What’s better depends on your threat model and tolerance for inconvenience.

Personally, I prefer a hardware security token PLUS a lengthy and complex passphrase (both required to unlock). That way someone can’t access my system simply by stealing my hardware token.