A password alone is one secret an attacker can steal. Two-factor authentication (2FA) adds a second proof, and passkeys aim to replace passwords entirely.
The factors, ranked
| Method | Strength |
|---|---|
| Passkeys / hardware keys | Best — phishing-proof |
| Authenticator app (TOTP codes) | Good |
| SMS codes | Weak — SIM-swap vulnerable, but better than nothing |
Why SMS is weak
Attackers SIM-swap your number to a phone they control and receive your codes. Prefer an authenticator app or, better, a passkey.
Passkeys — the password killer
A passkey is a public/private key pair tied to a site and stored on your device. You log in with your fingerprint/face; the device proves possession of the private key.
no shared secret to steal · nothing to phish · bound to the real domainPasskeys are phishing-proof by design: even if you're fooled by a fake site, the passkey simply won't work there — it's cryptographically bound to the legitimate domain.
Turn on 2FA everywhere that matters — especially your email and password manager, since those unlock everything else.
Related: Password Managers · Symmetric vs Asymmetric Encryption · Threat Modeling for Individuals