Passwords, passkeys, and MFA: what to use where

The tools solve different problems

A password is a shared secret. A password manager helps create and store a different strong secret for each account. Multi-factor authentication requires another proof. A passkey uses public-key cryptography and is designed so the secret credential is not handed to the website during sign-in.

The National Institute of Standards and Technology explains that passkeys are phishing-resistant because they are bound to the legitimate site, while passwords are not. That does not make every passkey setup automatically safe: the devices, cloud account, screen lock, and recovery process around it still matter.

Protect accounts in dependency order

1. 1

   Primary email: it can reset many other accounts. Update its recovery email and phone, revoke unknown sessions, and enable the strongest MFA it supports.

2. 2

   Password manager or platform credential account: secure the vault or the Apple, Google, or Microsoft account that synchronizes passkeys.

3. 3

   Financial and identity accounts: banks, tax services, benefits, health portals, mobile carrier, and cloud storage.

4. 4

   Communication and social accounts: they can be used to impersonate you or target contacts.

5. 5

   Lower-impact services: migrate them as you sign in instead of trying to fix hundreds of accounts in one weekend.

Set up recovery before you need it

For each critical account, identify the exact recovery route. Is it another email, a phone number, backup codes, a second security key, a trusted device, or human support? Remove old phone numbers and inaccessible addresses.

Store one copy of backup codes somewhere protected but available when your primary device is lost. For a hardware security key, consider a second key stored separately. Tell a trusted household member how to locate your recovery instructions without giving them every credential today.

Use a practical password policy

• Let the password manager generate a long, random, unique password when a passkey is unavailable.
• For the manager’s own master password, use a long memorable passphrase that is not reused anywhere else.
• Do not add predictable site names, years, or punctuation to a reused base password.
• Change a password when it is exposed, shared, phished, or reused—not merely because the calendar changed.
• Treat unexpected MFA prompts as possible attack signals. Deny them and review the account rather than approving to stop the notifications.

A one-hour migration session

Choose the four dependency accounts above. For each one: save the official sign-in page, review active sessions, update recovery, add a passkey or strongest available MFA, store backup codes, and record the completion date. Stop after those accounts and repeat next week.

The goal is not a perfect authentication system. It is to remove credential reuse, protect the accounts that reset everything else, and make recovery deliberate rather than improvised.