Protecting our online accounts is no longer just for IT experts: it's an everyday necessity. Between digital banking, secure emailSocial media, cloud computing, business management software, and messaging services—we are surrounded by services that store extremely sensitive personal, financial and professional dataWhen a single account falls into the wrong hands, the problem rarely stops there: many are linked together, which facilitates identity theft, financial fraud, and serious damage to our reputation.
In this context, the classic password has fallen short. Technologies such as passkeys, multi-factor authentication, physical tokens, and FIDO2 standards have emerged to offer a robust authentication and advanced management of credentials and access keysIn this guide we will calmly but clearly explain what all this means, how it works internally, what current standards and laws require, and, above all, how to apply it in practice both personally and in an organization.
Why a password is no longer enough
Digital accounts have become the epicenter of our online lives. They store everything we need. banking information, email histories, private conversations (e.g. Configure WhatsApp to be more secure), photographs, corporate documents, and health data. If someone gains access to even one of these accounts, they can not only snoop, but also impersonate us, make purchases, transfers, take out loans, or even blackmail us with sensitive information.
Furthermore, many platforms are interconnected: unauthorized access to email can allow the resetting of passwords for social media, banking, or cloud services. This kind of "domino effect" means that The protection of identities and credentials is a critical component of global security from any person or organization.
There's another factor that's often overlooked: reputation. When someone takes control of an account, they can publishing content on our behalf, sending fraudulent emails to customers or family members, distributing private material and, ultimately, destroy the trust that others have in us or in our brand.
Therefore, the simple recommendation of “don’t share your password” is no longer enough. It is essential to combine high-entropy passwords, password managers, multi-factor authentication, and passwordless technologies such as access keys, along with clear management and recovery policies.
The new standard for secure passwords
For years we've been bombarded with rules like "use uppercase letters, lowercase letters, numbers, and symbols" or "change your password every 90 days." Today, organizations like NIST (in its document SP 800-63B) and INCIBE have made it clear that Length and unpredictability are far more important than arbitrary complexity..
From a technical standpoint, the strength of a password is measured by its entropy, that is, its ability to resist brute-force and dictionary attacks. INCIBE points out that, in many cases, a phrase of about 4 or more random words It can be more secure and easier to remember than a short password full of symbols like “P@ssw0rd!”.
NIST strongly advises against policies that require users to change passwords periodically without any evidence of a security breach. This has been shown to lead users to engage in dangerous practices, such as generating malicious passwords. predictable variations of the same pattern (Password1, Password2…) or writing down passwords on unsecured websites. INCIBE agrees and recommends changing passwords only when there is reasonable suspicion of a data breach, for example, after learning of a data breach or checking on services like Have I Been Pwned that a password has been exposed.
Another key point: it's useless to have a very strong password if the service storing it isn't equally strong. Current standards indicate that systems must store passwords using strong passwords. Robust bypass functions such as Argon2 or PBKDF2, with a single salt per user, as INCIBE and ENISA point out, instead of storing them in plain text or with obsolete algorithms.
How they steal our credentials
Understanding how cybercriminals attack credentials helps us grasp why we need better authentication mechanisms. Currently, the most common scenarios include brute-force attacks, dictionary attacks, and massive phishing campaigns.
In a brute-force attack, the attacker systematically tries all possible combinations of characters until they find a match. With modern hardware (GPUs, cloud clusters), an 8-character password, even with symbols, may become vulnerable within reasonable timeframesespecially if the password database has been leaked.
The dictionary attack is a more "clever" variant: the attacker uses giant lists of common words, typical phrases, and already filtered passwordsMany people continue to use very predictable combinations, such as “123456”, “qwerty” or “Barcelona2024”, which makes the attacker's job much easier.
There are also dictionary attacks with character variations, where substitutions like “a” for “@” or “e” for “3” are tested (e.g., “p@ssw0rd”). Again, if the password follows a typical pattern, Modern algorithms will almost certainly include it on the test lists.
All of this is combined with phishing, where users are tricked into typing their credentials into fake websites that mimic legitimate servicesEven with strong, unique passwords, if the user types them on a malicious website, the account is compromised. This is where technologies like FIDO2 access keys and phishing-resistant multi-factor authentication They make a huge difference.
Password managers: The brain of your digital security
The reality is simple: no normal human being can remember dozens or hundreds of long, unique, and random passwords. That's why organizations like INCIBE recommend using Password managers that locally encrypt the database with AES-256 or higher, protected with a strong master password or device biometrics.
A good password manager generates and stores unique keys for each service, preventing reuse, a practice that According to reports from the CCN-CERT, it would be present in approximately 65% of the leaks analyzed.Among the well-known password managers are LastPass, 1Password, Dashlane, Bitwarden, or corporate solutions such as Netwrix Password Secure, which also helps to enforce password policies in business environments.
In these encrypted storage facilities, not only passwords can be managed, but also, increasingly, access keys (passkeys) and other modern credentialsIn fact, several vendors are incorporating full support for FIDO2 and access keys, offering secure synchronization between devices, auditing of weak passwords, and automatic checking against leaked key lists.
For organizations, it is important that these tools integrate with directory and provisioning services (for example, using protocols such as SCIM), so that the password policies, conditional expirations, and access auditing can be managed centrally. Solutions like Netwrix Password Secure or similar allow for account lockouts, real-time alerts, compliance reports, and detection of weak or reused credentials.
Multi-Factor Authentication (MFA): The indispensable extra layer
Multi-factor authentication adds an extra layer by requiring two or more items from these categories: Something you know (password or PIN), something you have (mobile phone, physical token), and something you are (biometric data)The logic is clear: even if the password is stolen, without the second factor the door remains locked.
There are different types of MFA: codes sent via SMS, TOTP applications (such as Google Authenticator or Authy), push notifications, physical security keys FIDO2/U2F (e.g. YubiKey, Google Titan) or biometric authentication integrated into devices. The CCN-CERT and ENISA consider SMS-based methods to be the weakest, as they are vulnerable to SIM swapping attacks, while FIDO2/U2F tokens offer very high resistance to phishing.
The reason is that these security keys do not send a password to the server, but instead use domain-bound public-key cryptographyIf the user attempts to authenticate on a fake site, the key detects that the domain doesn't match and the operation fails. There is no static secret that can be stolen and reused.
In corporate environments and services that handle sensitive data (healthcare, education, public administration, banking, e-commerce), MFA ceases to be optional and becomes mandatory. essential regulatory compliance requirement and good practiceThis is directly connected to the obligations of the GDPR, NIS2, PCI DSS, HIPAA, FERPA or the National Security Scheme, which require strong access controls.
Access keys (Passkeys): The beginning of the passwordless era
Access keys, or passkeys, are the next logical step: they allow Log in without a password to websites and apps, using asymmetric cryptography and local authentication on the device (fingerprint, face, PIN). They are based on open standards from the FIDO Alliance, so they are interoperable between compatible platforms.
When you create an access key for a service, your device generates a key pair: a private key that is securely stored on the device or key manager, and a public key that is registered on the serverTo log in, the server launches a cryptographic challenge that can only be solved with the private key, but without the key ever leaving the device.
The user doesn't type anything: they simply confirm access with a fingerprint, facial recognition, or local PIN. This has several huge advantages: There's no password to memorize, it can't be reused on other sites, it can't be guessed by brute force or stolen by phishing, since the key is associated with the specific domain of the service.
Access keys are compatible with Apple, Google, and Microsoft devices, and integrate with password managers and services like iCloud Keychain and Google Password Manager. Many popular services already support them. Google (including YouTube), Microsoft and Xbox, Meta (Facebook and WhatsApp), LinkedIn, Amazon, PayPal, TikTok, Yahoo, Discord, GitHub, Adobe Creative Cloud and others. Others, such as some large AI services, Spotify, or certain online stores, have not yet made the leap.
Compared to passwords, access keys offer superior protection against account theft. Since there is no secret key that the user types, There is no way to steal it through traditional phishing, keyloggers, or leaked databases.Each key is unique to a specific site and cannot be reused for other services.
From a convenience standpoint, logging in with a passkey is much faster: all you have to do is touch the fingerprint reader, look at the camera, or enter a short PIN on the deviceThere's no need to remember long sequences or copy and paste passwords from a manager.
However, it's not all advantages. One of the main disadvantages is that Anyone who can unlock your device will have access to your access keys and, therefore, to your accounts.This is especially problematic on shared computers at home or in poorly controlled environments.
Another problem arises when keys are stored on only one device without backup or synchronization. If that device is lost, broken, or stolen, You could lose access to your accounts and enter into long and complicated recovery processes.If that account was also your primary email (where recovery links from other services arrive), things get much more complicated.
Added to this are the compatibility challenges: users with multiple devices and different operating systems (Windows, macOS, Android, iOS, Linux) may experience frictions when synchronizing or using access keys in all environmentsAnd on older computers or outdated browsers, the experience may be completely unusable.
Passkey Compatibility: Ecosystems and Browsers
Access keys now work on most modern operating systems and browsers, although with some variations. On the operating system side, general compatibility is as follows, provided updated browsers are used:
On windowsPasskeys are natively supported from Windows 11 22H2 onwards, and with certain limitations in Windows 10 if using a browser like Chrome with Google's Password Manager.
On macOS and iOS/iPadOSCompatibility comes from macOS Ventura and iOS/iPadOS 16. The keys are stored in the iCloud Keychain and synced between Apple devices, allowing you to conveniently log in to websites and apps.
On AndroidAccess keys can be used from version 9 onwards, but advanced integration with third-party password managers and external passkey providers is only available from Android 14 onwards. Google's password manager automatically syncs the keys associated with your Google account.
On LinuxMost distributions do not yet have native system-level passkey support, but it is possible to use them through browsers like Chrome, Edge, or Firefox combined with a compatible password manager or a FIDO2 USB tokenIt's a somewhat more "artisanal" environment, but viable.
In browsers, essential access key functions are available from Chrome/Edge/Opera based on Chromium 108, with significant improvements from version 128 onwards; Firefox offers support from version 122, although not all sites work equally well; Safari supports them from version 16, with additional features from Safari 18 onwards.
In practice, if you have a modern mobile phone or computer, switching to access keys is usually simple. In most services, you just need to go to the section for In Security or Account, look for the option like “Access keys” or “Login without a password” and click on “Create access key”From there, the browser or app will guide you to use your fingerprint reader, facial recognition, or PIN.
The keys are stored locally: on iOS and macOS, in Apple's Keychain; on Android, in Google's Password Manager or manufacturer solutions (such as Samsung Pass); on Windows, via Windows Hello or third-party managers. In the future, when you want to log in, simply choose "Sign in with access key" and complete your device's usual verification.
Modern browsers offer an extra feature: if you have a saved password for a site that already supports passkeys, they can offer you one after you log in. Automatically convert that password into an access key and save it for future passwordless logins.This greatly accelerates the transition.
In the specific case of Google, you can use Google's Password Manager to create and store passwords directly associated with your Google account, allowing you to use them on any device where Sign in to Chrome or Android with that same accountThe protection is reinforced with a PIN specific to the manager, which you will have to enter when using the key.
Synchronization and credential management
When multiple devices are involved, the challenge lies in how to sync or transfer the keys. If your entire ecosystem is homogeneous (for example, only Apple devices, or only Android and ChromeOS), it's easy: Enable syncing in iCloud Keychain or Google Password Manager and let the system do the rest.
On iPhone and Mac, you can check for syncing by going to Settings → iCloud → Saved in iCloud → Passwords & Keychain, and enabling the corresponding option. On Android, the keys and passwords associated with the Google key manager are automatically synced with your account.
Windows and Linux currently do not offer such integrated native tools for synchronizing access keys between devices, although Microsoft has announced that it is working on it. In these environments, and especially when combining systems (Windows + Android, macOS + Android, etc.), Third-party password managers with Passkeys support have become the most universal option.
These solutions allow you to save and synchronize your keys in the provider's encrypted cloud. If you lose your only device, you can Restore all your keys to a new one after authenticating with the master password and, if applicable, a second factorHowever, you will need to install the manager and its browser extension on all your computers for a smooth experience.
Another option is to store access keys on dedicated hardware, such as FIDO2-compatible USB security keys (YubiKey, Titan, etc.). This is a very robust approach for corporate settings, high-risk access, or use on public computersHowever, it has the drawback that if you lose or reset the physical key, the passkeys stored on it cannot be recovered.
Just like passwords, access keys need to be managed: review which keys you've created, for which services, from which devices, and revoke those that are no longer needed. Each platform offers its own centralized menus.
On iOS (up to version 17) you can manage credentials from Settings → PasswordsWhile iOS 18 and macOS Sequoia already have a dedicated "Passwords" app, in earlier macOS versions, the options are found under "Passwords" within System Settings.
On Android, the path varies depending on the device brand, but it is usually found in the menus of Passwords, access keys and accounts, Password Manager or in dedicated applications such as Samsung PassIn Windows 11, the section is located in Settings → Accounts → Access keys.
If you use Google Password Manager, you can access it from Chrome (Menu → Passwords & Autofill → Google Password Manager) or via the web. There you will be able to View, edit, delete keys, change your manager PIN, or disable automatic passkey creation when logging in with saved passwords.
When using third-party password managers, administration is done entirely through their applications and web dashboards: adding and deleting keys, exporting/backing up, browser integration, and, in enterprise environments, detailed reports on usage, length and complexity policies, detection of compromised passwords, and regulatory compliance.
Regulations and compliance: Safety as a legal obligation
Strong authentication is not just a technical issue; it is also supported (and in many cases required) by regulations. The General Data Protection Regulation (GDPR), in its Article 32, mandates the application of “appropriate technical and organizational measures” to protect personal dataThis is what the Spanish Data Protection Agency (AEPD) usually interprets as the need for strong passwords and MFA, especially when dealing with sensitive data.
The NIS2 Directive, transposed into Spanish law by Royal Decree-Law 15/2023, imposes on essential entities and large companies the obligation to Implement multi-factor authentication for remote access to critical networks and systemsIn the public sector, the National Security Scheme (RD 311/2022) establishes very specific controls on identity management, prohibits default passwords and sets minimum complexity requirements.
In other areas, standards such as PCI DSS (for payment card data), HIPAA (healthcare in the US) or FERPA (education) They also include password security requirements, access control, and auditing. Failure to comply can result in financial penalties, loss of certifications, and reputational damage that is difficult to recover from.
In addition, there are voluntary frameworks such as the NIST Cybersecurity Framework or ISO 27001 that provide best practices for setting up and governing an information security management system, in which password policies, MFA and access key management take center stage.
Taking all of the above into practical terms, we could condense the main recommendations into a set of good practices applicable at both a personal and corporate level.
First, for passwords, prioritize length (minimum 12 characters or long passphrases), total uniqueness across services, and random generation using a password managerAvoid obvious patterns and do not reuse keys, even with slight variations.
Secondly, it enables Multi-factor authentication whenever the service allows itgiving preference, where possible, to phishing-resistant methods such as FIDO2 security keys, passkeys and TOTP applications over SMS.
Third, gradually migrate to access keys in services that offer them, but don't forget a plan B: keep alternative login or recovery methods (secure password, backup email or phone, password managers with encrypted cloud backups) to avoid losing access if the main device fails.
Finally, in organizations it is crucial to establish clear policies and train users: Explain the risks of password reuse, how to detect phishing emails, and what to do if you suspect a security breach. and how to properly use credential managers and access keys. Having monitoring tools like Netwrix Password Secure or similar ones helps to reinforce these policies with real technical controls.
The right combination of strong passwords, trust managers, multi-factor authentication, and well-managed access keys dramatically increases the level of protection, reducing the attack surface against breaches, identity theft, and massive credential theft, while aligning security with current regulatory requirements.
