# Passkeys vs 2FA: what a FIDO2 hardware security key is, how passkeys differ, and which to use URL: https://webvpn.org/encryption/passkeys-vs-2fa/ Updated: 2026-09-12 Passkeys vs 2FA compared, what a hardware security key is, how FIDO2 keys stop phishing, what to look for in a security key, and how passkeys and keys fit together. Passkeys and hardware security keys both replace phishable passwords and one-time codes with public-key cryptography defined by the FIDO2 and WebAuthn standards: the site stores a public key, your device or key holds the private key, and signing in means proving possession by signing a challenge that is bound to the site's real domain, so a look-alike phishing site receives nothing it can use. A passkey lives in your phone, computer or password manager and can sync across devices; a hardware security key keeps the private key in a tamper-resistant chip you carry. Traditional 2FA codes remain far better than a password alone, but they can be phished in real time, which is the gap these replace. The vocabulary around modern authentication is confusing, with passkeys, FIDO2, WebAuthn, U2F and security keys used interchangeably in marketing and settings menus. This guide sorts them out: why codes are phishable, how FIDO2 authentication works, how passkeys and hardware keys differ in practice, what to look for in a security key, and how to move your accounts over without locking yourself out. ## Why codes can be phished Traditional two-factor authentication adds a second step after the password: a code from an SMS, an authenticator app, or a push approval. It stops an attacker who has only the password. It does not stop a phishing site that relays your entries in real time. You type your password and code into the fake site, the fake site types them into the real one within seconds, and the attacker is in. Push approvals fall to fatigue attacks, where repeated prompts eventually get approved. SMS additionally falls to SIM swapping, covered in the phone number guide on this site. The common flaw is that a code is a secret you type, and anything you type can be relayed. ## How FIDO2 authentication works FIDO2 is the standard behind both passkeys and security keys, comprising WebAuthn, the browser interface, and CTAP, the protocol between a computer and an external key. It works like this. - Registration. When you add a passkey or key to an account, your authenticator generates a fresh key pair for that site. The private key never leaves the authenticator. The public key goes to the site along with a credential identifier. - Authentication. The site sends a random challenge. Your browser passes it to the authenticator together with the site's origin, its real domain name. The authenticator checks that the origin matches the one the key was registered for, asks you to confirm with a touch, fingerprint, face or PIN, and signs the challenge with the private key. - Verification. The site checks the signature with the stored public key. A match proves you hold the private key. Because the signature covers the origin, a signature made for a phishing domain is worthless at the real site, and the authenticator would not produce one for a mismatched domain in the first place. Nothing reusable crosses the network. There is no shared secret on the server to leak in a breach, only public keys. Each site gets a different key pair, so credentials cannot be correlated across services. The public-key cryptography guide on this site explains the mathematics. ## Passkeys A passkey is a FIDO2 credential stored in software you already have: the iCloud Keychain on Apple devices, Google Password Manager on Android and Chrome, Windows Hello, or a third-party password manager such as Bitwarden or 1Password. You unlock it with the device's biometric or PIN. Passkeys come in two forms. Synced passkeys are backed up and synchronised across your devices through the provider's end-to-end encrypted sync, so a passkey created on your phone works on your laptop. Losing one device does not lose the passkey; recovering the account with the provider recovers them. The trade is that the private key exists in more than one place and the provider's sync security and account recovery become part of the trust model. Device-bound passkeys stay on one device and cannot be exported. They are effectively what a hardware security key holds. For most people, synced passkeys are a large improvement over passwords with codes, with better convenience, since signing in is a fingerprint rather than a password and a code. ## Hardware security keys A hardware security key is a dedicated device, typically USB-A or USB-C with NFC, that holds FIDO2 credentials in a secure element. You plug it in or tap it to your phone, touch the button or sensor, and enter a PIN if the site requires user verification. Keys from Yubico, Google, Nitrokey, SoloKeys, Feitian and others are certified against the FIDO standards. Many also support older U2F for sites that have not moved to FIDO2, and some add unrelated functions such as OpenPGP smart card, PIV certificates for computer login, TOTP code storage, or a fingerprint reader instead of a PIN. The PGP tools and VeraCrypt tutorial guides on this site touch on those extras. The key's advantages over a synced passkey are that the private key cannot be copied off the chip by malware or by anyone who compromises your cloud account, that it works on any computer including ones you do not trust with your password manager, and that it is independent of any platform. Its disadvantages are that you must carry it, that losing it without a backup locks you out, and that it costs money. Keys can store a limited number of resident passkeys, sufficient for most people's important accounts. ## Passkeys versus security keys Aspect Synced passkey Hardware security key Phishing resistance Yes Yes Private key location Device, synced via provider Secure element in the key Works if device lost Yes, via sync and account recovery Only with a registered backup key Malware exfiltration Very difficult; depends on device and provider Not possible Convenience Highest Requires carrying the key Cost Free Purchase, ideally two Platform independence Tied to an ecosystem or manager Any platform Best for Everyday accounts, most people High-value accounts, admins, journalists, recovery Most security-conscious people end up with both: passkeys for daily convenience, and two hardware keys registered on their email, password manager, financial and cloud accounts as the phishing-proof recovery path. ## Choosing a hardware security key - FIDO2 certification. Non-negotiable. Check the FIDO Alliance's certified products list or the maker's documentation. - Connector. USB-C for modern laptops and Android phones; NFC for tapping phones including iPhones; USB-A only if you have older machines. Some keys offer both USB-C and NFC in one, which suits most people. - Resident credential capacity. Passkeys stored on the key count against a limit, commonly a few dozen to a hundred depending on model and firmware. Enough for important accounts; not for every site. - User verification. A PIN is standard; a fingerprint model removes PIN entry at a higher price. - Extras. OpenPGP, PIV, TOTP and static passwords matter to specific users and add nothing for most. Open-source firmware, offered by Nitrokey and SoloKeys, matters to some. - Reputation and supply. Buy from the maker or an authorised reseller, not a marketplace listing of unknown origin. - Buy two. One in use, one stored safely. Register both on every account at the same time. ## Migrating your accounts: a seven-step plan - Buy two hardware keys or set up passkeys on your primary device with a password manager or platform keychain. - Start with your email account, since it recovers everything else. Add a passkey or both keys. - Add them to your password manager, then financial accounts, cloud storage, social and developer accounts, in order of importance. - On each account, once passkeys or keys are working, remove SMS as a second factor and, where the site allows, disable password fallback. - Keep an authenticator app as a fallback where passkeys are not yet supported. - Store the backup key and any recovery codes offline, separately from your devices. - Test signing in from a fresh browser with only the key, and with only the backup key, so you know both work before you need them. ## What the FIDO Alliance, platform vendors and security researchers say The description above follows the standards and published research. The FIDO Alliance and W3C specifications for FIDO2, WebAuthn and CTAP describe origin-bound public-key authentication with the private key held by the authenticator, and the FIDO Alliance describes passkeys as FIDO credentials that may be synced across a user's devices or bound to a single device. Apple, Google and Microsoft document passkey support in their platforms with end-to-end encrypted synchronisation, and hardware key makers document FIDO2 certification, resident credential limits and supported connectors. Security researchers who have studied phishing at scale report that one-time codes and push approvals are defeated by real-time relay and prompt-fatigue attacks, while FIDO2 authentication has proven resistant in large deployments, and recommend registering at least two authenticators to avoid lockout. ## Replace the code, keep a spare Set up a passkey for your email today and register a hardware key beside it, then work down your account list. Each account you move stops being phishable, and the spare key in the drawer means losing a phone or a key costs you a trip to the drawer rather than your accounts. The rest of the encryption guides on this site protect your data; this is how you protect the doors to it. ## FAQ Q: What is the difference between passkeys and 2FA? A: Traditional 2FA adds a second step, usually a code, to a password; both can be phished. A passkey replaces the password entirely with a cryptographic key pair: the site stores a public key, your device holds the private key and proves possession by signing a challenge bound to the site's domain. Nothing reusable is ever typed or sent, so phishing sites get nothing. Q: What is a hardware security key? A: A small device, usually USB or NFC, that holds private keys in a tamper-resistant chip and signs authentication challenges when you tap it. It implements the FIDO2 and WebAuthn standards and often older ones such as U2F. Because the key checks the website's domain before signing, it cannot be tricked by a look-alike site. Q: Are passkeys better than a hardware security key? A: They use the same cryptography and are equally phishing resistant. Passkeys stored in a phone or password manager are more convenient and sync across devices, with recovery through the account. Hardware keys keep the private key in a chip you physically control, cannot be exfiltrated by malware, and are the stronger choice for high-value accounts and as a recovery method. Q: What is the best hardware security key? A: One certified for FIDO2 with a connector matching your devices, USB-C and NFC for most people, from an established maker such as Yubico, Google's Titan line, Nitrokey, SoloKeys or Feitian. Buy two, register both everywhere, and store one as a backup. Extra features like PIV, OpenPGP or a fingerprint reader are useful for some and unnecessary for most. Q: Do I still need 2FA if I use passkeys? A: A passkey is already two factors in one: possession of the device or key, and the biometric or PIN that unlocks it. Sites that support passkeys fully do not ask for a separate code. Keep a second passkey or a hardware key registered as a backup, and remove SMS codes as a fallback where the site allows, since they weaken the account.