Short answer: both are phishing-resistant and use the same cryptography — the difference is that a YubiKey never syncs and a passkey usually does. That single distinction decides which you want. Here’s the honest breakdown, and why the answer is probably “both.”
Short answer: WhatsApp doesn’t use authenticator apps — it uses a six-digit PIN you choose yourself, asked for when your number is registered on a new device. Turn it on in Settings → Account → Two-step verification. It’s the one setting that stops the “please forward me that code” takeover scam.
Short answer: storing TOTP codes in Bitwarden or 1Password is convenient, solves the backup problem, and beats having no 2FA at all. But it puts both factors in one vault — so here’s exactly which accounts to keep separate, and which are fine to consolidate.
Short answer: go to Accounts Centre → Password and security → Two-factor authentication and pick Authentication app. Important catch — enabling 2FA on a linked Facebook account does not protect Instagram. You have to switch it on separately, and most people don’t realise.
Short answer: push 2FA is convenient and roughly as strong as TOTP — but only with number matching. Without it, attackers can spam you with approval requests until you tap Approve to make the buzzing stop. Here’s how prompt bombing works and how to shut it down.
Short answer: go to Settings → Accounts Centre → Password and security → Two-factor authentication, and choose Authentication app. Facebook has moved this menu several times, so here’s the current 2026 path — plus the recovery codes step that saves accounts.
Short answer: a hardware security key is a physical device that proves your identity with cryptography instead of a typed code. It’s the only 2FA method that cannot be phished — because there’s nothing for you to accidentally hand over. Here’s how it works and why you should buy two.
Short answer: a TOTP code is a six-digit number your authenticator app calculates from two things — a secret key stored on your device and the current time. Both your phone and the server run the same maths independently, which is why the codes match without anything being sent over the internet.
Short answer: open Google Authenticator on your old phone, tap the menu, choose Transfer accounts → Export accounts, select which ones to move, and scan the resulting QR code with the app on your new phone. Do this before you wipe or sell the old device.
Backup codes are the single-use keys that get you back into an account when your authenticator is gone. Here is what they are, why screenshotting them is a mistake, and the four storage methods ranked from best to worst.