Authentication Method Selector
Select an account type, device support level, and risk tolerance to get an instant, tailored authentication method recommendation.
Free to use · no account required
Recommended Method
Passkey (platform authenticator)
For standard users on modern devices, a platform authenticator (Windows Hello, Touch ID, or similar) delivers the strongest practical protection with the lowest ongoing friction — no codes to type, no push-fatigue exposure.
Fallback: Authenticator app with number-matching for any application not yet supporting passkeys
This recommendation is a starting point based on general best practice, not a substitute for a full identity security review. See Multi-Factor Authentication: Methods and Best Practices for the full comparison behind these recommendations.
What It Recommends
Every recommendation this selector can return
Six outcomes, and the situation that produces each. The tool narrows to one of these — nothing here is withheld until you answer.
If this is your situation
Recommended method
Why
Standard user, modern devices
Passkey (platform authenticator) · phishing-resistant
For standard users on modern devices, a platform authenticator (Windows Hello, Touch ID, or similar) delivers the strongest practical protection with the lowest ongoing friction — no codes to type, no push-fatigue exposure. Fallback: Authenticator app with number-matching for any application not yet supporting passkeys.
Privileged account, or low risk tolerance
Passkey (platform authenticator) or hardware security key · phishing-resistant
This account type carries enough risk to warrant phishing-resistant authentication. Modern devices support built-in platform authenticators; a hardware key remains a strong alternative for shared or high-security scenarios.
Privileged account on legacy-only devices
Hardware security key (FIDO2/WebAuthn) · phishing-resistant
Privileged and high-risk accounts warrant phishing-resistant authentication regardless of device modernity — a physical hardware key works even on legacy devices lacking built-in platform authenticator support. Fallback: Authenticator app with number-matching, only if a hardware key genuinely cannot be provisioned.
Standard user, legacy-only devices
Authenticator app with number-matching · not phishing-resistant
Legacy devices without WebAuthn support limit passkey adoption. An authenticator app with number-matching enabled is the strongest practical option and defeats MFA fatigue attacks specifically. Fallback: SMS, only as a documented fallback for devices with no other option.
Service account (non-human)
Certificate-based authentication or managed identity · phishing-resistant
Service accounts are non-human and should never use interactive MFA methods. A certificate or platform-managed identity avoids storing a shared secret entirely.
Shared or kiosk device
Shared device sign-in with per-user authentication · not phishing-resistant
A shared device account should still require each individual user to authenticate before accessing anything sensitive — a shared login with no individual authentication defeats accountability entirely. Fallback: Authenticator app per user session, minimum.
Standard user, modern devices
Passkey (platform authenticator) · phishing-resistant
Why
For standard users on modern devices, a platform authenticator (Windows Hello, Touch ID, or similar) delivers the strongest practical protection with the lowest ongoing friction — no codes to type, no push-fatigue exposure. Fallback: Authenticator app with number-matching for any application not yet supporting passkeys.
Privileged account, or low risk tolerance
Passkey (platform authenticator) or hardware security key · phishing-resistant
Why
This account type carries enough risk to warrant phishing-resistant authentication. Modern devices support built-in platform authenticators; a hardware key remains a strong alternative for shared or high-security scenarios.
Privileged account on legacy-only devices
Hardware security key (FIDO2/WebAuthn) · phishing-resistant
Why
Privileged and high-risk accounts warrant phishing-resistant authentication regardless of device modernity — a physical hardware key works even on legacy devices lacking built-in platform authenticator support. Fallback: Authenticator app with number-matching, only if a hardware key genuinely cannot be provisioned.
Standard user, legacy-only devices
Authenticator app with number-matching · not phishing-resistant
Why
Legacy devices without WebAuthn support limit passkey adoption. An authenticator app with number-matching enabled is the strongest practical option and defeats MFA fatigue attacks specifically. Fallback: SMS, only as a documented fallback for devices with no other option.
Service account (non-human)
Certificate-based authentication or managed identity · phishing-resistant
Why
Service accounts are non-human and should never use interactive MFA methods. A certificate or platform-managed identity avoids storing a shared secret entirely.
Shared or kiosk device
Shared device sign-in with per-user authentication · not phishing-resistant
Why
A shared device account should still require each individual user to authenticate before accessing anything sensitive — a shared login with no individual authentication defeats accountability entirely. Fallback: Authenticator app per user session, minimum.
FAQ
Common Questions
How is this different from the other identity tools?
The Identity & MFA Readiness Assessment and Passwordless Readiness Assessment evaluate your organization's broader posture across many questions. This tool answers one narrower, immediate question — "which authentication method fits this specific account or scenario" — with a single recommendation.
Why does account type change the recommendation so much?
A service account, a shared kiosk device, a standard user, and an administrator all carry different risk profiles and have different practical constraints (a service account can't interact with a push notification). The right method depends on which of these you're actually authenticating.
What does "phishing-resistant" mean in the result?
A phishing-resistant method (hardware key, passkey) is cryptographically bound to the real destination and cannot be captured by a relay-based phishing attack the way a code or push approval can — see Authentication Attacks for the full explanation.
How It Works
What this tool does with your input
How this tool works, and what happens to what you enter
- You
You describe your situation
The requirements and limits that narrow the field.
- The tool
Options are matched locally
Your situation is compared against the selection criteria in the browser.
- You
You get a recommendation and its reasoning
Including the conditions under which it would be the wrong answer.
Learn More
Identity & Access Guides
Related Resources
The full topic hub — articles, diagrams, and downloads on authentication, MFA, SSO, and privileged access.
Broader identity and authentication posture assessment across six areas.
Full identity and access posture review, from MFA coverage to privileged access governance.
Operational Support
Need help rolling out the right authentication methods?
IT KORR can help select, procure, and roll out the right authentication methods across every account type in your organization — from service accounts to executive devices.
No commitment required — we respond within one business day.