Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For most personal accounts that support them, choose a passkey as your primary sign-in method. A properly configured WebAuthn passkey uses cryptographic challenge-response and verifier-name binding, so a fake site cannot simply capture a code and relay it. Keep an authenticator app as a fallback or for services that do not offer passkeys.
That recommendation depends on recovery. A synced passkey can be convenient across devices but makes the sync service and account-recovery process part of your security model. A device-bound passkey reduces sync exposure but can be harder to replace if the device is lost. A physical FIDO2/WebAuthn security key is another strong option when the account supports USB or NFC authenticators.
The short answer
Use a passkey first when a service offers one and you have a recovery method you can manage. Use an authenticator-app code (TOTP) when passkeys are unavailable, when an organization requires it, or as an additional recovery route. Neither method works identically on every website, and the labels describe the authenticator capability—not a guarantee that every service has implemented it correctly.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Best default for phishing resistance: a passkey with local user verification, such as a device unlock, fingerprint, or face check.
- Best fallback for broad availability: an authenticator app generating time-based one-time passwords.
- Best hardware option for supported accounts: a FIDO2/WebAuthn roaming security key connected by USB or NFC.
- Most important operational rule: register more than one recovery path where the service permits it, and test that recovery before you need it.
How the two methods work
Passkeys: a cryptographic response to a site challenge
A passkey is a WebAuthn/FIDO credential. During enrollment, the authenticator creates a key pair. The private key stays protected by the authenticator or its approved sync system; the service stores a public key. At sign-in, the site sends a fresh challenge. After you approve locally, the authenticator signs that challenge and returns the result. The service verifies the signature with the stored public key.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
WebAuthn also binds the response to the verifier’s authenticated domain name. A look-alike site on a different domain cannot request a valid response for the real site. This is why NIST describes WebAuthn as an example of phishing resistance through verifier-name binding in SP 800-63B: the authenticator chooses a secret based on the authenticated domain of the verifier.
Your local approval matters. A passkey normally requires user verification, such as unlocking the phone or computer, before the private key can be used. Some services may allow a passkey without that extra check, while others enforce it; confirm the service’s settings and your device’s behavior.
Authenticator apps: a manually entered one-time password
An authenticator app and the service share a secret during setup. The app uses that secret and the current time to calculate a short, one-time code, usually called a TOTP. You type the code into the service’s login form after entering your password or another factor.
Recommended Free Tools
The code is designed to expire and to be accepted only once. That gives TOTP replay resistance: an intercepted code generally cannot be reused later. However, the code is not cryptographically tied to the site or session where you enter it. A phishing site can ask for the current code and immediately relay it to the real service. NIST therefore classifies manually entered OTPs as not phishing-resistant.
Security comparison
| Decision point | Passkey | Authenticator-app code (TOTP) |
|---|---|---|
| What you do at sign-in | Approve a cryptographic challenge with a device, synced credential, or security key. | Read a changing code in the app and type it into the login flow. |
| Phishing resistance | Properly configured WebAuthn provides verifier-name binding and is phishing-resistant. | Not phishing-resistant when the code is manually entered, because an impostor verifier can relay it. |
| Replay resistance | Yes. The signed challenge is fresh for that transaction. | Yes. TOTP is time-dependent and intended for one-time use, but replay resistance is not the same as phishing resistance. |
| Cross-device use | Syncable passkeys can work across devices, subject to the sync service and account configuration. Device-bound passkeys stay on one authenticator. | You must enroll a new authenticator when changing phones. Some implementations support exporting or syncing the secret under applicable requirements. |
| Recovery trade-off | Sync can simplify recovery but adds risks involving key sharing, the sync fabric, and account-recovery access. Device-bound credentials limit sync exposure but make loss recovery more dependent on another registered method. | Recovery depends on a backup enrollment, an exported secret where permitted, or the service’s account-recovery process. Losing the only phone can lock you out. |
Are passkeys safer than authenticator apps?
For phishing resistance, yes—when the passkey is a properly configured WebAuthn authenticator and the service uses it as intended. The key difference is binding. A passkey signs a challenge for the authenticated site; a TOTP code is a value that a user can be persuaded to disclose to another site.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
That does not make every passkey arrangement automatically safer in every respect. A synced passkey can be available on several devices, so unauthorized sharing or compromise of the sync fabric could affect the credential. Recovery access to the sync account also matters. NIST’s guidance for syncable authenticators calls for encrypted private-key storage, strong access controls, visibility into sharing, recovery safeguards, and more than one authenticator for recovery.
A device-bound passkey avoids those sync-fabric concerns, but it creates a practical availability risk: if the sole device is lost, damaged, or reset, you need another registered authenticator or the service’s recovery process. The security choice is therefore not simply passkey versus TOTP; it is also synced versus device-bound and single recovery path versus multiple recovery paths.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat NIST and CISA actually classify
NIST’s implementation examples distinguish the two methods clearly. A smartphone TOTP app is listed as replay-resistant but not phishing-resistant. FIDO2 passkeys with user verification are listed as both replay-resistant and phishing-resistant. These are capability classifications, not promises that every website offers the method or has configured it identically.
NIST’s April 2024 supplement says properly configured syncable authenticators can satisfy AAL2 use cases when they provide local user verification (or another authenticator), encrypted storage for private keys, and strong controls over keys held in the sync fabric. That is standards guidance for qualifying configurations; it does not certify every passkey product or every account.
CISA describes FIDO/WebAuthn as a widely available phishing-resistant option. Its roaming authenticators are physical tokens that connect through USB or NFC. A security key can be valuable for a high-risk account or as a backup to a device passkey, but you must verify that the specific service supports security keys and that your computer or phone has a compatible connector or NFC capability.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose by account and situation
You have a personal account with passkey support
Register a passkey and make it the primary method if the service lets you do so. During setup, note whether the credential is being stored on one device or synchronized through an account. Add a second passkey on another device, a security key, or an authenticator-app fallback if the service allows it. Keep at least one method available when your primary device is unavailable.
Free tools Windows power users keep installed
One-click scans. No signup required.
The service offers only an authenticator app
Use TOTP rather than falling back to weaker, less protected options when TOTP is the strongest method available. Treat every code-entry page as a potential phishing target: check the domain before typing, avoid entering a code into a page reached through an unexpected message, and never disclose a current code to a person claiming to provide support.
You manage a work, school, or regulated account
Follow the organization’s accepted-authenticator and recovery policy. NIST notes that agencies choose authenticators according to risk, threats, and usability. A service may require a particular authenticator type, forbid personal sync, or require an approved physical key even when a consumer passkey is technically available.
You want the strongest practical hardware route
Consider a FIDO2/WebAuthn USB or NFC security key for accounts that support it. Register a second key or another approved authenticator where policy permits. A key is not a universal solution: support is account-specific, and a phone or computer may lack the required port or NFC capability.
Setting up a passkey safely
- Open the account’s security settings. Look for a label such as Passkeys, Sign-in keys, WebAuthn, or FIDO2. The exact menu name varies by service.
- Confirm the account recovery options first. Make sure you have an approved backup method before replacing a password or removing an existing authenticator.
- Start passkey enrollment. Choose the device, password manager, or external security key that the service offers. Read the prompt so you know whether the passkey will be synchronized or stored only on that device.
- Complete local user verification. Unlock the device or use the requested biometric or PIN check. This authorizes creation or use of the credential; the biometric itself is not sent to the service.
- Name the credential clearly. If the service displays a list, use a name that identifies the device or key without exposing sensitive details.
- Add a second recovery authenticator. Where supported, enroll another device, a physical key, or an authenticator app. Do not assume the sync service alone is sufficient recovery.
- Test a fresh sign-in. Sign out, sign back in with the new passkey, and verify that your backup route still works. Testing catches enrollment and recovery problems while you still have access.
Setting up and maintaining an authenticator app
- Open the account’s two-factor or multi-factor settings. Select the authenticator-app option and display the setup QR code or secret.
- Enroll the secret in the app. Scan the QR code or enter the secret exactly as shown. Keep the secret private; anyone who obtains it can generate the same codes.
- Enter the current code to confirm enrollment. Make sure the phone’s time is set automatically. Significant clock drift can make valid codes fail.
- Store the service’s recovery codes securely. Recovery codes are separate from TOTP and should not be kept only on the phone protected by that TOTP.
- When changing phones, enroll the new authenticator before wiping the old one. Then remove or invalidate the old enrollment. If the implementation permits export or synchronization, understand where the secret is stored and who can access it.
- Review the account’s enrolled methods periodically. Remove devices and authenticators you no longer control.
What to do if you lose a phone or computer
If the lost device held a synced passkey
Use another device that is already connected to the same sync account, if available, and review the sync account’s active sessions and recovery settings. Mark the lost device as unavailable where the service provides that control. Because sync and recovery behavior differs by provider, follow the service’s official account-recovery procedure rather than assuming that every synced credential can be remotely revoked in the same way.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If the lost device held a device-bound passkey
Sign in with a second registered passkey, security key, authenticator app, or approved recovery code. Add a replacement passkey and remove the lost device from the account’s enrolled credentials. Without another method, you may need the service’s identity-verification or account-recovery process.
If the lost device generated TOTP codes
Use a previously saved recovery code or another enrolled factor. If you have neither, contact the service through its documented recovery channel. Once access is restored, enroll a new authenticator and invalidate the old one; do not leave the lost phone’s enrollment active.
Common mistakes and how to avoid them
- Assuming every passkey is automatically synced. Some credentials are device-bound. Check the enrollment description and create a second recovery method.
- Confusing replay resistance with phishing resistance. A TOTP code can be single-use and still be phished in real time. Verify the domain before entering it.
- Removing the old method too soon. Keep the existing authenticator until the new passkey has been tested and recovery codes are stored safely.
- Putting all recovery on one account. If a sync account, email account, or phone is the only way to recover, losing that account can defeat an otherwise strong setup. Register multiple approved authenticators where possible.
- Ignoring organizational policy. A technically supported passkey may not meet a company’s or agency’s approved-authenticator requirements.
- Assuming a security key works everywhere. Confirm service support, USB or NFC compatibility, and whether the account requires a particular FIDO2/WebAuthn mode.
- Sharing a passkey or TOTP secret. A passkey’s private key and a TOTP enrollment secret are credentials, not ordinary login details. Never send them to support staff or store them in an unprotected note.
A practical decision checklist
Choose a passkey when all of the following are true:
- The account supports WebAuthn passkeys.
- You can complete local user verification on a trusted device or security key.
- You understand whether the passkey is synced or device-bound.
- You have another approved recovery method.
Choose TOTP when any of these conditions apply:
- The service does not offer passkeys.
- Your employer, school, or agency requires an authenticator app.
- You need a fallback while deploying passkeys across several accounts.
- You can protect the enrollment secret and maintain a tested recovery route.
Add a physical security key when the account supports FIDO2/WebAuthn and the consequences of losing access justify a dedicated backup or a device-independent sign-in method.
Bottom line for most readers
A passkey is the better primary choice for a supported personal account because WebAuthn can resist phishing through verifier-name binding, while a manually entered TOTP code can be relayed by a fake site. Keep TOTP for services that lack passkeys and as a possible fallback. Whichever method you choose, the quality of your recovery plan—especially a second registered authenticator and tested recovery codes—determines whether strong authentication remains usable when a device is lost.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
