Passwords, Passkeys and Two-Factor Authentication: How to Secure Your Accounts

The most effective way to protect your online accounts is to use passkeys wherever they are offered, a password manager with a long, unique password for everything else, and two-factor authentication (2FA) on your most important accounts, starting with email. Government cyber security agencies in the US, UK, Canada and Australia now give broadly the same advice, and it is simpler than the old rules about symbols and monthly password changes. Below we compare passkeys vs passwords, explain where 2FA fits in and set out what the official guidance recommends.

This guide explains what passkeys are, how they compare with passwords and 2FA, what makes a strong password in 2026, and the order in which to secure your accounts.

What Is a Passkey and How Does It Work?

A passkey is a way of signing in without typing a password. It is based on FIDO standards developed by the FIDO Alliance, an industry group, and uses a pair of cryptographic keys: one stored securely on your device or in your password manager, and one held by the website. When you sign in, you unlock the passkey with your fingerprint, face, PIN or device pattern, and your device proves who you are without sending a secret that can be stolen.

The big advantage is phishing resistance. Each passkey is tied to the genuine website or app it was created for, so it will not work on a fake login page, however convincing. The US Cybersecurity and Infrastructure Security Agency (CISA) describes FIDO-based authentication as the widely available form of phishing-resistant multi-factor authentication, and the UK’s National Cyber Security Centre (NCSC) says passkeys are its preferred way to log in where services offer them.

Are Passkeys Safer Than Passwords?

For most people, yes. Passwords can be guessed, reused, leaked in data breaches or typed into phishing sites. Passkeys avoid all four problems because there is no shared secret for you to reveal. The NCSC says passkeys are generally more secure than a password combined with 2-step verification.

Passkeys are not flawless. You need a plan for when you lose or replace a device, and account recovery processes can still be a weak point. Most major platforms sync passkeys across your devices through their password managers, which helps, but it is worth keeping backup sign-in methods up to date.

What Makes a Strong Password in 2026?

Password advice has changed considerably. The US National Institute of Standards and Technology (NIST) finalised its updated digital identity guidelines, SP 800-63B-4, in 2025. They say organisations should:

• Require length: at least 15 characters for passwords used on their own, and at least 8 when a password is only one part of multi-factor authentication.
• Allow long passwords, of at least 64 characters.
• Stop imposing composition rules, such as requiring a mix of upper case, numbers and symbols.
• Stop forcing periodic changes; change a password only when there is evidence it has been compromised.
• Screen passwords against lists of common, expected or breached passwords.

Advice for individuals points the same way. The Australian Cyber Security Centre recommends passphrases of four or more random words and at least 15 characters. The Canadian Centre for Cyber Security suggests a passphrase of at least four words and 15 characters, or a complex password of at least 12 characters. The NCSC has popularised “three random words” for memorable passwords, while recommending a password manager to generate passwords for most accounts.

The most important rule is never reuse passwords. If one site is breached, criminals try the same email and password combination on other services.

Should You Use a Password Manager?

Yes. A password manager generates and stores a unique, strong password for every account, fills it in for you and warns you about reused or breached passwords. Many also store passkeys. Built-in options from Apple, Google and Microsoft are free, and standalone managers work across different platforms. The Canadian Centre for Cyber Security advises protecting the manager itself with a strong master passphrase and multi-factor authentication.

What Is Two-Factor Authentication and Which Type Is Best?

Two-factor authentication, also called 2-step verification (2SV) or multi-factor authentication (MFA), adds a second check after your password, so a stolen password alone is not enough. Common methods, roughly from strongest to weakest, are:

• Passkeys and hardware security keys: phishing-resistant and the strongest option.
• Authenticator apps that generate time-based codes or approve sign-ins with a prompt.
• Text message (SMS) codes: much better than nothing, but vulnerable to SIM-swap fraud and phishing.
• Email codes: only as secure as your email account.

CISA recommends phishing-resistant MFA for everyone. If a service only offers SMS codes, turn them on anyway; any 2FA significantly raises the bar for attackers.

Which Accounts Should You Secure First?

Prioritise accounts that would give an attacker access to everything else:

• Email: it is used to reset passwords for most other accounts, which is why the NCSC puts it first.
• Your phone’s main account (Apple ID or Google account), including its backups.
• Banking, payment and investment accounts.
• Your password manager.
• Social media and messaging, which scammers use to impersonate you.
• Work and government accounts, such as tax and benefits services.

How Do You Set Up a Passkey?

The process is similar on most services. Go to the account’s security settings, look for “passkeys” or “sign in without a password”, and follow the prompts to create one on your phone or computer. You will be asked to confirm with your fingerprint, face or device PIN. Keep your existing password and 2FA in place as a backup until you are comfortable, and add a passkey on a second device if possible.

What Happens If You Lose Your Phone?

Because your phone may hold your passkeys, authenticator app and text message codes, losing it can lock you out of accounts if you have not planned ahead. Before that happens:

• Save backup or recovery codes when you turn on 2FA, and store them somewhere safe, such as your password manager or a printed copy at home.
• Add a second method, such as a hardware security key or a passkey on another device.
• Keep your recovery email address and phone number up to date.
• Make sure your passkeys and password manager sync to your account, so they can be restored on a new device.

If your phone is stolen, contact your mobile network to block the SIM, and use another device to sign out of sessions and change key passwords.

How Do You Spot Phishing Attempts?

Even with strong authentication, criminals will try to trick you. Warning signs include urgent messages asking you to “verify” your account, links to slightly misspelled websites, unexpected 2FA codes arriving on your phone, and requests to read out a code to someone who has contacted you. Never share a one-time code with anyone. Job seekers are a frequent target; our guide on how to find legitimate remote jobs explains common recruitment scams.

Security risks are also changing as AI tools spread. We have covered how organisations are building AI systems, such as retrieval-augmented generation, which makes basic account hygiene even more important for anyone using these tools at work.

What Are the Key Takeaways?

• Use passkeys wherever they are available.
• Use a password manager and a unique password of at least 15 characters for everything else.
• Turn on 2FA, preferably with an authenticator app or security key, starting with email.
• Never reuse passwords or share one-time codes.

Featured image: YubiKey 5C NFC, by Daniel Aleksandersen / Wikimedia Commons, CC BY 4.0. Cropped, colour-graded and combined with MediaPavilion branding.

Sources

• National Institute of Standards and Technology — SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management (2025).
• National Cyber Security Centre — Passkeys: what you need to know (accessed 23 October 2026).
• National Cyber Security Centre — Setting up 2-Step Verification (2SV) (accessed 23 October 2026).
• CISA — Implementing Phishing-Resistant MFA (fact sheet) (accessed 23 October 2026).
• FIDO Alliance — Passkeys (accessed 23 October 2026).
• Australian Cyber Security Centre — Creating strong passphrases (accessed 23 October 2026).
• Canadian Centre for Cyber Security — Best practices for passphrases and passwords (ITSAP.30.032) (accessed 23 October 2026).