iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Set up sign-in protection separately for each account: enable two-step verification for password logins, add a passkey where the service supports it, and configure recovery options before you lose a device. A passkey can replace a password and may also satisfy or bypass a separate second step, so adding one is not always the same as turning on two-factor authentication.
Understand what you are setting up
Two-factor authentication (2FA) means proving your identity with two different types of evidence, such as something you know (a password) and something you have (a phone or security key). Many services call this “two-step verification.” The labels differ, and the available choices depend on the service and account type.
A passkey is a cryptographic sign-in credential, not a one-time code sent by email or text. The service keeps a public key; the matching private key stays protected by your device or credential provider. You typically unlock it with a screen lock or biometric check. Because a passkey is tied to the service’s domain, it is designed to resist phishing.
Recommended Free Tools
Depending on the service’s implementation, a passkey can replace the password and cover the possession and local-unlock checks without a separate second-step prompt. If you continue signing in with a password, enabling a second factor adds protection to that password-based sign-in.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose a method and prepare recovery
Prefer a passkey or FIDO security key when the service and your devices support them. Authenticator apps, approval prompts, SMS, or calls may be alternatives, depending on the account. CISA’s Mobile Communications Best Practice Guidance recommends migrating away from SMS-based MFA; text messages are best treated as a fallback where stronger options are unavailable.
- Passkey: Convenient and phishing-resistant, but availability depends on the service and a compatible device or credential provider. If it syncs through a provider, recovery depends partly on that provider’s account and recovery setup.
- FIDO security key: A physical key can serve as a second factor or, where supported, hold a passkey. Check that the key’s connection method works with your device and that the account supports it. A lost key can lock you out if you have no alternative.
- Authenticator app or prompt: These can provide a second step when offered. Set up a backup method in case your primary phone is unavailable.
- SMS or phone call: These may be offered as fallback methods, but are less resistant to interception or relay than passkeys and security keys.
Before relying on one phone or key, add another sign-in or recovery method where the service allows it. Keep recovery information current, and store a spare physical key separately from your primary key if you use one. Do not remove an existing method until you have tested the replacement and confirmed you can still recover the account.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Set up two-step verification and passkeys on a Google Account
Turn on 2-Step Verification
- Open your Google Account and go to Security & sign-in.
- Under How you sign in to Google, choose Turn on 2-Step Verification.
- Follow the on-screen instructions to choose and verify an available second step. Options can vary by account.
Google explains that password sign-ins can require a second step, while signing in with a passkey bypasses that step because the passkey verifies possession of the device. That means a passkey and 2-Step Verification do not necessarily appear as two consecutive prompts. For current instructions, see Google’s 2-Step Verification guide and instructions for signing in with a passkey instead of a password.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Add a security key
Google’s security-key instructions say to obtain a compatible key from a trusted retailer, enroll it in the account, and use it when prompted at sign-in. FIDO1 or FIDO2 keys can be used as a second step; creating a passkey on the key requires a FIDO2-capable key. Confirm compatibility with the account, device, browser, and available ports or wireless connection before purchasing. Google advises adding other sign-in options in case the key is lost. Its published guidance says a newly added key may take up to seven days to become trusted; its recovery guidance says a request may take three to five business days when you have no other second step or have forgotten your password. These are Google-specific timings and can change. See Google’s security-key instructions.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Set up Apple Account protection
Apple says an Apple Account using iCloud Keychain requires two-factor authentication, and someone trying to register a passkey without it will be prompted to set it up. When signing in for the first time on a new device, Apple says you need your account password and a six-digit verification code displayed on trusted devices or sent to a trusted phone number. The exact flow can depend on device and software version; review your Apple Account security settings and Apple’s current information about passkey security.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Set up protection on Microsoft and other accounts
For a personal account, use the provider’s official security settings to find its current passkey and multi-factor enrollment options. Microsoft describes passkeys as phishing-resistant in its passkeys frequently asked questions; actual availability depends on the account and platform.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Work and school accounts can be controlled by an organization. For Microsoft 365 organizational accounts, an administrator must enable MFA before users can register a method. Depending on organization policy, available methods may include an authenticator, passkey, SMS, phone call, or token. Follow your organization’s enrollment prompts or contact its administrator if an option is missing. Google also notes that work, school, or group accounts may be administrator-managed.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Check that sign-in and recovery work
- Sign out or open a private browsing window, then test the new sign-in method while keeping an existing trusted session available.
- Confirm that your backup method is still accessible, such as a second enrolled device, a spare key, or a current recovery phone number.
- Check the provider’s account recovery instructions and make sure recovery contact details are up to date.
- Only after successful testing, consider removing an older method you no longer want to use. Keep at least one practical recovery route.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
