Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Passkeys generally protect the authentication secret better than password managers do. A passkey is an origin-bound cryptographic credential, so a look-alike site cannot obtain a valid response for the real service. A password manager dramatically improves password uniqueness and reduces credential-stuffing risk, but malware running on the device can still read stored passwords, capture autofill results, or steal an active session cookie. Neither technology automatically invalidates a session that an infostealer has already taken.
The short answer
Use passkeys wherever a service supports them. For accounts that still require passwords, use a password manager to create a different, random password for every site. Protect administrators, primary email, financial accounts and the password-manager account with a device-bound passkey or FIDO2 security key, and register a backup authenticator.
This is not an either-or choice. Passkeys are the stronger authentication method against phishing and reusable-credential theft; password managers remain essential for the large number of sites that have not adopted passkeys. An infostealer changes the problem, however. Once malware controls a computer, it may target browser password stores, autofill data, cookies and other local secrets. A strong login can be bypassed if the attacker replays a session token issued after that login.
Recommended Free Tools
What an infostealer can take
An infostealer is malware designed to collect valuable data from an infected endpoint and send it to an operator. Common targets include:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Passwords saved in browsers or password-manager integrations.
- Encryption keys or key material needed to decrypt browser-stored passwords.
- Autofill data, such as usernames, addresses and payment details.
- Authentication cookies and other session tokens.
- Local files, cryptocurrency wallets, email data and messaging credentials.
Microsoft has documented that the encryption key protecting browser-stored passwords can be available to any process running locally, including malicious software. The U.S. Cyber Safety Review Board (CSRB) has described widespread theft and monetization of authentication cookies by infostealer operators. These findings mean endpoint compromise is a separate security problem from weak or reused passwords.
Why a stolen cookie matters
After a successful login, a service normally issues a session token, often represented in a browser as a cookie. The browser presents that token on later requests so you do not have to authenticate on every page. If malware copies a still-valid token, an attacker may replay it from another device and appear already logged in. They may not need the password, passkey or second factor again.
Passkeys and password managers both authenticate the initial login; neither is a universal session-protection mechanism. Services that support token binding or token protection can make a stolen token less useful, but availability and implementation vary. Microsoft recommends token protection where it is available, and the CSRB has called for stronger browser defenses against stolen cookies.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How password managers and passkeys work
Password manager
A password manager generates and stores unique passwords, then fills the selected credential into a browser or app. The main security gain is compartmentalization: if one site is breached, its password cannot be used to log in to your other accounts. Unique passwords also reduce the value of credentials harvested by phishing or credential-stuffing campaigns.
The manager’s protection depends on the endpoint and on the security of the manager account. A locally running infostealer may read browser password stores, observe secrets after autofill, capture the vault’s unlocked state, or steal the session used to access the manager. A password manager is therefore password-hygiene infrastructure, not a malware-containment system.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Passkey
A passkey is based on public-key cryptography. During enrollment, the authenticator creates a key pair. The service stores the public key; the private key remains with the authenticator. At sign-in, the service sends a challenge. After you unlock the device or security key, the authenticator signs that challenge with the private key. The service verifies the signature with the stored public key.
The credential is associated with the service’s specific domain, also called its relying-party origin. Microsoft states that a passkey cannot be presented to a look-alike phishing domain. The FIDO Alliance describes the private key as origin scoped and says it cannot be stolen from the relying party’s servers. A phishing page may trick a user into typing a password, but it cannot obtain a valid passkey response for another origin.
What the passkey does not expose
The service does not receive a reusable password or the private key. A successful sign-in proves possession of the authenticator and, depending on policy, local user verification such as a device PIN, fingerprint or face unlock. This is why passkeys remove password reuse and sharply reduce phishing opportunities on supported services.
Security comparison
| Security or usability factor | Password manager | Synced passkey | Device-bound passkey or FIDO2 key |
|---|---|---|---|
| Phishing resistance | Depends on autofill behavior; a password can still be entered on a fake site. | Strong because the credential is bound to the legitimate origin. | Strong because the credential is bound to the legitimate origin. |
| Protection from password reuse | Strong improvement when every site receives a unique generated password. | Eliminates passwords on services that support passkeys. | Eliminates passwords on services that support passkeys. |
| Exposure to local infostealer | Stored passwords, autofill state and unlocked-vault data may be exposed. | Depends on the endpoint and the account that synchronizes credentials; malware can still target the device and sessions. | The private key stays on the enrolled device or key, but malware can still steal sessions. |
| Protection from session-cookie theft | Still vulnerable if a valid cookie is stolen. | Still vulnerable if a valid cookie is stolen. | Still vulnerable if a valid cookie is stolen. |
| Recovery | Usually convenient when vault synchronization works; the manager account must be secured. | Usually easiest because credentials can be restored or used on additional devices. | Hardest unless backup keys or another recovery method are registered. |
| Best fit | Sites and applications that still require passwords. | Most users who want broad convenience and phishing resistance. | Administrators, privileged users and the highest-value accounts. |
Are passkeys safer than a password manager against infostealers?
For the authentication secret itself, usually yes. A password manager stores or releases a reusable password, so malware that can access the vault, browser store or autofill process may obtain a credential that can be replayed elsewhere. A passkey keeps a private key in an authenticator and produces a response only for the correct origin. The private key is not sent to the website and is not a string that an infostealer can simply copy from a server breach.
The qualification is important: passkey safety is not the same as device safety. Malware on a computer can monitor what happens after authentication, steal browser cookies, alter pages, capture data displayed in an already authenticated session or abuse an unlocked account. Passkeys reduce the chance of the attacker obtaining the initial credential; they do not guarantee that an already-compromised endpoint cannot be abused.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
FIDO Alliance reported in 2024 that passwords were the root cause of more than 80% of data breaches and that up to 51% of passwords were reused. Those figures describe the broader password problem, not a guarantee that every passkey deployment prevents an endpoint compromise. They explain why replacing reusable passwords is valuable even when a password manager is used correctly.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Can an infostealer steal your passkeys?
It generally cannot extract a usable private key from a properly designed hardware authenticator by reading a website’s password database. A passkey is intended to remain inside the device’s protected credential store or a physical security key, and the authenticator releases only a signature for the matching origin after user verification.
“Cannot steal the private key” does not mean “cannot attack a passkey user.” An infostealer may:
- Steal the browser session created after a passkey sign-in.
- Use an already-unlocked device or session while you are signed in.
- Capture recovery codes, email access or other account-recovery material.
- Target a synchronized credential account or another enrolled device.
- Manipulate a compromised browser or operating system so that actions occur under your authenticated session.
Synced passkeys add a recovery and portability layer. They remain origin-bound and phishing-resistant, but the synchronization account and every device enrolled in it become part of the trust boundary. A compromise of that account or of an enrolled endpoint can affect more than one device. Device-bound credentials limit where the private key exists, at the cost of more demanding recovery planning.
Do passkeys stop cookie stealers?
No. A passkey protects the act of proving your identity; a cookie proves that the service has already accepted that identity. If malware copies a valid session cookie, the attacker may use it until the service expires, revokes or otherwise invalidates the session.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Reduce this residual risk by using services that offer short session lifetimes, reauthentication for sensitive actions, device or token binding, and administrator controls for revoking sessions. Sign out of unfamiliar sessions promptly. When a device may be infected, do not rely on changing a password from that same device: the attacker may capture the replacement credential or the new session.
Synced versus device-bound passkeys
Synced passkeys
Synced credentials are designed for recovery and multi-device use. A replacement phone or computer can often obtain the passkey through the provider’s synchronization system, which reduces the chance of permanent lockout. This is the practical option for many ordinary accounts and for users who move between several personal devices.
The trade-off is a wider trust boundary. You must secure the synchronization account, its recovery methods and every device that can access the synced credentials. Keep those devices updated, protected by a screen lock and covered by account alerts. Synced does not mean inherently weak; it means you are choosing convenience and recoverability over exclusive possession of one physical authenticator.
Device-bound passkeys
A device-bound passkey stays on one enrolled device or security key. It gives administrators and other high-privilege users clearer control over where the credential exists. The operational cost is recovery: if the device or key is lost and no backup is registered, access may depend on the service’s recovery process.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →FIDO2 security keys
A FIDO2 security key is the clearest physical-product choice for high-value accounts. It supplies a device-bound authenticator that is separate from the computer being protected. Register two keys where the service permits it: keep one available for daily use and the backup in a secure, separate location. Confirm that the service supports the key’s required connection method and that you have a documented recovery path before enforcing key-only access.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Recommended setup for most people
- Enable passkeys on supported accounts. Start with primary email, financial services, cloud administration, social accounts with sensitive data and the account that controls your password manager.
- Use a unique generated password everywhere else. Let the password manager create long, random credentials for legacy sites. Do not reuse the manager’s master password on any other service.
- Add phishing-resistant MFA to the password manager. Prefer a passkey or FIDO2 security key when the manager supports it. A second factor does not erase a compromised endpoint, but it reduces remote takeover through stolen passwords.
- Separate high-value authenticators. For administrator, finance and primary-email accounts, use a device-bound passkey or FIDO2 key and enroll a backup before disabling older methods.
- Harden every enrolled device. Apply operating-system and browser updates, use a screen lock, remove unneeded extensions, install applications only from trusted sources and keep endpoint security enabled.
- Review sessions and recovery options. Remove unknown devices, rotate recovery codes, verify notification addresses and ensure that a lost device can be revoked.
Choosing the right method by account type
| Account or situation | Preferred method | Reason |
|---|---|---|
| Primary email | Device-bound passkey or FIDO2 key, plus a registered backup | Email can reset many other accounts and is a high-value target for session theft. |
| Administrator or infrastructure access | Device-bound passkey or FIDO2 key with documented recovery | Limits where the private key exists and reduces phishing of privileged credentials. |
| Banking and financial services | Passkey when supported; otherwise a unique manager-generated password and the strongest available MFA | Uses origin binding where available while accommodating services that still require passwords. |
| Password-manager account | Passkey or FIDO2 key, unique recovery material and a backup authenticator | Compromise of this account can expose many legacy credentials. |
| Legacy site without passkeys | Password manager with a unique random password | Provides the main available defense against reuse and credential stuffing. |
| Shared or public computer | Avoid signing in when possible; use a hardware authenticator only when you can verify the device | Local malware and residual sessions are difficult to control on an untrusted endpoint. |
What to do if malware is suspected
Treat a suspected infostealer as an account-exposure incident, not merely a password-reset task.
- Stop using the affected device for sensitive sign-ins. Disconnect it from networks if your incident plan requires containment, and do not enter replacement credentials on it.
- Move to a known-clean device. Use it to review account activity, revoke active sessions and invalidate tokens where the service provides those controls.
- Secure the control points first. Protect primary email, the password-manager account and synchronization account with a passkey or FIDO2 key. Replace exposed recovery codes.
- Reset exposed passwords from the clean device. Generate new, unique passwords in the manager for accounts that do not yet support passkeys.
- Revoke and re-enroll authenticators as needed. Remove unknown passkeys, security keys, devices and application sessions. Keep legitimate backups.
- Rebuild or thoroughly remediate the endpoint. A complete operating-system reinstall is often the clearest way to remove an infostealer; follow your organization’s incident-response process for business devices.
- Monitor for delayed abuse. Watch sign-in alerts, forwarding rules, new recovery addresses, payment changes and newly created API tokens.
Changing a password while malware is active can hand the attacker the new password. Revoking sessions is equally important because a stolen cookie may remain useful after a password change.
Common misconceptions and failure modes
“A password manager makes infostealers harmless.”
It does not. The manager prevents reuse and can reduce phishing when autofill refuses an unrecognized origin, but malware with local access may read stored material or observe an unlocked session.
“A passkey means the account cannot be hijacked.”
Passkeys strongly protect the initial authentication exchange. They do not protect a session cookie already stolen from a compromised browser, nor do they prevent abuse of a device that is already unlocked.
“Synced passkeys are just passwords in the cloud.”
They are still cryptographic, origin-bound credentials rather than reusable password strings. Syncing changes recovery and trust boundaries; it does not remove the phishing resistance of the passkey protocol.
“One security key is enough.”
A single key creates a lockout risk if it is lost or damaged. Register a backup and test the recovery procedure before making the key mandatory.
“Changing every password is the first response to a stolen cookie.”
Session revocation comes first. A valid cookie can continue to authorize requests even after the password changes, depending on the service’s session policy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Decision framework
- If the site supports passkeys: enroll one, preferably a device-bound credential for high-value access and a synced credential when recovery convenience is more important.
- If the site supports only passwords: use a password manager, generate a unique password and enable the strongest available MFA.
- If you administer sensitive systems: use FIDO2 security keys or device-bound passkeys, maintain a separately stored backup and document revocation and recovery.
- If your endpoint may be infected: assume both passwords and sessions on that device are exposed; switch to a clean device and follow the incident steps above.
- If you are choosing between convenience and control: synced passkeys favor recoverability and multi-device use, while device-bound credentials favor tighter control over where the private key exists.
The practical hierarchy is straightforward: remove reusable passwords with passkeys where possible, use a password manager for the accounts that still need passwords, and treat endpoint and session security as a separate layer that both methods require.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
