Passkeys, 2FA and Password Managers: A Practical Account Security Setup

Almost all advice about account security fails for the same reason: it asks you to do the same thing for two hundred accounts. Nobody sustains that, so people do nothing, and then reuse one password everywhere.

A better approach accepts that accounts are not equally important and spends effort accordingly. Here is a setup that takes an evening and addresses the failure modes that actually cause account takeovers.

The one thing that matters most

Password reuse is the mechanism behind most compromised accounts. Breaches happen constantly, and attackers take the email-and-password pairs from one breach and try them everywhere else — a technique called credential stuffing. It works because most people reuse passwords.

So the goal is not primarily "strong" passwords. It is unique passwords, which in practice requires a password manager, because unique passwords for two hundred accounts cannot be remembered.

Choosing a password manager

The things worth checking:

• Zero-knowledge architecture. The provider should be unable to read your vault — encryption and decryption happen on your device with a key derived from your master password. Every reputable manager works this way and says so plainly.
• Independent security audits, published, and reasonably recent.
• Breach history and how it was handled. A provider being breached is not automatically disqualifying — what matters is whether vault contents were protected and whether disclosure was prompt and complete.
• Platform coverage for everything you use, including browser extensions and mobile autofill.
• Export. Confirm you can export your vault in a standard format. A manager you cannot leave is a manager that owns you.
• Emergency access or inheritance — a way for someone you trust to reach your vault if something happens to you.

Browser-built-in managers are genuinely better than reuse and are free. Dedicated managers add cross-browser support, better sharing, breach monitoring and more control. Either beats a notebook or a reused password.

Your master password is the one you must remember

Everything rests on it, so it deserves different treatment: long, unique, never used anywhere else, and memorable enough that you will not lock yourself out. A passphrase of four or five unrelated words is both stronger and easier to remember than a short string of substituted characters — length contributes far more to resistance than symbol soup.

Write it down once, on paper, and store it somewhere physically secure. That is not a security failure; losing access to your vault entirely is a far more likely disaster than a burglar finding a note in a safe.

Then save the recovery kit or emergency sheet your manager offers, in the same place.

Two-factor authentication, ranked

Not all second factors are equivalent, and the differences are large.

Hardware security keys (FIDO2/WebAuthn) are the strongest. They are phishing-resistant by design: the key verifies the site's actual domain, so a convincing fake login page cannot obtain anything reusable. Worth buying two — one to use, one stored as a backup.

Passkeys are the same underlying cryptography built into your devices and password manager, with no separate hardware. They replace the password entirely rather than adding a step, and they are also phishing-resistant. Where a service offers passkeys, they are usually both more secure and less annoying than what they replace — which is a rare combination.

Authenticator apps generating six-digit codes are good, widely supported, and the practical default for most accounts. They are vulnerable to real-time phishing — a fake site can ask for the code and use it immediately — but they defeat credential stuffing entirely.

Email-based codes are weak, because they collapse to the security of your email account.

SMS codes are the weakest form in common use, and worth understanding why: SIM-swap attacks let someone persuade or bribe a carrier to move your number to their device, after which every SMS code goes to them. It is a documented, repeatedly-used technique, especially against people holding cryptocurrency.

SMS is still better than nothing. But where a service supports an app or a key, switch — and ask your mobile carrier to add a port-out PIN or account lock, which is free and takes one call.

Tier your accounts

This is what makes the whole thing sustainable.

Tier one — your email. Secure this first and most heavily. Email is the master key: password resets for everything else arrive there. A compromised email account means a compromised everything. Use a hardware key or passkey if available, a unique long password, and remove SMS as a recovery method if you can replace it with something stronger.

Tier two — money and identity. Banks, brokerages, payment apps, tax accounts, mobile carrier, cloud storage, password manager itself. Strongest available 2FA on each.

Tier three — accounts holding personal data or a payment method. Shopping, social, subscriptions. Unique passwords from the manager, plus app-based 2FA where offered.

Tier four — everything else. Forums, one-off signups, newsletters. Unique passwords from the manager and nothing more. This is most of your accounts and it should cost you no ongoing effort.

Recovery codes: the step people skip and regret

When you enable 2FA, most services offer a set of one-time backup codes. Save them. Losing your phone with an authenticator app on it and no backup codes is how people permanently lose accounts, and support cannot always help.

Store them in your password manager if your manager is protected by a hardware key or passkey, or on paper with your master password. Note that some authenticator apps offer encrypted cloud backup, which solves the lost-phone problem — worth enabling.

An evening's work, in order

1. Install a password manager and set a strong master passphrase. Save the recovery kit on paper.
2. Change your email password to a generated one and turn on the strongest 2FA it supports. Save the backup codes.
3. Work through tier two — banks, brokerage, carrier, cloud. Unique passwords, best available 2FA, backup codes saved.
4. Run the manager's breach or password-health report. It will flag reused and exposed passwords. Fix the tier-one and tier-two items it lists, then work down at your own pace.
5. Adopt passkeys wherever offered as you encounter them, rather than as a project.

Then stop. The remaining accounts get unique passwords automatically as you log into them over the following months, which requires no discipline at all — which is precisely why this approach survives contact with real life.

If you are choosing a tool, our ranked comparison of password managers covers how they differ on architecture, audits, platform support and sharing, scored against the criteria in our rating methodology.

This is general information, not security consulting for a specific threat model. Product features, audit status and pricing change over time — confirm current details with the provider, and if you face targeted threats, seek advice suited to your situation.