2FA, Passkeys and Security Keys: What to Use at Home
Two-factor authentication (2FA) adds a second step when you sign in, so a stolen password alone is not enough. Passkeys go further and replace the password. Security keys are small physical devices for people who want extra protection. For most homes the free options are enough, and the most useful first step is turning on 2FA for your email account.
Quick answer
Turn on two-factor authentication for free, learn when passkeys beat codes, and see whether a security key is worth it, with free options first and official sources.
Where to start
On this page (10 sections)
Is this the right guide? This page covers second sign-in steps, passkeys and security keys. For a place to keep your passwords and recovery codes, see Password Managers for a Household: Free Options First. For backups, see Home Backups: the 3-2-1 Rule, Free Options First. Camera accounts? See How to Secure Your Security Camera.
New to a term? See the glossary: Two-factor authentication, Authenticator app, Passkey, Security key.
The short version
- Start with your email account. CISA’s example of the damage from skipping this: an attacker who gets into your email can use it to reach linked accounts such as banking and retail apps. Turn on 2FA there first, then banking, shopping and social media.
- Any 2FA is better than none. If the only option is a text code, use it. Where an authenticator app or a passkey is offered, those are the stronger choices.
- Free is enough for most homes. Built-in phone tools and free authenticator apps cover it. A physical security key is optional.
- Save your recovery codes when an account gives them to you, and keep them offline. See our backup guide.
- Store logins in a password manager. See our password manager guide.
This helps reduce risk; it is not a guarantee. This guide shares general information to help reduce risk. It is not a guarantee and it is not professional security advice. Vendor features, plans and menus change, so confirm details on the vendor’s own page before you rely on them.
How we built this guide
Facts below come from the pages we link, read on October 27, 2026: CISA’s Turn On MFA (CISA) and phishing (CISA) pages, the FIDO Alliance’s passkeys page (official site), and the vendors named. We have not tested any product here. We leave out prices, since they change. Everyday Tech Guide is not affiliated with these organizations and there are no affiliate links on this page.
2FA in one minute
Signing in normally uses something you know (a password). Two-factor authentication adds something you have or are. CISA says that even if someone steals your password, they cannot meet the second step. To turn it on, CISA’s steps are: open the account’s settings, find the security section, look for a setting called two-factor or two-step authentication (or similar), switch it on and choose a method.
The methods CISA lists are a numeric code by text or email, an authenticator app that generates a new code every 30 seconds, and biometrics such as a fingerprint or face scan. CISA’s advice is to turn on MFA for every account that offers it, starting with email, banking and social media, and its pro tip is to ask a provider why it does not offer it if it does not.
Which second step should you pick?
| Method | Cost | Good to know |
|---|---|---|
| Text or email code | Free | Easiest to start, and better than nothing. Bitwarden says codes sent by text can be exposed to SIM-swap attacks and need a mobile signal. |
| Authenticator app | Free options below | Codes change every 30 seconds and are made on your device. Bitwarden says they work offline. |
| Passkey | Free, built into modern phones and computers | The FIDO Alliance says passkeys are phishing-resistant and are unlocked the way you unlock your device. |
| Security key | Paid hardware, optional | A physical USB or NFC device. The FIDO Alliance says security keys hold device-bound passkeys. |
When the free built-in option is enough: for almost every household. Use a passkey where a site offers one and an authenticator app or text code where it does not.
Free authenticator apps
Bitwarden Authenticator Free
Who it is for: anyone who wants a separate, free codes app on iPhone or Android.
What Bitwarden says
- The free app is open source, generates time-based codes, and is available free on iOS and Android.
- It can be used without a Bitwarden account.
- In this release its data is backed up through the phone’s own backup service, so make sure your phone is set up for backups.
- It suggests writing down and storing your recovery codes in a secure place.
Bitwarden Authenticator (official site)
Not independently tested. This is based on the vendor’s own pages, read on October 27, 2026.
Apple Passwords Free, built in
Who it is for: iPhone, iPad and Mac households.
What Apple says
- The Passwords app stores passwords, passkeys and verification codes together, on iOS 18, iPadOS 18, macOS Sequoia and visionOS 2 and later.
Apple: about the Passwords app (official site)
Not independently tested. This is based on the vendor’s own pages, read on October 27, 2026.
If you use a password manager that also stores one-time codes, check its plan page: for example, Bitwarden says built-in code generation is a premium feature of its password manager, and Proton says integrated 2FA is on its paid plan. We could not confirm other authenticator apps as free from their own pages for this guide, so we do not list them.
Passkeys: signing in without a password
The FIDO Alliance describes a passkey as a sign-in credential based on FIDO standards that is stored on your phone or computer, or on a hardware security key, and that you approve the same way you unlock your device, such as a fingerprint, face scan, PIN or pattern. It says passkeys are always strong and phishing-resistant, and that your biometric information stays on the device and is never sent to a remote server.
Synced or device-bound
Per the FIDO Alliance, a passkey can be synced across your devices through a passkey provider, or be device-bound and never leave one device. It says syncing is end-to-end encrypted, and that built-in providers include iCloud Keychain and Google Password Manager, with third-party apps as another option.
Setting one up on Google
- Google says to create passkeys only on devices you own, not on shared or borrowed ones.
- Adding a passkey does not remove your other sign-in methods.
- Google also notes a possible seven-day wait before a new passkey works in some situations; check its page for the current rules.
Google: sign in with a passkey (official site) FIDO Alliance: passkeys (official site)
Where passkeys get stored matters
If your passkeys sync through Apple, Google or a password manager, then that account is now the key to everything. Protect it with a long unique passphrase and its own 2FA, as covered in our password manager guide. Bitwarden’s pricing page lists passkey management among its features, and Proton lists passkeys on its free plan.
Security keys: when they make sense
A security key is a small physical device you plug in or tap to confirm a sign-in. The FIDO Alliance says security keys store passkeys on hardware, and that device-bound passkeys on modern security keys offer the highest assurance; it also says they can help someone who does not use a smartphone, and can act as a recovery credential if you lose the devices your passkeys are synced to.
Do you need one? For most households, no. It is a paid extra on top of the free options, and an authenticator app or passkey already helps reduce risk a great deal. A key is worth considering for an account that would be very costly to lose, or for someone who cannot use a phone-based flow. If you do buy one, we suggest getting two so a lost key does not lock you out.
Yubico Security Key series
What Yubico says
- The Security Key series supports FIDO2/WebAuthn and U2F, and comes in USB or NFC versions.
Yubico: Security Key series (official site)
Not independently tested. This is based on the vendor’s own pages, read on October 27, 2026.
Google Titan Security Key
What Google says
- Titan keys are sold in the U.S. (except Puerto Rico) in USB-C with NFC and USB-A with NFC versions.
Google: Titan Security Key (official site)
Not independently tested. This is based on the vendor’s own pages, read on October 27, 2026.
Recovery and phishing: the two things that go wrong
Plan for a lost phone
- Save the recovery or backup codes each account gives you, and keep them offline or in your password manager.
- Keep your passkey provider or authenticator app backed up, following the vendor’s own instructions linked above.
- Know which devices hold your codes before you replace or reset a phone.
Phishing still matters
Phishing is a scam message that tries to get you to click or share information. CISA’s advice is to recognize it, resist the urge to click, and delete it, and to look up a company’s contact details another way instead of using the ones in the message. 2FA helps reduce risk but a code typed into a fake site can still be stolen, which is one reason the FIDO Alliance describes passkeys as phishing-resistant. See CISA: recognize and report phishing (CISA).
A 30-minute household checklist
- Turn on 2FA for each family member’s main email account.
- Do banking and shopping accounts, then social media.
- Choose an authenticator app, or the built-in one on your phone, and save recovery codes.
- Switch to a passkey wherever a site offers one and you own the device.
- Secure the accounts behind your smart home: the router admin, camera and doorbell apps. See camera security and the Home Network Health Check.
- Help older relatives set up the simplest option they will actually use. A text code is better than none.
Frequently asked questions
What is the difference between 2FA and MFA?
Two-factor authentication uses exactly two checks, such as a password and a code. Multi-factor authentication means two or more. Bitwarden notes that 2FA uses two verification methods while MFA can use two or more. For home use the terms are often used interchangeably.
Is a text message code good enough?
It is better than nothing. CISA lists a code by text or email as a valid MFA method. Bitwarden says authenticator apps are stronger because text codes can be exposed to SIM-swap attacks and depend on a mobile network. If a site only offers text, turn it on.
Are passkeys better than 2FA codes?
The FIDO Alliance says passkeys, standing alone, are more secure than a password plus a one-time code or phone approval, because those second steps can still be phished. Use a passkey where a site offers one, and keep 2FA on for sites that do not.
What if I lose the phone with my authenticator app or passkeys?
Use the recovery codes you saved when you turned 2FA on, or a second device or a security key if you set one up. Bitwarden says its Authenticator app is backed up through your phone's own backups, and the FIDO Alliance says synced passkeys come back when you sign in to your passkey provider on a new device. Check each vendor's page for its recovery steps.
Do I need a hardware security key?
Most households do not. Free options such as passkeys and authenticator apps already help reduce risk. A key is an optional paid extra for accounts that would be very costly to lose. If you buy one, consider a second as a spare.
Should I use 2FA on my security camera and router accounts?
Yes, wherever it is offered. Those accounts control devices in your home. The FTC and CISA both recommend two-factor authentication for camera accounts; our camera security guide covers the steps.