Passkeys vs. Passwords vs. MFA: A Plain-English Guide to Phishing-Resistant Sign-In

 Turn on passkeys wherever a site offers them, add a physical security key to your email and bank, and stop relying on text-message codes: that combination blocks the fake-login-page scams that fool most other protection.

The options side by side

Only passkeys and hardware security keys are phishing-resistant: a password or a code can be typed into a fake website, but these two cannot. The table runs from weakest to strongest.

"MFA" (multi-factor authentication) just means a second proof on top of your password. Any MFA beats none, but the type of second proof decides whether a scammer can get around it.

Why a code can still be stolen

A code protects you only if you give it to the right website, and scammers build fake sites that look identical to the real one. CISA, the US cyber defense agency, says text-message, voice and authenticator-app codes are not phishing-resistant because you can be tricked into typing them into an attacker's page.

Here is how it usually plays out:

1. You get a text: "Your parcel is on hold, confirm your details."
2. The link opens a page that looks exactly like your bank or email login, and you type your password.
3. The fake page passes your password to the real site, which sends you a code.
4. You type the code into the fake page, and the attacker uses it on the real site within seconds.

A passkey breaks step 2. Your device checks the website's real address before it signs you in, so on a lookalike address it has nothing to hand over, and there is no code for you to type. NIST, the US standards body, states that manually entered one-time codes are not phishing-resistant, while passkeys are tied to the legitimate domain.

Your 30-minute plan

You can get the strongest protection onto your most important accounts in one sitting, with no technical knowledge. Work down the list in order and stop whenever you run out of time; each step helps on its own.

• Update your phone and computer. Passkeys need a reasonably recent system, and updates fix known security holes anyway.
• Set a strong screen lock. A passkey is only as safe as the fingerprint, face or PIN that unlocks it, so use a 6-digit PIN or longer rather than 1234.
• Open your email account's security settings and add a passkey. Look for "Passkeys" or "Sign in without a password" and follow the prompts; it takes about two minutes.
• Repeat for your bank, payment apps and Apple, Google or Microsoft account. Many big services now offer passkeys, and each one has the same "add a passkey" button in its security page.
• Buy two hardware security keys for your email and password manager. Look for keys labelled FIDO2 or passkey-compatible, and match the connector to your devices (USB-C, USB-A or tap-to-phone). Two keys cost roughly US$50 to $100 together.
• Add both keys to your email account, then store one somewhere safe at home.
• Remove the weak backups. Once a passkey or key works, delete text-message sign-in from the account where the site lets you. If you must keep your phone number on file, ask your mobile carrier to add a SIM-lock PIN so nobody can transfer your number.
• Save your recovery codes for each account (see below).

Two habits matter as much as the settings. Type the website address yourself or use your bookmarks instead of tapping links in messages. And never read a code out to anyone who contacts you first, including someone claiming to be your bank.

Which accounts to protect first

Start with the accounts that can unlock all the others, which means your email above everything else. CISA's advice to organizations is the same: protect email first, then the other high-value systems.

Losing your phone without losing your accounts

Keep at least two ways into every important account, so a lost phone is an inconvenience rather than a lockout. Recovery is also where scammers try next once sign-in is strong, so it deserves the same care.

• Use two security keys. Register both, and keep the spare in a safe place at home.
• Let your passkeys sync. Apple, Google and most password managers copy passkeys, encrypted, to your new device when you sign in to your account there.
• Print your recovery codes. Store the paper with your important documents, not as a screenshot on the phone you might lose.
• Keep your recovery email and phone number current, and protect that email like your main one.
• Tell one trusted person where the spare key and codes are.

Common worries, answered

What if someone steals my phone? A thief would also need your fingerprint, face or screen PIN to use the passkey. Turn on your phone's Find My or Find My Device feature, and from another device you can sign the lost phone out of your accounts.

Are passkeys stored in the cloud safe? They are encrypted, and NIST's final identity guidance, SP 800-63 Rev. 4, explicitly covers syncable passkeys. An earlier NIST update said they can meet its second-level (AAL2) assurance "if properly implemented", according to Yubico's summary.

Can I sign in on a friend's or work computer? Usually yes. Choose "use a passkey from another device", then scan the QR code on screen with your phone.

My bank doesn't offer passkeys. What now? Use the strongest option it has: the bank's own app for approvals beats text-message codes, and an authenticator app beats both. Ask the bank when passkeys are coming.

Does this make me unhackable? No. Passkeys do not stop malware on your device, malicious enrolment, or scammers who target the account-recovery process. They remove the most common attack, the fake login page, which is why they are worth setting up first.