MELKEM.

Passkeys vs authenticator codes

Last checked

Short answer

The short answer

A passkey is the stronger way to sign in where a service offers one, because it can’t be typed into a fake website or read out to a scammer. Authenticator codes still matter wherever passkeys aren’t available, and an account can have both.

New to the terms? Start with what two-factor authentication is. More guides: why a code in an app beats a code by text message, and what to do if you lose your phone.

What each is

What each one is

The FIDO Alliance says a passkey “is an authentication credential based on FIDO standards, that can be stored on your phone or computer”, and that you sign in “with the same process that they use to unlock their device”. Apple adds: “Passkeys sync across a user’s devices using iCloud Keychain.”

An authenticator code is a short number your app works out and shows for a short time. You type it in after your password.

Passkeys win

Where passkeys are better

  • They resist fake websites. Apple says: “This makes passkeys very strong, easy to use credentials that are highly phishing-resistant.” The FIDO Alliance says: “Unlike passwords, passkeys are always strong and phishing-resistant”.
  • There is nothing to read out. Google says: “Unlike passwords, passkeys can’t be shared, copied, written down, or accidentally given to someone else.” A code can be, which is the trick described in our guide on never sharing your 6-digit code.
  • They save a step. Google says: “When you sign in with a passkey, it bypasses your second authentication step, since it verifies that you have possession of your device.”

Codes still matter

Where codes are still needed

  • Each service decides whether to offer passkeys. Where it doesn’t, a code is what you have, so check its own help page. Our guide on which apps and websites work with an authenticator app links to many.
  • Codes have a weakness: you type them. A scammer can ask for one, as our guide on never sharing your 6-digit code shows. Texted codes are the weaker kind: “verification codes sent by texts or calls can be vulnerable to phone number-based hacks”, says Google.
  • A passkey is as safe as the device that holds it. Google warns: “Even if you sign out of your Google Account, once you create a passkey, anyone who can unlock your device can access your Google Account.”
  • Recovery differs. Apple says: “Passkeys can be recovered through iCloud keychain escrow, which is also protected against brute-force attacks, even by Apple.” An authenticator app depends on how that app backs up: see what to do if you lose your phone.

Both

Using both

You don’t have to choose. Google says adding a passkey “doesn’t change or remove any authentication or recovery factors” already on your account, and “you still have the option to use your password to sign in to your account.”

So a sensible order is to add a passkey where you can, and keep your authenticator app and backup codes in place as the fallback until you are sure you can get back in.

Sources

Sources

FIDO Alliance: FIDO Passkeys: Passwordless Authentication. Apple Support (dated 16 September 2024): About the security of passkeys.

Google Account Help: Sign in with a passkey instead of a password and Turn on 2-Step Verification.

Ask MELKEM