Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Passkeys are safer against phishing than authenticator-app codes that you manually type. A passkey uses WebAuthn/FIDO2 cryptography to bind the sign-in to the legitimate website or app domain. A time-based one-time password (TOTP) from an authenticator app is an extra factor, but the digits are not bound to that particular session; a phishing site can ask for the code and relay it to the real service while it is still valid.
That is a phishing-resistance judgment, not a claim that passkeys solve every account-security problem. Device loss, account recovery, malware, compromised endpoints, weak support procedures, and whether a service supports passkeys still determine how well either method works in practice.
What this comparison covers
“Authenticator app” can mean several things. Here it means an app that generates a one-time code—usually a six-digit TOTP—that you manually transcribe into a login form. Push approvals, number matching, in-app passkeys, and other features may have different properties and are not interchangeable with manually entered OTP.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The passkey side means a WebAuthn/FIDO2 credential used by a phone, computer, platform credential store, third-party credential manager, or hardware security key. The credential proves possession of a private key without displaying a reusable secret to the website.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The direct security verdict
For the specific threat of being tricked into authenticating on an impostor website, passkeys provide the stronger protection. NIST’s current standard, SP 800-63B-4 (final, July 2025), states: “OTP authentication is not phishing-resistant.” It explains that authenticators requiring manual entry of an output “SHALL NOT be considered phishing-resistant because the manual entry does not bind the authenticator output to the specific session being authenticated.”
WebAuthn passkeys use verifier-name binding: the browser or operating system checks the relying-party domain associated with the credential before an assertion is released. A look-alike domain cannot obtain a valid assertion for the real domain. With a typed OTP, the phishing page can collect the digits and immediately forward them to the genuine service.
Authenticator-app OTP is still more useful than a password alone. It can stop an attacker who has only your password, provided the attacker cannot also capture the current code. The narrower conclusion is that OTP is phishable, while passkeys are designed to resist this verifier-impersonation step.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How phishing resistance works
What NIST means by phishing resistance
NIST defines phishing resistance as the ability of an authentication protocol to prevent authentication secrets or valid authenticator outputs from being disclosed to an impostor verifier. The protocol, rather than the user’s ability to spot a fake page, must enforce the distinction between the real verifier and the attacker.
Two related ideas are channel binding and verifier-name binding. In verifier-name binding, the authenticator creates or releases a response for a specific authenticated domain name. The response is therefore useful to the legitimate service but not to a different origin.
Why a passkey assertion is bound
When a service registers a passkey, the authenticator creates a key pair. The service stores the public key; the private key remains under the control of the device or credential provider. During sign-in, the service sends a challenge. The authenticator signs that challenge together with the relying-party information, and the browser enforces the origin associated with the credential.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A phishing page can imitate the service’s visual design, but it cannot turn its own domain into the registered relying-party domain. The fake page may still steal unrelated information or manipulate a user in other ways, yet it cannot obtain a valid passkey response for the real site merely by asking the user to authenticate.
Why a manually entered OTP is relayable
A TOTP app calculates a short code from a shared secret and the current time. The code is intentionally designed to be entered into a login form. A phishing site can display a prompt for that code, submit the captured digits to the real service, and complete the session before the validity window closes. The code itself carries no proof of which website displayed the prompt.
The exact timing window, clock tolerance, and retry rules vary by service, but those implementation details do not change NIST’s classification: manual entry does not bind the output to the intended session.
Passkeys and authenticator-app OTP compared
| Decision factor | Passkey | Manually entered authenticator-app OTP |
|---|---|---|
| Resistance to verifier impersonation | Phishing-resistant when implemented as WebAuthn/FIDO2 with the correct relying-party domain. | Not phishing-resistant under NIST SP 800-63B-4; a phishing verifier can relay the code. |
| Manual transcription | No code to read or type. The user approves locally with a device unlock method. | Yes. The user reads a changing code and types it into the sign-in page. |
| Secret exposed to the service | The private key is not sent. The service receives a signed assertion and stores the public key. | The service and the authenticator app share a secret from which codes are generated. |
| Credential custody | May be device-bound or synced through a platform or third-party credential provider. Those models have different control and recovery implications. | The shared secret is stored in the authenticator app and usually copied or restored according to that app’s export and backup design. |
| Portability | Can be available on multiple devices when a sync provider supports it; a device-bound key requires another registered authenticator for additional devices. | Depends on whether the app supports backup, export, or migration. A phone loss can leave the user dependent on recovery codes or the service’s recovery process. |
| Service compatibility | Only works where the account supports passkeys/WebAuthn and the device or browser supports the required flows. | Widely supported as a second factor, but availability and enrollment details differ by service. |
| Primary phishing weakness | Not the passkey assertion itself; attacks may instead target recovery, the endpoint, or unrelated information. | The user can be induced to reveal the current code to a relay site. |
Passkey custody: device-bound versus synced
“Passkey” does not identify one storage policy. Ask where the credential is held, how it reaches another device, and who controls recovery.
Device-bound passkeys
A device-bound credential stays on one phone, computer, or hardware authenticator. The private key does not automatically appear on another device. This can reduce the number of places where the credential is available and gives the owner a clear physical custody model.
The trade-off is recovery. If the sole device is lost, destroyed, reset, or unavailable, the account must have another registered passkey, a security key, recovery codes, or a supported account-recovery path. Registering a second device before an emergency is more reliable than trying to recover access afterward.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Synced passkeys
A platform or third-party credential provider may synchronize passkeys across a user’s devices. FIDO describes passkeys as credentials that can be stored on a phone, computer, or hardware security key and, depending on the provider, synchronized across devices.
Sync improves portability and makes a lost device less disruptive, but it introduces a custody question: the security of the sync account, its recovery process, and every device authorized to use the credential matter. NIST notes that a verifier may have limited visibility into user-controlled sync fabrics and devices, and that some syncable deployments could allow keys to be shared with other users. Do not treat all sync systems as equivalent or assume that “synced” and “device-bound” offer the same control model.
Local biometrics are not sent to the website
A passkey flow may ask for a fingerprint, face scan, or device PIN to unlock the local authenticator. FIDO states that biometric data used for local user verification is not sent to the remote service. The site receives the cryptographic result, not the biometric template.
Where a hardware security key fits
A FIDO2/WebAuthn hardware security key is optional. It can provide a device-bound passkey or serve as a backup authenticator for services that support security keys. It is useful for people who want a credential kept separate from everyday phones and computers, but it is not required for ordinary passkey use, and not every account supports it.
What authenticator-app OTP still does well
OTP can materially improve security over password-only sign-in. An attacker who obtains a password through reuse, a breach, or guessing still needs the current code. The code changes regularly, so a captured value is not normally reusable indefinitely.
Its limitation is the interaction model. The user must decide where to type the code, and a convincing fake page can make the wrong destination look normal. Treat every request for a current OTP as a high-risk action: verify the domain independently, do not read codes to a caller or support chat, and do not approve an unexpected login just because the page looks familiar.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
OTP also remains useful as a transitional or fallback factor where passkeys are not yet supported. It should be viewed as a second layer with a known phishing weakness, not as equivalent protection.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow to choose for different account situations
Choose a passkey first when
- The service supports WebAuthn passkeys and your browser or device offers a maintained implementation.
- You regularly face targeted phishing, use high-value accounts, or administer systems where an impostor login would be costly.
- You can enroll at least one additional passkey or maintain a documented recovery method.
- You are comfortable deciding whether a synced or device-bound custody model fits your threat model.
Keep OTP as a fallback or transition when
- The account does not yet support passkeys.
- You need an additional factor while migrating a large set of accounts.
- Your organization requires a particular authenticator method for compatibility with existing systems.
- You have tested recovery and can protect the phone and authenticator-app backup material.
Use both when the service allows it
Many accounts let you register more than one authenticator. A practical arrangement is a passkey for normal sign-in, a second passkey on another device or a security key for backup, and recovery codes stored offline. Keep an authenticator-app OTP enrolled only if it provides useful fallback coverage and your organization’s policy permits it. Every additional method is another credential to inventory and revoke when a device is lost.
Setting up a passkey safely
Labels differ by service, but the following sequence matches the common account flow. Use the account’s genuine website or app, reached from a bookmark or a known address, rather than a link in an unsolicited message.
- Sign in through the service’s normal login page and open Account, Profile, or Settings.
- Open Security, Sign-in and security, or the equivalent section, then find Passkeys, Security keys, or WebAuthn.
- Select Create passkey or Add passkey. Confirm the account and domain shown by the browser or operating system.
- Approve the local prompt with your device PIN, fingerprint, face verification, or another supported unlock method. The biometric remains local.
- Give the credential a useful name that identifies its custody, such as “work laptop” or “backup key,” if the service offers naming.
- Immediately add a second authenticator or save the service’s recovery codes in a protected offline location. Do not wait until the first device is missing.
- Sign out and test the passkey in a private window or on a second device, while keeping a recovery method available in case the test reveals a compatibility problem.
If the passkey prompt does not appear, update the browser or operating system, confirm that the account actually supports passkeys, and check whether the device’s screen lock is enabled. Do not disable security controls or install an unknown extension to force a prompt.
Enrolling an authenticator app without creating avoidable risk
- Open the genuine account security page and choose Set up authenticator app, Two-step verification, or the service’s equivalent.
- Scan the displayed QR code only inside the authenticator app. If scanning is unavailable, enter the setup key exactly as shown and keep that key confidential.
- Enter the current code once to confirm enrollment, then save recovery codes according to the service’s instructions.
- Record which device holds the authenticator and whether the app offers an approved backup or export function. Do not take an unprotected screenshot of the setup secret.
- During future sign-ins, verify the domain in the address bar before entering the code. A legitimate support representative should not ask you to disclose a current OTP.
When replacing a phone, enroll the new authenticator before wiping the old one, or verify that the service’s documented migration and recovery process works. A code generator that has not been tested on the replacement device is not a dependable backup.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Recovery is part of the security decision
Phishing resistance does not remove the need for account recovery. Before removing a password or OTP method, answer these questions for each important account:
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- What happens if the primary phone or computer is lost, stolen, reset, or offline?
- Is there a second passkey, a supported hardware security key, or an offline recovery code?
- Can the passkey provider recover a synced credential, and what identity checks are required?
- Does the service fall back to email, SMS, or support-assisted recovery, and could an attacker target that channel?
- How will you revoke a credential that belonged to a former employee, family member, or lost device?
Store recovery codes where they are accessible during an emergency but not exposed with the device they protect. For organizational accounts, document who owns recovery, how devices are removed, and how a departing user’s authenticators are revoked.
Compatibility and migration checklist
Support is not universal. Check the specific service rather than assuming that a passkey created on one account will work everywhere.
- Confirm that the service lists passkeys or WebAuthn in its current security settings.
- Check which browsers, operating systems, and account types are supported.
- Verify whether the service permits multiple passkeys and whether it supports a hardware security key.
- Review the sign-in fallback order: passkey, OTP, recovery code, email, phone, or support review.
- Test sign-in from the devices you actually use before deleting an older factor.
- Keep an inventory of registered credentials and remove entries for devices you no longer control.
A phased migration is safer than an abrupt switch. Start with your email account and other accounts that can reset many others, add a second authenticator, test recovery, then move through lower-impact services. Keep OTP only where it has a defined fallback purpose.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThreats passkeys do not eliminate
The passkey advantage is specific: it prevents the credential response from being accepted by an impostor verifier. It does not guarantee that the user will never be deceived or that the endpoint is trustworthy.
- Compromised devices: Malware with control of an unlocked endpoint may manipulate what you see or do, even if it cannot extract the private key.
- Malicious recovery: An attacker who takes over email, a phone number, a sync account, or a support process may obtain access without defeating the passkey protocol.
- Social engineering: A user can still reveal invoices, documents, recovery codes, or other information to a fake site or person.
- Enrollment attacks: If an attacker is already signed in, they may try to register their own authenticator. Protect existing sessions and review newly added credentials.
- Service implementation errors: A poorly designed account-recovery or fallback flow can undermine a strong primary authenticator.
Use device updates, screen locks, least-privilege access, careful recovery controls, and credential reviews alongside either authentication method.
What the available evidence does—and does not—show
NIST and FIDO documentation establish the protocol distinction, but there is no independent, directly comparable head-to-head figure showing phishing success rates for passkeys versus authenticator-app OTP in the cited material. Passkey adoption numbers, general breach statistics, or vendor-reported conversion rates would not answer that specific question and should not be substituted for it.
Quick Recap
A practical decision in one minute
- If the account supports a passkey, enroll one from the genuine security settings page.
- Add a second passkey or compatible hardware security key before relying on the first one.
- Save and test recovery codes or the service’s documented recovery path.
- Keep authenticator-app OTP only where it is needed for compatibility or fallback, and always treat its code as relayable by a phishing site.
- Review the account’s registered devices and recovery channels whenever a device, provider, or user changes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
