Skip to main content

Password Security & Passkeys

A 2026 guide to authentication — passkeys, password managers, hardware keys, and the MFA hierarchy. Practical defense against account takeover.

The 2026 reality

Over 24 billion username/password pairs are circulating in breach databases. Info-stealer malware harvests millions more from individual computers every month — including your saved browser passwords, session cookies, and 2FA seeds. The single password you reuse across "low value" sites is one breach away from being the password to your bank. The good news: passkeys are real, they work, and they kill credential phishing entirely.

Why passwords fail

Passwords have three structural problems no amount of complexity rules can fix:

  • Reuse: Most people reuse passwords across sites. One breach contaminates many accounts ("credential stuffing").
  • Phishability: A password can be typed into a fake login page. The site doesn't verify the site — that's on you.
  • Bulk theft: Server-side breaches steal millions at once. Even hashed passwords get cracked given time and modern GPUs.

Adding "MFA via SMS" patches some of this but still hands the attacker an active session if you fall for a real-time phishing kit. The real fix is to remove the typeable secret from the equation entirely.

The MFA hierarchy (worst to best)

Tier 4 — SMS / phone-call codes

Better than nothing. Vulnerable to SIM swap, telecom interception, and real-time phishing. Use only when no other option exists, and set a port-out PIN with your carrier.

Tier 3 — Authenticator app codes (TOTP)

Six-digit codes from Google Authenticator, Authy, 1Password, Microsoft Authenticator. Immune to SIM swap. Still phishable in real time — a fake login page can relay your code to the real site within its 30-second window.

Tier 2 — Push notifications with number matching

Microsoft Authenticator and Duo with "match the number on screen" prompts. Defeats blind push-bombing attacks. Still defeatable by sophisticated AiTM if the user approves.

Tier 1 — Passkeys / hardware security keys (FIDO2)

The gold standard. Cryptographically bound to the real domain — a phishing site cannot complete the challenge. Includes:

  • Hardware keys like YubiKey, Google Titan — physical USB / NFC devices.
  • Platform passkeys stored in iCloud Keychain, Google Password Manager, Windows Hello, or your password manager.

Use this tier wherever it's offered. It's 2026 — every meaningful service supports it.

Passkeys explained

A passkey is a public-key credential bound to a specific website. When you sign in, your device proves it has the matching private key without ever transmitting a secret. Three things make passkeys fundamentally better than passwords:

  • Phishing-resistant. The browser will not present a passkey to a site whose domain doesn't match. A lookalike domain breaks the challenge.
  • Nothing to steal in bulk. Servers store only public keys. A breach of the server gets the attacker nothing usable.
  • Nothing to type. No password to reuse, no code to enter into a fake page.

Passkeys sync across your devices through your operating system or password manager (Apple, Google, Microsoft, 1Password, Bitwarden, Dashlane). If you lose your phone, you can sign in from your laptop or recover via your account.

Password managers — pick one and use it

Until passkeys cover every site (we're not there yet), you still need passwords for the long tail. A password manager is non-negotiable. The reasonable options:

  • 1Password — polished UX, family/business plans, strong passkey support. Paid.
  • Bitwarden — open source, free tier is fully featured for individuals, paid plans add advanced 2FA. Excellent value.
  • Apple Passwords / iCloud Keychain — built into Apple devices, free, syncs everywhere Apple. Now a viable standalone option.
  • Google Password Manager — built into Chrome and Android. Fine for personal use.
  • Dashlane — strong UX, good for families.

Avoid: writing passwords in browsers signed into a personal Google account on a work device, sharing passwords by Slack/email, or storing them in a "Notes" app without device-level encryption.

If you must create a password (no passkey available)

  • Length over complexity. A 4–5 word passphrase like tractor-canoe-orange-mailbox beats P@ssw0rd1! by orders of magnitude.
  • Unique per site. Always. Your password manager generates these for you — you never need to memorize them.
  • 16+ characters as a minimum where the site allows.
  • Don't rotate on a schedule unless required. NIST has long advised against forced rotation — it leads to weaker patterns. Rotate when there's a reason (breach disclosure, suspicion).

The account-hardening checklist

High-priority accounts (do these first)

Your email, your password manager, your bank, your phone carrier, your work identity provider (Microsoft 365 / Google Workspace), and your domain registrar. These are the keys to the kingdom — compromise one and the others usually fall.

  • Set a unique 16+ character passphrase.
  • Enroll a hardware key or passkey as the primary MFA.
  • Add a backup hardware key and store it offsite.
  • Remove SMS as an MFA option once you have a stronger method.
  • Save recovery codes in your password manager — not in email or a sticky note.
  • Review active sessions and trusted devices; revoke anything unfamiliar.

For everything else

  • Migrate to passkeys when offered.
  • Otherwise: unique generated password from your manager + authenticator-app MFA (not SMS).
  • Use a "throwaway" email alias (Apple Hide My Email, SimpleLogin, Firefox Relay) for sites that don't need your real address.

After a breach

  1. Check your exposure at haveibeenpwned.com. Sign up for free notifications going forward.
  2. Rotate the breached password on the affected site.
  3. Rotate anywhere you reused that password. If you don't know — that's a sign you need a password manager.
  4. Sign out of all sessions on the breached account, not just change the password. Session cookies survive password resets.
  5. Add or upgrade MFA on the affected account if it didn't have it.
  6. If financial data was exposed: freeze your credit, watch statements for two billing cycles, and consider an identity-monitoring service.

Tools and resources

Last updated April 28, 2026.

Build the right defense

Explore CyberAware Initiative's other free guides on phishing, BEC, and small business security.

All Resources