iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Passkeys provide stronger protection against phishing-driven account takeovers than authenticator-app codes. A passkey uses WebAuthn/FIDO2 public-key cryptography and binds the sign-in to the legitimate website, so a lookalike site cannot use the response. An authenticator app’s time-based one-time password (TOTP) is still useful, but a live phishing proxy can capture and relay the code before it expires. Use a synced passkey for everyday accounts when available, keep an authenticator app where passkeys are unsupported, and protect high-risk or recovery accounts with a separately stored hardware FIDO2 key.
Why passkeys stop a phishing relay
A passkey is a FIDO credential created with public-key cryptography. During enrollment, the authenticator generates a key pair. The service stores the public key; the private key stays protected by the phone, computer, password manager, or hardware security key that holds it.
At sign-in, WebAuthn checks the relying-party ID and website origin. The authenticator will produce a valid response only for the domain for which the credential was created. A phishing page that imitates a bank, email provider, or payroll service has a different domain, so it cannot obtain a response that the real service will accept. The user normally approves the request with a device unlock, biometric check, or security-key touch; no reusable secret is typed into the page.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchNational Institute of Standards and Technology (NIST) describes this as verifier name binding. Its July 2025 Digital Identity Guidelines, SP 800-63B-4, state that WebAuthn—used by FIDO2 authenticators—provides phishing resistance by choosing an authenticator secret based on the authenticated verifier domain. The Cybersecurity and Infrastructure Security Agency likewise says FIDO/WebAuthn is the only widely available phishing-resistant authentication.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How authenticator-app codes work—and where they fail
Most authenticator apps implement TOTP. During setup, the service and app share a secret. The app calculates a short code from that secret and the current time, and the code changes periodically. You read the code and type it into the login form after entering your password.
TOTP adds a real possession factor: an attacker who has only your password normally still needs access to the app or its backup. It is therefore a substantial improvement over password-only sign-in. The weakness is that the code is not cryptographically tied to the website session or domain.
In a real-time phishing attack, an impostor page collects your password and current TOTP code, then forwards both to the legitimate service. The attacker can complete the login while the code is valid. NIST’s July 2025 guidance says authenticators that require manual entry of an output, including OTP authenticators, shall not be considered phishing-resistant because manual entry does not bind the output to the specific session being authenticated.
Security comparison at a glance
| Criterion | Passkey (WebAuthn/FIDO2) | Authenticator-app TOTP |
|---|---|---|
| Phishing resistance | Strong by design; the response is bound to the legitimate verifier domain. | Not phishing-resistant; a live proxy can relay the typed code. |
| Resistance to verifier impersonation | A credential made for the real domain will not authenticate a lookalike domain. | The code can be entered into any page that asks for it. |
| Replay resistance | Each WebAuthn assertion is challenge-based and signed by the private key; a copied response cannot normally be reused. | The code is valid for its time window and can be relayed during that window. |
| What the user enters | Usually nothing; approve with device unlock, biometrics, or a key touch. | Read and manually type a changing numeric code. |
| Recovery after device loss | Depends on whether the credential is synced and on the service’s recovery process; a device-bound key requires another enrolled key or recovery method. | Requires a backup of the shared secret, recovery codes, another enrolled authenticator, or the service’s account-recovery process. |
| Cross-device portability | Synced passkeys can appear on a user’s other supported devices; device-bound credentials do not move automatically. | Portability depends on whether the app securely backs up or transfers its secrets. |
| Compatibility | Increasing, but some older or specialized services still do not offer passkeys. | Widely supported anywhere a service offers time-based two-factor authentication. |
| User friction | Low after enrollment; approve a prompt or use a biometric/device PIN. | Copy a code during every sign-in that requests the second factor. |
| Administrative support cost | Requires enrollment, device lifecycle, recovery, and policy design; phishing-resistant policy reduces incident exposure. | Simple to deploy, but help desks must handle lost phones, seed resets, code drift, and phishing incidents. |
The decisive security question is whether the protocol binds the response to the legitimate verifier. Recovery and availability determine which implementation is practical for a particular person or organization.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Synced and device-bound passkeys are different choices
Synced passkeys
A syncable authenticator keeps passkeys available across a user’s approved devices through an operating-system or credential-manager sync service. NIST’s April 23, 2024 supplement says correctly implemented syncable authenticators, including FIDO passkeys, can provide phishing resistance, simpler recovery, cross-device support, and consumer-friendly platform authentication.
For someone who uses a phone, tablet, and computer, synchronization avoids registering every device separately and makes replacing a lost phone less disruptive. The trade-off is that the sync account becomes an important part of the security boundary. Protect it with a strong, unique account credential, its own passkey or hardware key where supported, device lock, and the provider’s recovery controls. Review which devices are signed in and remove old devices promptly.
Device-bound passkeys and hardware keys
A device-bound passkey remains on one authenticator. A FIDO2 security key is the clearest example: the private key is held in a separate physical device and is released only after the required touch, PIN, or biometric action. This limits dependence on credential synchronization and is attractive for administrators, executives, journalists, regulated systems, and break-glass accounts.
Free tools Windows power users keep installed
One-click scans. No signup required.
The operational cost is recovery. If the only key is lost, damaged, or locked out, the account enters a recovery event. Enroll at least one separately stored spare key when the account’s risk justifies it. Keep the spare in a controlled location, record which accounts are enrolled, and test that it works before an emergency.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft’s reported usability result
Microsoft’s current Entra documentation reports a 95% sign-in success rate for synced passkeys versus 30% for legacy authentication methods in the cited experience. This is a Microsoft-reported comparison, not an independent, universal benchmark for every passkey deployment or authenticator app. Treat it as evidence that a particular passkey experience can reduce sign-in friction, not as a prediction of your own rate.
What to use for different accounts
Most personal accounts
Enroll a synced platform passkey wherever the service supports it. Store the service’s recovery codes in an encrypted password manager or another protected offline location, and enroll a second recovery method that you can access if your primary device is unavailable. Do not leave recovery codes in an unprotected screenshot or an email inbox that depends on the same account.
Services without passkey support
Use a TOTP authenticator app rather than password-only login. During sign-in, verify the domain before entering either the password or code. Treat an unexpected request for a code, a phone call asking you to read one aloud, or a “support” message demanding a code as hostile. A TOTP code is a secret for the real service, not proof that the person requesting it is legitimate.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Administrators, executives, journalists, and other high-value users
Use a passkey as the normal sign-in method and enroll a separate hardware FIDO2 security key as a backup or required factor where the service’s policy permits. Keep the backup key separate from the primary device and document the recovery procedure. For privileged accounts, consider requiring the hardware key for administrative actions rather than relying solely on a synced credential.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Organizations
Make phishing resistance a policy requirement for sensitive applications instead of treating it as an optional convenience. Define which applications require WebAuthn, which accounts need two keys, who can approve recovery, and how a lost authenticator is revoked. Pilot enrollment with representative users, test sign-in on every supported device type, and rehearse recovery before broad rollout. Keep TOTP available only where compatibility or a documented exception requires it, and monitor exceptions.
Step-by-step: moving an account to a passkey
- Check the service’s security settings. Sign in through the service’s known address, open Account, Security, or Sign-in options, and look for Passkeys, WebAuthn, or Security keys. Do not follow an unexpected email link to begin enrollment.
- Prepare the authenticator. Update the operating system and browser, enable a device PIN or biometric lock, and make sure the device can be recovered if it is lost. For a hardware key, have the key and any required PIN available.
- Start enrollment. Choose Add passkey or the equivalent control. The browser will identify the relying party and ask you to select a platform authenticator, phone, or security key.
- Approve locally. Unlock the device, complete the biometric check, or touch and authenticate the security key. The private key should not be displayed or copied into a form.
- Confirm the registration. Give the credential a recognizable name if the service allows it, such as “Personal laptop” or “Backup security key.” Verify that it appears in the account’s list of enrolled authenticators.
- Add recovery before signing out. Save recovery codes, enroll a second passkey or hardware key when appropriate, and confirm that the service’s recovery contact is current. Do not remove the old method until the new one has been tested.
- Test a fresh login. Sign out or use a private browser window, then sign in with the new passkey. Confirm that the prompt shows the expected service and that you can still reach the account if the primary device is unavailable.
Step-by-step: using TOTP as safely as possible
- Install an authenticator from a trusted source and enable the phone’s screen lock. Avoid copying the seed into notes, cloud documents, or chat.
- Enroll from the service’s security page. Scan the QR code or enter the setup key only inside the authenticator app. Save the service’s one-time recovery codes separately.
- Verify the displayed domain. Before typing a password or code, inspect the browser address and certificate warning status. A familiar logo or page design is not enough.
- Enter the TOTP only when you initiated the login. Never read a code to a caller, “support agent,” coworker, or person in a chat. Reject unexpected push prompts and change the password if you entered credentials on a suspicious page.
- Prepare for phone loss. Keep a second enrolled method or a protected copy of the setup secret where the service permits it. Test the recovery path while you are still signed in.
What happens if you lose your phone or security key?
Lost phone with a synced passkey
Use another device already connected to the same sync account, or use the service’s documented recovery method. From the account’s security page, revoke the lost device or passkey, review active sessions, and register a replacement. Change the sync account’s credentials if you suspect the phone was unlocked or the sync account was compromised.
Lost phone with device-bound credentials or TOTP
Use the second enrolled passkey, spare security key, recovery code, or approved account-recovery process. If none exists, contact the service through its published support channel; expect identity checks and possible delays. Once access is restored, revoke the missing authenticator and enroll a replacement. Do not disable all security controls simply to regain access.
Recommended Free Tools
Lost hardware key
Sign in with the spare key or another approved method, remove the lost key from the account, inspect active sessions, and enroll a new backup. If the key protected administrative access, notify the organization’s security team immediately so it can be revoked centrally.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Common failure modes and fixes
- “The passkey option is missing.” The service, account type, browser, or operating-system version may not support passkeys. Update supported software, check the service’s security documentation, and use TOTP rather than falling back to password-only login.
- “The passkey works on my phone but not my computer.” The credential may be device-bound, cross-device approval may be disabled, or the browser may be signed into a different profile. Try the phone-based QR or nearby-device option, confirm the correct account, and enroll a computer passkey if policy permits.
- “The TOTP code is rejected.” Check the phone’s automatic date and time, wait for the next code, and avoid repeatedly submitting guesses. If clock correction does not help, use a recovery method and reset the authenticator through the service rather than deleting the only enrollment.
- “I approved a login I did not start.” Treat it as an incident. Deny further prompts, change the account password from a trusted device, revoke unknown sessions and authenticators, inspect recovery details, and notify the service or organization.
- “Recovery codes are gone.” While signed in through a trusted authenticator, generate a new set, invalidate the old set, and store the new codes in a protected location. Do not create multiple untracked copies.
Do passkeys eliminate every account-takeover route?
No. Passkeys directly address credential phishing and verifier impersonation, but an attacker can still target the account’s recovery process, steal an unlocked device, compromise the email address used for recovery, trick a user into approving an action on a malicious device, or exploit a service-side breach. Keep device locks enabled, update software, review active sessions and enrolled authenticators, and protect recovery channels as carefully as the passkey itself.
Passkeys also do not make every implementation identical. A correctly implemented synced authenticator can retain phishing resistance while improving availability, whereas an unplanned device-bound deployment can strand users without a spare. Evaluate the authenticator, the service’s recovery design, and the organization’s operating procedures together.
A practical decision framework
- Choose a synced passkey when you need convenient access across several personal devices and can secure the sync account and recovery methods.
- Choose a device-bound passkey or hardware FIDO2 key when limiting credential synchronization is more important than convenience, especially for privileged, regulated, or break-glass accounts.
- Choose TOTP when the service does not support passkeys or your organization has a documented compatibility exception. It is materially safer than a password alone but remains vulnerable to real-time phishing.
- Use more than one authenticator when losing a single device could interrupt critical work. Keep the spare separate and test it.
What the evidence says—and what it does not
NIST’s July 2025 SP 800-63B-4 explicitly separates phishing-resistant WebAuthn from manually entered OTP authenticators. NIST’s April 23, 2024 supplement addresses the operational benefits of correctly implemented syncable authenticators. CISA identifies FIDO/WebAuthn as the only widely available phishing-resistant authentication. Together, these sources support the security distinction between passkeys and TOTP.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAdoption is growing: an independent FIDO Alliance survey in 2024 reported that 53% of respondents had enabled passkeys on at least one account and 22% had enabled them on every account where they could. Those are survey figures, not a measure of protection against confirmed takeovers.
No independent, apples-to-apples account-takeover rate covering every type of passkey deployment and every authenticator-app implementation establishes one universal percentage advantage. The defensible conclusion comes from the protocol property: WebAuthn binds the authenticator response to the legitimate verifier, while a manually entered TOTP does not.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
