More than a password
MFA asks for more than one kind of proof. Passkeys use cryptographic keys tied to a service.
In 30 seconds
- Two passwords are still the same kind of factor.
- Passkeys can resist phishing by binding authentication to the correct service.
- Device loss and account recovery still deserve a plan.
Make it concrete
List something you know, something you have and something you are. Keep these categories distinct from the number of login screens.
- 01Identity claim
- 02Proof
- 03Access
Check your understanding
Do two password prompts automatically count as two different authentication factors?
- Two passwords are still the same kind of factor.
- Passkeys can resist phishing by binding authentication to the correct service.
- Device loss and account recovery still deserve a plan.
Go to the source
Sources reviewed: 13.09.2026