Two-factor authentication: SMS vs apps vs security keys
Not all 2FA is equal. Why SMS codes are weak, how authenticator apps and passkeys compare, and which to use for exchanges and email.
On this page
Two-factor authentication (2FA) means a stolen password alone is not enough to log in. But the second factor you choose decides which attacks you are protected from.
The options, from weakest to strongest
| Method | Protects against stolen passwords | Protects against SIM swaps | Protects against phishing sites |
|---|---|---|---|
| SMS code | Yes | No | No |
| Email code | Yes | Yes | No |
| Authenticator app (TOTP) | Yes | Yes | No |
| Push approval in an app | Yes | Yes | Partly (number matching helps) |
| Security key or passkey (FIDO2/WebAuthn) | Yes | Yes | Yes |
Why SMS is the weakest
An SMS code goes to whoever controls your phone number. Attackers can take over numbers through SIM swaps or port-outs by tricking or bribing mobile carrier staff. Then they receive your codes and password reset messages. See SIM-swap protection.
If an account offers anything better than SMS, switch, and then remove the phone number as a recovery option where you can.
Authenticator apps (TOTP)
Apps that show a six-digit code that changes every 30 seconds are a big step up. They are not tied to your phone number.
Their weakness is phishing: if you type the code into a fake login page, the attacker can relay it to the real site within seconds. So the code protects you from password leaks, not from lookalike sites.
Save the backup or recovery codes when you enable TOTP. If you lose your phone without them, account recovery can take a long time.
Security keys and passkeys
FIDO2 security keys (small USB or NFC devices) and passkeys use public-key cryptography tied to the website's real domain. A fake site on a different domain cannot get a valid response, even if you are completely fooled by it. That makes them the only common method that is resistant to phishing.
- Register two security keys and keep one somewhere safe as a backup.
- Use them first on your email account, then exchanges and your password manager.
Where to enable 2FA first
- Email. Whoever controls your email can reset almost everything else. See email security.
- Exchanges. See exchange security.
- Password manager.
- X, Discord and Telegram. Hijacked social accounts are used to scam your followers and friends.
Warning: Nobody legitimate will ever ask you to read out a 2FA code. A caller or chat agent asking for "the code we just sent you" is in the middle of taking over your account.