Two-Factor Authentication and Passkeys
Passwords alone are no longer enough. Even a truly random, uncrackable password can be stolen in a phishing attack, leaked in a data breach, or intercepted on an insecure network. That's where two-factor authentication and passkeys come in — they add a second layer of verification that makes a stolen password useless to an attacker.
What is two-factor authentication?
2FA requires something you know (your password) plus something you have (a phone, hardware key, or authenticator app) or something you are (a fingerprint or face scan). The most common forms are time-based one-time passwords (TOTP) from apps like Google Authenticator or Authy, SMS codes, and hardware security keys like YubiKey.
Passkeys: the next evolution
Passkeys are a newer standard that replaces passwords entirely with cryptographic key pairs. Your device generates a private key that never leaves it, and a public key stored on the server. To log in, you simply authenticate with your device's biometric or PIN — no password to type, remember, or leak. Passkeys are already supported by Apple, Google and Microsoft, and they're resistant to phishing by design.
Simplify your security: A password manager like NordPass not only stores and generates strong passwords but also supports 2FA token management and is adding passkey support, keeping all your authentication methods in one secure vault.
Which should you use?
Both are excellent — and they work together. Enable 2FA on every account that offers it, preferably with an authenticator app rather than SMS. If a service supports passkeys, set that up as your primary login method. Between a strong password, 2FA, and passkeys, you're protected against the vast majority of attacks targeting everyday users.
Don't forget backup codes
When you enable 2FA, you'll usually get a set of backup codes. Save them somewhere safe — ideally in your password manager vault. If you lose your phone, those codes are your only way back into your account.