Clear Path step · Home · Logins that are hard to steal
Add passkeys to the accounts that hold the rest
Why it matters: These accounts can reset, pay for or unlock everything else. Once they need something a scammer can't type into a fake page, a stolen password stops being enough.
Best after: Put one password manager in charge
Do it
- Work down this list: bank and brokerage, mobile carrier, Apple, Google or Microsoft account, password manager, then social media.
- On each, add a passkey where offered; otherwise an authenticator app; text codes only as a last resort.
- Remove text-message codes as a fallback once a passkey or app is working, where the site allows it.
- Record in your password manager which method each account uses.
Check it worked: Your bank, mobile carrier, Apple, Google or Microsoft account and password manager all require a passkey or MFA, not just a password.
Simply put
These accounts are the key ring that opens everything else: bank, phone number, cloud account. A passkey is tied to the real website, so even a perfect fake page can't get it out of you.
In detail
Passkeys are built on the FIDO Alliance and W3C WebAuthn standards and are tied to the real website, so a lookalike page can't use them. NIST's digital identity guidelines (SP 800-63B-4) accept synced passkeys at the middle assurance level, AAL2.
If this is new to you: No need to do the whole list at once. Work down it one account at a time, and record in your password manager which method each one uses.
Points toward the Long View: accounts that need something a scammer can't type, everywhere it counts.