Choosing a login method does not have to mean picking one technology for every account. This guide compares passkeys, password managers, authenticator apps, SMS codes, and security keys, then gives you a practical system for choosing, backing up, and reviewing the strongest option your account and devices support.
Overview
The best way to secure online accounts is usually a layered approach: use a passkey where it is supported and practical, use a password manager for accounts that still require passwords, and add a strong second factor to important accounts. SMS codes can be better than no additional protection, but they are generally a weaker fallback than an authenticator app or hardware security key.
Each method solves a different problem:
- Passkeys use a device-based credential, often unlocked with a screen lock, fingerprint, or face recognition. They are designed to reduce exposure to phishing and password reuse.
- Password managers create and store unique passwords so you do not need to remember them. They remain useful for services that do not support passkeys.
- Authenticator apps generate temporary verification codes. They provide an additional factor after a password is entered.
- Security keys are physical devices used to verify sign-ins. They are particularly useful for high-value accounts and people who want a separate, phishing-resistant factor.
- SMS codes deliver verification codes by text message. They are convenient, but depend on the security of your phone number and mobile account.
There is no universal winner for every person, device, or account. A passkey may be the simplest choice on a personal email account, while a password manager and security key may be more practical for a business administrator managing several devices. Your decision should account for security, recovery, device access, and your ability to maintain backups.
Quick decision table
| Situation | Practical first choice | Useful backup | Reason |
|---|---|---|---|
| Primary email or identity account | Passkey or security key | Authenticator app or second key | These accounts can reset access to many other services. |
| Banking or financial account | Strongest method the provider supports | Documented recovery method | Provider rules may limit your available options. |
| Shopping, subscriptions, or lower-risk services | Unique password in a password manager | Authenticator app if offered | Good password hygiene prevents reuse across sites. |
| Work or administrator account | Passkey or security key | Organization-approved backup | Administrative access can affect many users or systems. |
| Shared or replaced device | Synced passkey or password manager | Recovery codes stored safely | Access should survive device loss without relying on memory alone. |
| Limited technical comfort | Password manager or guided passkey setup | Printed or offline recovery instructions | A method you can reliably use is safer than one you abandon. |
What to track
Authentication choices should be treated as an account-maintenance task rather than a one-time setup. Keep a simple inventory of important accounts and record the protection currently enabled. Do not store passwords or one-time codes in an unprotected document; record only enough information to guide a review.
1. Which accounts matter most
Start with your primary email, password manager, financial accounts, mobile carrier, cloud storage, work identity, domain registrar, website hosting, and social accounts that could be used to impersonate you. For website owners, include registrar, DNS, hosting, analytics, advertising, code repository, and business email accounts. These accounts can control a domain, publish content, or expose customer and operational data.
2. Which sign-in methods are available
When reviewing an account, look for labels such as passkey, security key, two-step verification, authenticator app, or backup codes. Check whether the service permits more than one passkey or security key. Also note whether an existing password remains active after a passkey is added. Some accounts let you remove weaker methods; others retain recovery options by design.
3. How recovery works
Ask these questions before you need the answer:
- Can you sign in if your main phone is lost, damaged, or replaced?
- Can you add a second passkey or security key?
- Where are recovery codes generated, and where are they stored?
- Does account recovery depend on an email address, phone number, or support review?
- Will changing a password or recovery detail sign out other sessions?
- Can an administrator or trusted family member help recover the account?
Recovery is part of security. A method that is technically strong but leaves you locked out after a device failure may encourage unsafe workarounds, such as reusing passwords or disabling protection.
4. What has changed
Track phone replacements, operating-system changes, new browsers, new work devices, account ownership changes, and any suspicious sign-in alert. A new device is a reason to confirm that passkeys, password-manager access, authenticator backups, and recovery codes still work. If a phishing incident occurs, follow a structured recovery plan rather than relying on the same compromised device or session; see how to recover after phishing.
Cadence and checkpoints
A short quarterly review is sufficient for many personal accounts, with immediate reviews after major changes. Business and website owners may need a monthly check for administrator access, domain controls, and staff departures.
At account setup
- Use the service’s official website or app rather than a link in an unexpected email or text.
- Open the security or sign-in settings and confirm whether passkeys are supported.
- Set up a passkey, password-manager entry, or approved second factor.
- Add a backup method before leaving the settings page.
- Save recovery codes offline or in an appropriately protected location.
- Review active sessions and remove devices you do not recognize.
During a quarterly review
- Confirm that your primary email and password manager have their strongest available protection.
- Test that you can access your authenticator app or backup device.
- Check for unknown passkeys, security keys, devices, sessions, or recovery contacts.
- Replace reused, exposed, or manually stored passwords with unique generated passwords.
- Remove access for old employees, contractors, family members, or unused applications.
- Review mobile-carrier and email recovery settings, because these can influence account recovery.
For website owners, authentication is only one part of domain safety. Review registrar and DNS access alongside SPF, DKIM, DMARC, DNSSEC, and WHOIS privacy settings using this DNS security guide.
How to interpret changes
A newly available passkey is usually worth considering, but availability alone does not answer whether it fits your recovery plan. Before switching, check how the credential is stored or synchronized across your devices, whether you can create a second one, and what happens if you lose access to the device that created it. Use the service’s own instructions because setup screens and recovery policies vary.
If an account adds authenticator-app support, consider using it instead of SMS when you can reliably maintain the app and its backup process. If SMS is the only available option, enable it rather than leaving the account protected only by a password, and protect the associated mobile account with its own login security.
A password-manager warning about a reused or compromised password is a useful action signal. Change that password on the affected service, then change it anywhere else it was reused. Do not treat a password-strength label as proof that a website is legitimate. Before signing in, check the domain and use the service’s normal navigation path. Our guides on spotting phishing messages and checking whether a website is safe can help with that decision.
When an account introduces a new recovery requirement, read it carefully rather than dismissing it. A recovery email, backup code, or second device can be valuable, but each also becomes a security target. Keep recovery information private, review it periodically, and never provide a one-time code to someone who contacted you unexpectedly.
When to revisit
Revisit this comparison and your account inventory quarterly, and sooner when any of these events occur:
- You buy, lose, repair, or replace a phone or computer.
- You change your primary email address, phone number, or password manager.
- A service adds passkeys, changes its sign-in flow, or changes account-recovery options.
- You receive an unexpected sign-in alert, password-reset message, or security notification.
- You click a suspicious link, scan an unexpected QR code, or submit credentials to a questionable page.
- You take over a website, domain, advertising account, or other administrative system.
- A staff member, contractor, or household member no longer needs access.
Use this five-minute action list at your next review:
- List your five highest-value accounts.
- Mark whether each uses a passkey, password manager, authenticator app, security key, or SMS.
- Add a backup method that you can access without the primary device.
- Remove unknown sessions, old recovery details, and unused access.
- Record the next review date and repeat after any security alert or device change.
For broader maintenance, combine this authentication review with an online privacy checklist. Strong login protection works best when paired with careful handling of personal information, cautious responses to scam alerts, and regular review of who can access your accounts.
