited prompt, deny it, change your password if appropriate and review account activity rather than approving the request just to dismiss the notification.
How to create a passkey
- On a personal device that you can unlock, open Google Account passkey settings.
- Select Create a passkey.
- Approve the browser or operating-system prompt.
- Unlock the device with its screen lock to finish registration.
- Repeat the process on other personal devices if you want more than one passkey.
A passkey is stored by the device platform or, for a hardware option, by the FIDO2 key. The setup screen may use a fingerprint, face recognition, PIN or password, but that local unlock is not sent to Google. If you are registering a phone to approve a sign-in on another computer, turn on Bluetooth on both devices and keep them close enough for the cross-device prompt to complete. Apple devices also need iCloud Keychain enabled.
Do not create a passkey on a shared, borrowed or public computer. The person who can later unlock that device could use the passkey. If a device is sold, given away or permanently lost, remove its passkey from the account as soon as you can sign in through another method.
Creating several passkeys can make everyday access easier, but each one increases the number of devices or keys that must be tracked. Give every personal device a screen lock, and remove credentials promptly when a device leaves your control. A passkey on a second personal device is also a useful recovery route, provided that device is kept separately from the primary phone.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesHow passkey sign-in works alongside 2-Step Verification
With a password, the normal sequence is password first and a second challenge when Google requests one. With a passkey, you select the passkey sign-in option and unlock the registered device or key. Google treats that possession-and-unlock check as the sign-in verification for that session, so it bypasses the separate 2SV step for that sign-in.
This is not a choice between keeping and deleting 2SV. Your password, prompts, authenticator codes, security keys, backup codes and account-recovery routes remain important if you sign in from a device without the passkey. If the passkey option is not offered, select Try another way to return to the available password and 2SV choices. Review the Skip password when possible setting if you want Google to offer passkey-first sign-ins where supported.
To sign in with a passkey instead of a password, look for the passkey or “use your passkey” choice on the Google sign-in screen, select the registered device or key, and complete its local unlock. If the passkey is on your phone and the sign-in is on another computer, approve the cross-device request with Bluetooth enabled. The exact button labels can vary by browser and platform.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Passkeys are designed to resist phishing because the credential is tied to the legitimate site and device interaction rather than a code that can be copied into a fake site. Still, protect the device itself: anyone who can unlock it may be able to complete the passkey sign-in.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Build a recovery plan before you lose a device
Account protection is incomplete if the only second step is a phone that can be lost, damaged or replaced. Set up at least one independent route and keep it somewhere you can reach without the primary device.
- A second phone already signed in to the account.
- Another phone number added to 2-Step Verification.
- A passkey on a second personal device.
- A hardware security key already registered to the account.
- A printed or securely stored set of backup codes.
- The account-recovery options Google provides for your account.
To prepare backup codes, first enable 2-Step Verification, then use the account’s backup-code option to generate a set. Google supplies 10 codes in a set; each becomes inactive after one use, and generating a replacement set invalidates every code from the old set. Print the codes or store them in a private, protected location with other important documents. Google says it will not ask for a backup code except during sign-in, so never send one to a person who requests it by message, phone or email.
Keep a spare security key in a secure location if a physical key is your main method. The spare should be added to the account before the primary key is lost; buying an unregistered replacement after a lockout does not restore access by itself.
Test your recovery plan while you are still signed in. Confirm that you know where the backup codes are, that a spare key is registered, and that a second device can reach the account. Do not store every recovery method in the same bag or alongside the only phone; a single theft or loss should not remove all options.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Troubleshoot common setup and sign-in problems
The 2-Step Verification option is missing
Confirm that you are in the intended Google Account and that you opened Security & sign-in, not a browser or device settings page. If the account belongs to work, school or another organization, an administrator may control the feature. Ask that administrator which methods are permitted.
A passkey is not offered
- Enable a screen lock on the device and try again.
- Confirm the operating-system and browser versions meet Google’s listed minimums.
- On an Apple device, turn on iCloud Keychain.
- For a phone approving another computer, enable Bluetooth on both devices.
- Leave Incognito or private browsing if the browser does not support passkeys there.
- Check Skip password when possible and select Try another way if you need a password-and-2SV sign-in instead.
I did not receive a Google prompt or verification code
Make sure the expected phone is signed in to the same account, has an internet connection for prompts, and is able to display notifications. If a prompt still does not arrive, choose Try another way and use an authenticator code, backup code, security key or another method already registered. For SMS or voice delivery, carrier coverage and local routing can affect arrival; Google also warns that phone-number-based codes are more exposed to attacks than stronger device-based methods.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Never repeatedly request codes from an unexpected sign-in page or give a code to someone claiming to be support. Use the Google sign-in screen directly, verify the account shown on your phone, and try an already registered alternative if delivery continues to fail.
I lost my phone
Use another phone already signed in, another registered number, a passkey on a different device, a hardware key or a saved backup code. After you regain access, remove the lost phone’s passkey or other credential from the account and register a replacement device. If none of those routes is available, use Google’s account-recovery process. Accounts enrolled in Advanced Protection may restrict alternative sign-in methods, so follow the recovery instructions specific to that program.
I lost a security key
Sign in with another registered method, remove the lost key from the account and add a replacement FIDO2 key. If the lost key was the only available method, a newly purchased key cannot prove ownership of the account until you complete account recovery.
The passkey works on one device but not another
Passkeys are dependent on the platform, browser, account policy and local unlock configuration. Check the version requirements, screen lock, iCloud Keychain on Apple devices and Bluetooth for cross-device use. If the second device still cannot use the passkey, select Try another way, complete a password-and-2SV sign-in, and create an additional passkey on that device if Google offers the option.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If you want a physical security key
A physical key is optional. It can serve as a 2SV method and, when it supports the FIDO2 protocol, can hold a passkey. Before buying or enrolling one, check:
- FIDO2 support, not merely an older one-time-password feature.
- The connector required by each computer or phone you will use.
- Whether the operating systems and browsers in your account meet the key maker’s compatibility requirements.
- Whether you can keep a spare key in a separate secure location.
Register the key while you still have another way into the account, then test it before relying on it as your only second step. A key does not replace the need for recovery planning.
Practical setup checklist
- Turn on 2-Step Verification from Security & sign-in.
- Prefer Google prompts or a passkey over SMS or voice codes when those options fit your devices.
- Create passkeys only on devices and keys you personally control.
- Register a second passkey, backup code set or spare security key.
- Store backup codes privately; never share them.
- Test Try another way before an emergency so you know which alternatives are available.
- Remove credentials for devices or keys that are lost, sold or given away.
- For a managed work or school account, follow the administrator’s policy.
Once these steps are complete, password sign-ins have a second check available, while compatible devices can use a passkey-first flow that is resistant to phishing and does not require a separate second prompt for that sign-in.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Frequently Asked Questions
How do I sign in with a passkey instead of a password?
On the Google sign-in screen, choose the passkey or “use your passkey” option, select the registered device or security key, and unlock it locally with its PIN, password, fingerprint or face recognition. If the option is unavailable, choose “Try another way.”
What if I lose my phone?
Use another signed-in phone, a second registered number, a passkey on another device, a registered hardware key or a saved backup code. After access is restored, remove the lost phone’s credential and add a replacement. If no alternative works, use Google’s account-recovery process.
Why didn’t I get a verification code or Google prompt?
Check that the expected phone is signed in to the same account, connected for prompts and able to show notifications. For SMS or calls, carrier coverage and routing can delay delivery. Choose “Try another way” and use an authenticator code, backup code or security key already registered.
Recommended Free Tools
Can I use a security key?
Yes. A key can be a 2-Step Verification method, and a key with FIDO2 support can also hold a passkey. Check its connector and compatibility, register it before an emergency, and consider adding a spare.
Do I need to buy a physical key to enable 2-Step Verification?
No. Google prompts, an authenticator app, SMS or voice codes and backup codes are available alternatives, depending on the account. Device-based passkeys also work without buying hardware when the device and browser meet Google’s requirements.
Can passkeys and 2-Step Verification be enabled together?
Yes. A passkey does not remove your password, existing 2SV methods or recovery options. Passkey sign-in bypasses the separate second step for that sign-in, while password sign-ins can still use 2SV.
The Bottom Line
Enable 2-Step Verification in Security & sign-in, then create passkeys only on trusted devices you can unlock. Prefer passkeys or Google prompts over phone-number codes when practical, and keep backup codes, another device or a registered spare key so a lost phone does not become a permanent lockout.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
