iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Organizations moving beyond one-time codes should make phishing-resistant FIDO2/WebAuthn authenticators the default, then select platform passkeys, roaming hardware security keys, or PIV/CAC smart cards according to device management, assurance, portability, and recovery needs. Authenticator apps can be a transitional or backup method, but app approvals and one-time codes are different controls. SMS and email codes should not be treated as equivalent to phishing-resistant authentication.
This guide explains what each option does, where it fits, how syncability changes risk, and how to deploy and recover credentials without locking out employees or contractors.
First, separate passwordless sign-in from passwordless second-factor authentication
“Passwordless” describes how a user proves control of an account; it does not by itself describe the strength of that proof. A user may sign in without typing a password by approving a prompt, entering a one-time code, presenting a smart card, or unlocking a FIDO credential with a device PIN or biometric. Those methods have materially different resistance to phishing, replay, account takeover, and device loss.
Passwordless authentication
In a passwordless sign-in, the authenticator replaces the password as the primary credential. FIDO2/WebAuthn is the clearest example: the authenticator creates a key pair during registration, and the service verifies a signature during sign-in. The private key is not sent to the service.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Passwordless second factor
An organization may still require a password while adding a passwordless factor, such as a security key or authenticator-app approval. This can improve security during migration, but it is not the same as eliminating passwords. Document whether a method is the primary sign-in credential, a second factor, or a recovery fallback.
Identity proofing is a separate decision
One-time identity checks used to establish who a person is at onboarding are identity-proofing controls. Authentication then verifies that the same person can access the account later. Replacing a one-time check with a stronger authenticator does not automatically change the organization’s identity-proofing obligations.
Why FIDO2/WebAuthn is the foundation for phishing-resistant access
FIDO2 combines the Web Authentication API (WebAuthn) with the Client to Authenticator Protocol (CTAP). It supports authenticators built into a device and external, roaming authenticators. During registration, the authenticator creates a credential scoped to the service. During sign-in, the service sends a challenge and receives a signed response.
Recommended Free Tools
NIST SP 800-63B describes this protection as verifier name binding: the authentication response is bound to the verifier’s identity, so a credential response for a genuine service is not valid at a look-alike phishing site. NIST contrasts this with passwords, which reuse the same authenticator output and are not replay-resistant.
FIDO2 does not mean every deployment has identical assurance. A device-bound credential, a synchronized credential, and a hardware key have different recovery and custody properties. The service, endpoint, authenticator configuration, and account-recovery process all affect the practical result.
Options at a glance
| Option | How the user authenticates | Main strengths | Important trade-offs | Typical role |
|---|---|---|---|---|
| Platform passkey | A FIDO credential stored in a phone or computer and unlocked with a device PIN or biometric. | Fast enrollment and convenient sign-in on supported managed endpoints; can work without a separate token. | Device-bound credentials require a replacement plan. Syncable credentials improve cross-device access but extend protection requirements to synchronized key material. | Primary sign-in for users with managed, compatible phones or computers. |
| Roaming FIDO2 security key | An external authenticator connected through a supported interface, such as USB, NFC, or another service-supported connection. | Portable across compatible devices; the user can keep a separate physical credential and spare. | Keys can be lost, damaged, or left behind. The identity provider, applications, browsers, operating systems, and endpoint policy must all support the required interface. | Privileged users, shared workstations, contractors, or anyone needing a separate hardware token. |
| PIV/CAC smart card | A certificate-bearing card used with a reader and client-authenticated TLS or another supported certificate workflow. | Established in government and public-key-infrastructure environments; NIST identifies phishing resistance through channel binding. | Requires card issuance, lifecycle management, readers or compatible devices, certificate infrastructure, and application integration. | Government environments and organizations already operating a PKI and card program. |
| Authenticator-app approval | The user approves a sign-in notification in a mobile application. | Uses existing phones and can be easier to deploy than hardware for a transitional population. | It is not the same as a FIDO credential. Push fatigue, mistaken approvals, phone loss, and recovery need controls. | Migration, fallback, or lower-risk populations when FIDO enrollment is not yet complete. |
| Authenticator-app one-time code | The user enters a time-based or event-based code generated by an app. | Works when push notifications are unavailable and is widely supported by older applications. | The code can be phished in real time. It is a fallback or transition method, not equivalent to verifier-bound FIDO authentication. | Legacy compatibility and temporary fallback. |
| SMS or email code | A code is delivered through a phone-number or email channel. | Broad reach when no authenticator is enrolled. | CISA ranks text or email codes lowest among the MFA choices on its business guidance page. Delivery-channel compromise and real-time phishing remain concerns. | Last-resort recovery or temporary enrollment, subject to risk policy. |
How the main passwordless alternatives work
Platform passkeys
A platform authenticator is integrated into a phone, tablet, or computer. The user unlocks it with the device’s local PIN, pattern, fingerprint, or face recognition; the biometric normally unlocks the key rather than being sent to the identity provider. The organization should verify that the endpoint is managed, receives security updates, and supports the required WebAuthn policies.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Ask the identity provider whether the credential is device-bound or syncable. A device-bound passkey generally stays on one authenticator and needs a deliberate replacement process. A syncable passkey can become available on additional devices through the platform’s synchronization service. That convenience can simplify travel and recovery, but it means the organization must assess how synchronized key material is protected and how accounts are recovered if the synchronization account is compromised.
Free tools Windows power users keep installed
One-click scans. No signup required.
Roaming FIDO2 security keys
A roaming authenticator is a separate physical device. It can be moved between supported endpoints, which is useful for administrators, contractors, users who work on multiple managed computers, and environments where employees are not issued a single permanent workstation.
Enrollment policies should require at least one primary key and define whether a second key must be registered as a spare. Check the identity provider and every critical application for support before purchasing or issuing tokens. Test the connection types that users will actually need, including USB, NFC, or another supported interface, and test sign-in from the operating systems and browsers in scope.
PIV and CAC smart cards
PIV and CAC cards use certificate-based authentication and are especially relevant where an organization already has card issuance and PKI operations. NIST SP 800-63B states: “Personal identity verification (PIV) and common access card (CAC) cards, which use client-authenticated TLS, provide phishing resistance through channel binding.”
That model is not a drop-in replacement for FIDO. It depends on certificate issuance, renewal, revocation, card readers or compatible hardware, middleware where required, and applications that understand client certificates. Confirm those dependencies before selecting cards for a new population.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Authenticator apps and one-time codes
App approval and app-generated one-time passwords should be documented as separate methods. An approval prompt can be accepted accidentally or repeatedly during an attack; an OTP can be entered into a phishing site and relayed to the real service. Number matching, rate limits, risk-based prompts, and user training can reduce some problems, but they do not create FIDO’s verifier name binding.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
These methods remain useful while an organization migrates legacy applications or enrolls users who cannot yet use a supported FIDO authenticator. Set an expiration date for their transitional role and retain a stronger recovery path.
Compare methods on the decisions that affect an enterprise rollout
| Decision axis | Platform passkey | Roaming security key | PIV/CAC | App approval or OTP | SMS/email code |
|---|---|---|---|---|---|
| Phishing resistance | High when implemented as FIDO2/WebAuthn; verifier name binding applies. | High when implemented as FIDO2/WebAuthn; verifier name binding applies. | High in the client-authenticated TLS model described by NIST. | Lower than verifier-bound FIDO; approval and OTP mechanisms differ. | Lowest among the methods compared by CISA on its business MFA guidance page. |
| Portability | Depends on whether the credential is device-bound or syncable. | Designed to roam across compatible endpoints. | Portable only where card, reader, certificates, and middleware are supported. | Usually tied to the enrolled phone and app. | Tied to access to the phone number or email account. |
| Recovery after loss | Requires another registered authenticator, a controlled recovery process, or supported synchronization. | Use a registered spare or controlled re-enrollment; revoke the lost key. | Issue a replacement card and revoke the old certificate; follow PKI procedures. | Re-enroll a replacement phone or use another approved factor. | Restore the delivery channel, then replace it with a stronger method. |
| Syncability | May be syncable or device-bound; verify the implementation. | Normally a separate physical credential rather than a synchronized passkey. | Certificate and card lifecycle are centrally managed rather than passkey-synchronized. | App backup and migration behavior varies; do not assume it provides secure recovery. | Not a synchronized authenticator, but dependent on a separate channel. |
| Assurance fit | Choose configuration according to the required assurance level; syncable use is not interchangeable with every device-bound design. | Useful where possession of a separately managed token is required. | Strong fit for existing government or PKI assurance frameworks. | Often transitional or fallback, subject to policy. | Restricted to the lowest-risk use cases or tightly controlled recovery. |
Syncable versus device-bound credentials
Syncability is a risk decision, not a simple “good” or “bad” label. A synchronized credential can let a user sign in from a newly acquired device and can make recovery after a lost phone easier. It also changes the security boundary: the organization must consider the platform account, synchronization process, device protections, and recovery of that platform account.
CISA advises against syncable authenticators in AAL3 scenarios. NIST’s 2024 supplement describes correctly implemented syncable authenticators as phishing-resistant and notes their cross-device and recovery benefits. These statements are compatible: an authenticator can resist phishing while still being unsuitable for an organization’s highest assurance level because of its synchronization and recovery model.
Classify applications and user populations by the assurance level they require. Do not issue one passkey policy to every account simply because the enrollment screen looks the same.
A practical deployment plan
- Inventory the authentication surface. List identity providers, critical applications, VPNs, administrative consoles, SaaS services, on-premises systems, browsers, operating systems, shared workstations, and contractor access paths. Record which systems support WebAuthn, PIV/CAC, app approval, OTP, or only legacy methods.
- Set assurance requirements by use case. Separate ordinary workforce access, privileged administration, sensitive data, service-desk operations, contractors, and shared-device scenarios. Document whether synchronization is allowed for each class and confirm the organization’s compliance requirements with its security and legal teams.
- Choose an authenticator mix. CISA’s hybrid identity guidance supports combinations of platform and roaming FIDO2 authenticators. A common pattern is platform passkeys for managed personal endpoints, roaming keys for administrators and users who move between devices, and an approved fallback for users awaiting enrollment.
- Validate the technical path. Test enrollment, sign-in, account switching, browser behavior, device lock and unlock, offline or intermittent connectivity, password reset interaction, and conditional-access policies. Test every critical application rather than assuming that support in the identity provider guarantees support in the application.
- Pilot representative users. Include employees, contractors, administrators, remote workers, shared-workstation users, and users with accessibility or device-availability constraints. Measure whether they can enroll two authenticators, sign in from each required endpoint, and complete recovery without help-desk bypasses.
- Issue spares and define ownership. For roaming keys and other physical credentials, record custody, replacement authority, shipping procedures, and return or destruction requirements. For platform passkeys, define what happens when a phone or computer is replaced, wiped, retired, or transferred.
- Design recovery before broad enrollment. Require a second enrolled authenticator where feasible. Create a verified service-desk procedure that checks identity using independent signals, records the action, revokes lost credentials, and prevents a temporary bypass from becoming a permanent weak factor.
- Roll out in stages. Start with administrators and high-impact applications, then expand to the workforce. Keep a time-limited fallback while enrollment coverage grows, monitor its use, and set a retirement date rather than allowing the fallback to become the default.
- Monitor and revise. Track enrollment failures, repeated prompts, lost credentials, recovery events, unsupported applications, and fallback usage. Review whether the selected mix still matches endpoint changes, new applications, and assurance requirements.
Recovery and lifecycle controls
Lost or stolen phone
Revoke the affected device or passkey through the identity platform, invalidate active sessions where appropriate, and issue a replacement using a pre-approved recovery path. If the user has another registered authenticator, require it for re-enrollment. Do not rely on an unverified phone call or an email link as the sole proof of identity.
Lost security key
Mark the key as lost, revoke its credential, and issue a spare or replacement. The spare should be enrolled before the primary key is lost whenever policy permits. Keep an inventory record without storing the private key.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Expired or replaced PIV/CAC card
Follow the PKI process for certificate renewal, revocation, reader replacement, and card issuance. Confirm that downstream applications recognize the new certificate chain before disabling the old credential.
Account recovery when no authenticator remains
Use a documented, audited identity-verification process with separation of duties for sensitive accounts. A temporary recovery factor should have a short lifetime, limited scope, and immediate replacement requirement. Recovery must not silently downgrade a high-assurance account to SMS or email indefinitely.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Integration and policy checklist
- Identity provider and application support for the selected FIDO2/WebAuthn features.
- Browser, operating-system, endpoint-management, and device-lock requirements.
- Whether users need USB, NFC, or another authenticator interface.
- Device-bound versus syncable credential behavior and the permitted assurance level.
- Enrollment of a second authenticator or issuance of a spare.
- Lost-device, lost-key, card-revocation, and help-desk recovery procedures.
- Contractor, temporary-worker, shared-workstation, and offline-access scenarios.
- Accessibility and replacement-device accommodations.
- Logging for enrollment, authentication, recovery, revocation, and fallback use.
- A retirement date and exit criteria for app OTP, SMS, or email fallbacks.
Which option fits which organization?
Mostly managed laptops and phones
Start with platform passkeys if the endpoint fleet and applications support them. Require device lock, endpoint management, and a second enrollment or controlled recovery route. Decide explicitly whether synchronization is allowed for each account class.
Privileged administrators and high-impact accounts
Use roaming FIDO2 security keys or another authenticator that meets the required assurance and custody model. Issue spares, separate administrative identities from ordinary user accounts, and test recovery without weakening the privileged path.
Government or established PKI environment
PIV/CAC may fit where card issuance, certificate validation, readers, and client-authenticated TLS are already operating. FIDO2 can still serve populations or applications that do not fit the card workflow; the choice should be based on application and assurance requirements.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Legacy applications with limited support
Use app approval or OTP only as a documented bridge while upgrading the application or placing it behind an identity layer that supports FIDO2. Treat SMS and email codes as the weakest fallback, not as a peer to a security key.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Common mistakes and how to correct them
Calling every code-based method passwordless security
“Passwordless” says nothing about phishing resistance. Label the mechanism precisely in policy and user instructions: FIDO passkey, roaming security key, app approval, app OTP, SMS code, or email code.
Assuming passkeys are interchangeable
Ask whether a credential is device-bound or syncable, what recovery does, and which assurance level permits it. CISA’s AAL3 caution about syncable authenticators makes this distinction operationally important.
Deploying without a spare or recovery path
Users lose phones and keys. Enroll a second authenticator where appropriate, document revocation, and rehearse replacement before the rollout reaches the whole organization.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBuying hardware before testing compatibility
Confirm identity-provider, application, endpoint, browser, connection-interface, and policy support first. A physical key that cannot be used with a critical application is not a recovery plan.
Leaving weak fallbacks permanently enabled
Fallbacks expand the attack surface. Limit who can use them, log every use, require replacement after recovery, and retire them when enrollment and application coverage are sufficient.
Bottom line: choose a managed mix, not a single universal authenticator
For most organizations, FIDO2/WebAuthn should be the target architecture. Platform passkeys provide convenience on managed devices; roaming security keys provide portability and a separately controlled token; PIV/CAC remains appropriate where card and PKI infrastructure already exists. App approvals and OTPs can keep legacy users moving during transition, while SMS and email codes belong at the bottom of the hierarchy. The correct combination depends on assurance level, endpoint and application support, syncability, recovery, and the users being served—not on the word “passwordless” alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
