See how authenticator codes and passkeys actually work, using your own phone, and why only one of them stops a phishing site.
Scan this demo QR code with any authenticator app (Microsoft Authenticator, Google Authenticator, 1Password…). It adds an entry called NDGM Lab: demo that you can delete afterwards.
Or type the secret:
What the server expects right now
Next code in
The catch: a code works for anyone who has it for those 30 seconds. A phishing page that relays your password and code to the real site in real time gets in. That's why passkeys exist.
Create a demo passkey with your phone, security key, Windows Hello or password manager, then sign in with it. The browser ties the passkey to this site's domain, so a look-alike phishing site can't use it. This saves a passkey called NDGM Lab demo to your device; delete it afterwards in your password manager or security settings. Nothing is sent to a server.
Any MFA is far better than none, but not all MFA is equal. One-time codes and push prompts can be relayed by a real-time phishing proxy; the attacker simply passes your code on before it expires.
Passkeys are bound to the website's domain by the browser itself. A look-alike domain gets nothing it can use, which is why phishing-resistant MFA is what I push for on every admin account first.