Something you know
A password, PIN, or recovery phrase.
MFA Guide
What MFA is
Section titled “What MFA is”Multi-factor authentication (MFA) means proving who you are with two or more independent credentials drawn from different categories:
Something you have
A passkey on your phone, a security key, an authenticator app.
Something you are
A fingerprint or face scan that unlocks the “something you have.”
A password by itself is one factor. A password + an SMS code is technically two factors but a poor one (see below). A password + a passkey is two factors that are genuinely different — and meaningfully harder to bypass.
The 2026 Hierarchy
Section titled “The 2026 Hierarchy”Not all MFA is equal. The difference that matters most is phishing resistance — can the second factor be stolen by tricking you into giving it to a fake site?
| Tier | Method | Phishing-resistant? | Best for |
|---|---|---|---|
| Best | Passkeys + hardware security keys (both are FIDO2/WebAuthn) | ✅ Yes — credential is bound to the legitimate domain | Anything that offers it |
| OK | TOTP authenticator app (Aegis, Ente Auth, 2FAS) | ❌ No — codes can be stolen by AiTM proxies | Sites that don’t yet support passkeys |
| Weak | SMS codes | ❌ No — and vulnerable to SIM swap, SS7 interception | Last resort only |
| Avoid | Email codes, “security questions” | ❌ No — your email password is the same factor; questions are public records | Skip entirely if possible |
CISA (2022, reaffirmed in their 2024 “Secure by Demand” guide): “The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.”
NIST SP 800-63B Rev. 4 (April 2024): synced passkeys are acceptable at AAL2. Hardware-resident FIDO2 credentials reach AAL3. SMS-based MFA is restricted.
Passkeys
Section titled “Passkeys”Passkeys are the biggest change since this page was first written. If you only do one thing from this guide, enroll a passkey wherever it’s offered.
What a passkey actually is
Section titled “What a passkey actually is”A passkey is a FIDO2 / WebAuthn credential — a cryptographic keypair created when you register at a site. The private key never leaves the authenticator. When you sign in, the site sends a random challenge, your authenticator signs it with the private key, and the site verifies the signature with the public key it stored at registration.
Two things make this phishing-resistant:
- The credential is bound to the legitimate domain. A fake
goog1e.comsite can’t get a signature from yourgoogle.compasskey — the authenticator refuses. - There’s no shared secret sent over the wire. Even a perfect AiTM (attacker-in-the-middle) proxy can’t replay anything useful.
Synced vs. device-bound passkeys
Section titled “Synced vs. device-bound passkeys”| Synced passkeys | Device-bound passkeys | |
|---|---|---|
| Where it lives | A password manager or OS keychain that syncs across your devices | A hardware security key — never leaves the device |
| Convenience | High — log in from any of your devices | Lower — you have to have the key physically |
| Recovery | Through your sync provider | Through a backup hardware key |
| NIST level | AAL2 | AAL3 |
| Best for | Daily-driver accounts on many devices | Critical accounts (email, financial, admin, password manager itself) |
Most readers will mix both: synced passkeys for the bulk of their accounts, hardware-key-bound for the few accounts where compromise would be catastrophic.
Where to store passkeys (mid-2026)
Section titled “Where to store passkeys (mid-2026)”| Storage | Synced? | Notes |
|---|---|---|
| Apple Passwords / iCloud Keychain | Apple devices only | Default on iOS/macOS. Locked into the Apple garden. |
| Google Password Manager | Google account / Chrome | Default on Android/Chrome. Locked into Google. |
| Bitwarden | Cross-platform | FOSS, free tier includes passkeys. Strong default for most users. |
| 1Password | Cross-platform | Polished UX, paid only. Native Windows 11 passkey provider since late 2025. |
| Proton Pass | Cross-platform | FOSS, free tier includes passkeys. Ties into Proton account suite. |
| KeePassXC / KeePassDX | File-synced (you provide the sync) | Both support passkeys. Offline-friendly. |
| YubiKey 5 / Nitrokey 3 / Token2 | No — device-bound | The phishing-resistant choice for high-value accounts. |
Which services support passkeys
Section titled “Which services support passkeys”Solidly supported (web and mobile): Google, Apple ID, Microsoft, GitHub, Amazon, PayPal, LinkedIn, X/Twitter, WhatsApp, Coinbase, eBay, Best Buy, Shopify, Adobe, the password managers themselves. About 48% of top-100 sites as of late 2025.
Laggards to be aware of:
- Most US retail banks — still TOTP or SMS-only.
- Discord, PayPal web UX — mobile-only or quirky.
- Many self-hosted SaaS — depends on the project.
A live, community-maintained directory is at passkeys.io.
What can go wrong with passkeys
Section titled “What can go wrong with passkeys”- Phishing-resistant ≠ unphishable. Attackers shift to account-recovery flows, helpdesk social engineering, and forcing fallback to SMS/TOTP. If a site lets you reset 2FA by clicking an email link, the email account is the real factor.
- Sync-provider lock-in. Apple passkeys don’t easily leave Apple. Google’s don’t easily leave Google. The FIDO Alliance’s Credential Exchange Format (CXF) is shipping but slow — practical cross-provider migration in 2026 is still painful.
- “Where did I save it?” When Apple Passwords, Google Password Manager, Bitwarden, and 1Password are all installed, they fight over the passkey UI. Pick one as your primary passkey home and disable autofill in the others.
- Recovery is the soft spot. Lose your Apple ID or Google account → all synced passkeys gone. Always keep a hardware-key passkey or printed recovery codes for the accounts you can’t afford to lose.
Hardware Security Keys
Section titled “Hardware Security Keys”Even with synced passkeys in a password manager, a hardware security key still earns its place — it’s the device-bound, AAL3, can’t-leave-this-piece-of-metal option. Use one (actually two) for the handful of accounts where compromise would ruin your week.
Why you still want one
Section titled “Why you still want one”- Highest assurance level. Synced passkeys reach AAL2; hardware-bound FIDO2 credentials reach AAL3.
- Independent of any cloud provider. No sync provider to lock you out.
- Recovery anchor. A YubiKey or Nitrokey is the backup that survives losing your phone and losing your password manager.
Buying guide (mid-2026)
Section titled “Buying guide (mid-2026)”| Use case | Pick | Approx. price |
|---|---|---|
| First key — entry-level | Yubico Security Key C NFC (blue, FIDO2 only) | ~$29 |
| Power-user pair (main + backup) | 1× YubiKey 5C NFC + 1× Security Key C NFC | ~$87 |
| FOSS-priority | Nitrokey 3C NFC (×2 for backup) | ~$118 |
| Maximum features | YubiKey 5C NFC (×2) | ~$116 |
| Cheap bulk / secondary | Token2 PIN+ Release 3 (FIDO2-only, Swiss-audited 2024) | ~$13–25 |
Notes:
- The YubiKey 5 Series (~$58) costs roughly 2× the blue Security Key because it adds PIV smart card, OpenPGP, OATH-TOTP, Yubico OTP, and challenge-response. If you just want WebAuthn/passkeys, the blue key is enough.
- YubiKey firmware is not field-updatable — a CVE means buying a new key. Nitrokey 3 firmware is upgradeable.
- Buy two keys at enrollment. Register both on every important account. Store the backup offsite (safe deposit box, trusted family). Mixing vendors (one YubiKey + one Nitrokey) hedges against single-vendor firmware bugs.
For the deeper setup walkthrough — GPG on-card, FIDO2-sk SSH keys, smartcard configuration, and what works in each desktop/mobile email and SSH client — see the SSH & GPG Keys page.
Setup (per account)
Section titled “Setup (per account)”- Log in and open the account’s Security settings.
- Find “Add a security key” or “Passkey” (some sites unify these now).
- Plug in the key (USB-C) or tap to NFC when prompted.
- Touch the gold disk on the key to confirm presence.
- Repeat with your backup key before leaving the page.
- Download backup recovery codes if the site offers them; store in your password manager and offline (printed, in your fire safe).
Compatibility caveats
Section titled “Compatibility caveats”- GrapheneOS NFC works for FIDO2 sign-ins; some quirks on Android 16 with the Yubico Authenticator app auto-launching (forum thread). WebAuthn flows are unaffected.
- iOS over NFC works on iPhone 7+; over USB-C on iPhone 15+.
Authenticator Apps (TOTP)
Section titled “Authenticator Apps (TOTP)”TOTP is now a fallback factor — use it where passkeys aren’t offered (most banks, legacy SaaS, many self-hosted services). It generates a 6-digit code every 30 seconds from a shared secret.
TOTP is not phishing-resistant. An AiTM proxy that captures your password can also capture the code in real time. It’s still vastly better than SMS, just not as good as FIDO2.
Recommended apps
Section titled “Recommended apps”| App | Platform | Sync | Notes |
|---|---|---|---|
| Ente Auth | Cross-platform (Android, iOS, desktop, web) | E2EE, opt-in | New top cross-platform pick. FOSS, server audited by Cure53 (Oct 2025). |
| Aegis | Android only | Local-only by design | Top Android-only pick. F-Droid: com.beemdevelopment.aegis. Pair with Syncthing if you need multi-device. |
| 2FAS | Android, iOS | iCloud / Google Drive (not E2EE) | Acceptable iOS option. Be aware sync isn’t end-to-end encrypted. |
| OTP Auth | iOS only | Encrypted iCloud | Apple Watch, Siri integration. Niche but solid for power users. |
| Bitwarden Authenticator | Cross-platform | E2EE | Fine if you’re already deep in Bitwarden. Keep it separate from the password vault. |
Don’t use
Section titled “Don’t use”- Authy. Twilio killed the desktop apps in March 2024 and the mobile app is in maintenance mode. The app hides the seeds, so migration off it requires re-enrolling every account. Migrate now, don’t wait.
- Google Authenticator’s cloud sync. Added in 2023, but the synced seeds are not E2EE — Google holds the keys. The local-only mode of the same app is fine.
- Microsoft Authenticator unless you’re in the Microsoft 365 ecosystem.
Should you put TOTP in your password manager?
Section titled “Should you put TOTP in your password manager?”Convenient, but a real tradeoff: it collapses two factors (something you know + something you have) into one (access to the vault). The 2026 community consensus:
| Account type | TOTP in password manager? |
|---|---|
| Low/medium-stakes (forum, retailer, social) | ✅ Acceptable |
| The password manager itself | ❌ Never |
| Primary email | ❌ Never |
| Banking, brokerage, crypto | ❌ Never |
| Sysadmin / root / cloud-admin | ❌ Never |
For the “never” rows, use a separate TOTP app or a hardware key.
- Open the account’s Security settings, enable Multi-Factor Authentication → choose Authenticator App.
- Scan the QR code with your chosen app.
- Also store the secret (text below the QR) in your password manager as a recovery anchor — without it, a lost phone means a lost factor.
- Download backup codes and store offline.
- Test sign-in before logging out.
SMS and Email Codes
Section titled “SMS and Email Codes”Use only if literally no other option exists.
- SMS is vulnerable to SIM swap (the attacker convinces your carrier to port your number), SS7 interception, and any malware on the receiving device. CISA, NIST, and the broader security community have been pushing the industry off SMS for years; some banks still haven’t moved.
- Email codes turn your email password into the de-facto MFA secret. If your email is itself protected only by a password, the “two factors” are the same factor.
If a service only offers SMS, at minimum: set a SIM PIN on the receiving phone, and enable a port-out lock with your carrier (Verizon “Number Lock,” AT&T “Wireless Account Lock,” T-Mobile “SIM Protection,” Mint “SIM Lock”). These don’t make SMS phishing-resistant, but they make SIM swap harder.
Backup and Recovery
Section titled “Backup and Recovery”The thing that actually locks people out is not having a recovery plan when their primary factor disappears. Build one at enrollment, not after.
TOTP backups
Section titled “TOTP backups”- Save the secret seed (the text under the QR code, or a JSON/
.2fasexport) somewhere recoverable — your password manager is fine for low-stakes accounts; for high-stakes, also keep an offline copy. - Don’t rely on Seedvault to back up authenticator app data — it doesn’t reliably preserve it.
- Migration from Authy: requires re-enrolling every account from the original site. Plan for an afternoon.
Hardware key strategy
Section titled “Hardware key strategy”- Two keys minimum. Register both on every important account at the moment you enroll. Doing it later is harder because some sites lock you out of re-enrollment without an MFA.
- Mix vendors (one YubiKey + one Nitrokey or Token2) to hedge against any single vendor’s firmware CVE.
- Store the backup offsite. Safe deposit box, trusted family, hidden in a labeled “old electronics” drawer at a different address.
Passkey recovery
Section titled “Passkey recovery”- Your sync provider is your single point of failure for synced passkeys. Treat losing your Apple ID / Google / Bitwarden account as a worst-case event and plan accordingly.
- Keep a hardware-key passkey for the accounts where losing access is catastrophic.
- Print recovery codes for the top 3–5 accounts (email, password manager, banking) and store them with the offsite backup key.