Accounts
Does it support passkeys?
Search thousands of sites for the second factors they offer, from passkeys down to SMS. Then pick the strongest one each site allows.
Search sites
Loading the directory…
Data from 2FA Directory and itspasskeys list, maintained by volunteers. Missing or wrong?Contribute there.
Which second factor to choose
Strongest first. Use the best one a site offers, and keep a backup method or recovery codes somewhere safe.
| Method | Stops phishing | Why |
|---|---|---|
| Passkey | Yes | Replaces the password. Bound to the real site, so a fake one gets nothing. |
| Security key | Yes | A physical key (FIDO2/U2F). Same protection as a passkey, kept on a device you carry. |
| Authenticator app | No | Six-digit codes (TOTP). Can’t be SIM-swapped, but a convincing fake site can ask for the code. |
| App push prompt | No | Tap to approve. Attackers spam prompts until someone taps yes; number matching helps. |
| SMS or call | No | Better than nothing. Vulnerable to SIM swaps and phone-number takeovers. |
| Email code | No | Only as safe as your email account. |
Authenticator apps
All of these make the same six-digit codes. They differ in who can read your backups and whether you can move your codes to another app.
| App | Platforms | Open source | Backup | Export | Note |
|---|---|---|---|---|---|
| Ente Auth | iOS, Android, Windows, macOS, Linux, Web | Yes | End-to-end encrypted sync | Yes | Works across phones and computers; sync is optional. |
| 2FAS Auth | iOS, Android | Yes | Optional iCloud or Google Drive sync, encrypted export | Yes | Browser extension can fill codes from the phone. |
| Aegis Authenticator | Android | Yes | Encrypted vault, automatic local backups | Yes | No cloud of its own; you choose where backups go. |
| Bitwarden Authenticator | iOS, Android | Yes | Optional sync with a Bitwarden vault | Yes | Free; doesn't need a Bitwarden account. |
| Google Authenticator | iOS, Android | No | Optional sync to your Google account | Yes | Transfers to another phone by QR code. |
| Microsoft Authenticator | iOS, Android | No | Cloud backup to a Microsoft account | No | Best for Microsoft accounts, which also use its push sign-in. |
| Twilio Authy | iOS, Android | No | Encrypted cloud backup tied to your phone number | No | Desktop apps were discontinued in 2024; codes can't be exported, which makes leaving hard. |
Where to keep passkeys
Your phone or computer can store passkeys already (iCloud Keychain, Google Password Manager, Windows Hello). These keep them portable across platforms.
Password managers
- Bitwardenopen source
Free tier stores passkeys; premium adds built-in authenticator codes.
- Proton Passopen source
Stores passkeys and authenticator codes, with email aliases.
- KeePassXCopen source
Desktop, offline, no account. Stores passkeys and authenticator codes in a local file you control.
- 1Password
Paid. Stores passkeys and authenticator codes and fills them in.
Security keys
- YubiKey 5 series
USB-A, USB-C, Lightning and NFC models. Stores passkeys and works as a second factor almost everywhere.
- Google Titan Security Key
USB-C with NFC. Stores passkeys; a simple choice for Google accounts and beyond.
- Nitrokey 3
Open-source hardware and firmware. Passkeys, second factor and more.
Buy two and register both, so losing one doesn’t lock you out.