Two-step verification and passkeys: which kind is strongest

Any second step is far better than a password alone, but not all second steps are equal. Knowing the difference between a text code, an app, a security key and a passkey lets you choose the strongest option your accounts offer.

Watch the 1-minute overview

Watch the full video guide for this module

Quick recap: what 2SV does

• 2-step verification (2SV), also called two-factor authentication (2FA) or multi-factor authentication (MFA), helps keep criminals out of your accounts 'even if they know your passwords' (NCSC).
• Common second steps include a code by text or email, a fingerprint or face scan, an authenticator app, or a separate device such as a USB key (NCSC).
• Start with your most important accounts: email, banking, social media and online shopping (NCSC).
• Lesson ai-07 shows how to switch it on. This lesson is about choosing the strongest kind.

The strength ladder, from strongest to weakest

• Top: phishing-resistant methods such as passkeys and hardware security keys built on FIDO standards. CISA urges organisations to use phishing-resistant MFA based on FIDO and similar technology (Infosecurity Magazine).
• Middle: authenticator apps and app approval prompts. Better than text codes, but a fake site can still trick you into typing an app code, and approval prompts can be abused by push bombing. CISA calls number matching (typing a number shown on screen) one of the best interim fixes.
• Lower: codes by text message or voice call. CISA lists SIM swaps and weaknesses in phone networks (SS7) among the ways these are stolen, and the FTC warns text verification may not stop a SIM swap (BleepingComputer).
• Bottom: a password with no second step at all.
• The practical rule: use the highest rung each account offers, but never switch off 2SV just because the only option is a text code. A text code still stops most password-only attacks.

Passkeys in plain language

• A passkey lets you sign in with your device's fingerprint, face or screen-lock PIN instead of typing a password (NCSC).
• Behind the scenes it uses a pair of cryptographic keys. The website holds only a public key, so there is no shared secret on the server for criminals to steal (FIDO Alliance).
• Each passkey is tied to one specific website or app, so a look-alike phishing site cannot use it, and there is nothing for you to type into a fake page (FIDO Alliance).
• Google notes that your fingerprint or face data stays on your device and is never shared with Google, and that passkeys 'can't be shared, copied, written down, or accidentally given to someone else'.
• In April 2026 the NCSC said passkeys are 'at least as secure as, and generally more secure than' the strongest password combined with 2SV, and recommended them as the default where available (Computing).

Synced passkeys, device-bound passkeys and security keys

• Synced passkeys are copied between your devices through a cloud account, so a new phone can still sign you in (FIDO Alliance).
• Because your credential manager backs them up, the NCSC says you should not completely lose access to your passkeys if you lose a device.
• Device-bound passkeys never leave one device. The FIDO Alliance says those in modern hardware security keys offer the highest security assurance.
• Only create passkeys on devices you personally own, never on a shared device, because anyone who can unlock that device can get into your account (Google).
• If you lose a device, remove its passkey from your account using another device you control (Google).

Do not let 2SV become a backdoor

• Never read out, forward or type a code that someone else asks you for, even if they claim to be from the company or a friend. The Scams and Fraud module covers these tricks.
• Never tap 'approve' on a login request you did not start.
• Keep your recovery options current: a recovery email and phone number you still control. If a service offers backup codes, store them somewhere safe and offline, such as your password manager or a sealed note at home.
• Where passkeys are not offered, the NCSC says to keep using strong passwords from a password manager, with 2SV switched on.