You will often see all three on one security settings page. They overlap, and it is not always obvious which you should use. This comparison is part of our two-factor login and passkeys guide.
Side by side
| Question | Password alone | Password + app code | Passkey |
|---|---|---|---|
| Can be guessed | Yes, if weak | Only the password part | No |
| Leaks in a breach | Possibly | The password part | No useful secret |
| Works on fake sites | Yes, you get robbed | Can be relayed | No |
| Reused across sites | Often | Often | Never |
| Effort at login | Typing | Typing and a code | A fingerprint |
| If you lose your device | No problem | Backup codes | Sync or recovery |
What each one is
A password is something you know. It only works if it is long, random and unique. See our password basics.
Two-factor login adds a second proof to that password, as we explain in what 2FA is. Methods differ widely in strength, as shown in 2FA methods compared.
A passkey replaces both. Your device holds the key, which is "something you have", and your fingerprint or PIN unlocks it, which is "something you are" or "know". See what passkeys are.
What about a security key?
A hardware security key can act as a second factor alongside a password, or it can hold a passkey. It offers the same protection against phishing, but the secret stays on the physical key.
What to use, account by account
- Offers passkeys? Create one, and register a second device or a backup.
- No passkeys, but offers an app or key? Use a unique password plus the strongest second factor.
- Only offers SMS? Use it, along with a unique password.
- No second factor at all? Use a very long unique password, and think about how much you trust that service.
The weak link: recovery
An account is only as strong as its easiest way in. If your passkey login is excellent but "forgot password" sends a text to your phone, an attacker can try that instead. Check recovery settings on your most important accounts. Our email security checklist walks through this.