Passwords, Passkeys, and MFA: How to Protect Your Accounts

Passwords are still common, but they should not be your only account protection. A unique password, multi-factor authentication (MFA), and passkeys where available give you stronger protection than any one method alone.

Start with a unique password

Create a long, random password for each account. Avoid names, dates, familiar phrases, and reused passwords. Use the Strong Password Generator when you need a password that meets a website's requirements.

Add multi-factor authentication

MFA requires an additional confirmation after your password, such as an authenticator-app code, security key, or device prompt. It can help if a password is exposed, though you should still change a password after a suspected breach.

Consider passkeys

Passkeys use your device to authenticate rather than requiring you to type a password. When a service supports passkeys, they can reduce phishing risk and remove the need to remember another password. Keep recovery options current.

Practical account-security checklist

• Use a different password for every account.
• Store passwords in a trusted password manager.
• Turn on MFA for email, financial, and work accounts.
• Prefer passkeys when a trusted service offers them.
• Review breach notifications and change exposed passwords promptly.

FAQ

Do passkeys mean I never need passwords?

Not always. Support varies by service, and some accounts still use passwords or recovery passwords. Follow each service's setup and recovery guidance.

Which MFA method is best?

Use the strongest option a service offers that you can reliably maintain. Authenticator apps and hardware security keys generally avoid some risks associated with SMS codes.