SMS vs Authenticator App vs Security Key: Which 2FA Method Is Safest?

Any second factor is better than a password alone. But the methods aren't equal, and the differences matter most against the attacks people actually face: phishing pages, SIM swaps, and attackers who already have your password and just need one more step.

This article explains how SMS codes, authenticator apps, push notifications, and security keys (including passkeys) work, what each one defends against, where each one fails, and which to choose for different situations.

SMS and Voice Codes

How it works

When you sign in, the service sends a short code to your phone number by text message or automated call. You type it in to prove you have that phone.

Strengths

• Works on any phone, no app needed.
• Easy to recover: if you lose the handset, your carrier can move the number to a new SIM.
• Familiar to almost everyone.

Weaknesses

The code is tied to your phone number, and phone numbers can be moved. In a SIM swap, an attacker convinces or bribes a carrier employee, or abuses an online account, to transfer your number to a SIM they control. From that moment, your codes go to them.

SMS can also be intercepted through weaknesses in the phone network's signaling systems, or read by malware on the phone, and codes may show up on a lock screen preview. Finally, SMS codes are easy to phish: a fake login page simply asks for the code and relays it.

For these reasons, NIST's digital identity guidelines classify SMS and voice as a "restricted" authenticator, meaning organizations should offer alternatives and understand the risks.

Authenticator Apps (TOTP)

How it works

During setup, the service gives you a secret key, usually as a QR code. Your authenticator app stores it and combines it with the current time to produce a 6-digit code that changes every 30 seconds. This is the Time-based One-Time Password (TOTP) standard, defined in RFC 6238. The server holds the same secret and calculates the same code, so nothing needs to be sent over the network to your phone. You can see the mechanism for yourself by pasting a test key into the 2FA-Auth code generator.

Strengths

• No dependency on your phone number, so SIM swaps don't help an attacker.
• Works offline, on a plane or abroad with no signal.
• Free, widely supported, and the codes can be generated on any device that has the key.

Weaknesses

TOTP is phishable in real time. If you land on a convincing fake login page, enter your password, and then enter your current 6-digit code, an attacker's tooling can forward both to the real site within seconds. The code is valid for about 30 seconds (often a little longer to allow for clock drift), and that is enough. Automated "adversary-in-the-middle" phishing kits do exactly this and can steal the resulting session cookie as well.

Other weaknesses:

• The secret key is a shared secret. If it leaks from the server or from wherever you stored it, anyone can generate your codes.
• If you lose the device and have no backup of the keys, you're locked out until recovery.
• Codes depend on correct time. A phone clock that's several minutes off produces rejected codes.

Push Notifications

How it works

Instead of typing a code, you get a prompt in an app on your phone asking "Is this you trying to sign in?" and tap Approve.

Strengths and weaknesses

Push is convenient and avoids SIM swap issues. Its well-known problem is MFA fatigue, sometimes called push bombing: an attacker with your password triggers prompt after prompt, often late at night, until you tap Approve to make it stop or by accident. Attackers have used this technique in real-world breaches.

Many providers now add number matching, where you must type a number shown on the login screen into the app, plus details like location and app name. This makes blind approval much harder. A push prompt is still phishable, though, since a relay site can trigger a genuine prompt and show you the matching number.

Security Keys, FIDO2, and Passkeys

How it works

Security keys and passkeys use the FIDO2 standards, including WebAuthn in the browser. When you register, your device creates a key pair just for that website. The private key stays on the device; the site stores only the public key. To sign in, the site sends a challenge, and your device signs it after you touch the key, enter a PIN, or use a fingerprint or face unlock.

The critical detail: the browser includes the website's origin in what gets signed, and the credential is bound to the real domain. A phishing site at a look-alike address can't get a valid signature for the real site, no matter how convincing it looks. There is no code for you to type and therefore nothing to hand over.

Hardware keys vs passkeys

• Hardware security keys are small USB, NFC, or Lightning devices. The private key can't be copied off them. You should register at least two, keeping one as a spare.
• Passkeys are FIDO credentials stored in your phone, computer, or password manager and often synced across your devices. They can replace the password entirely. Syncing makes them easy to recover, with the trade-off that their security depends on the account that syncs them.

Weaknesses

• Not every service supports them yet.
• Hardware keys cost money and can be lost, so you need a backup method.
• Recovery flows on many sites still fall back to weaker methods like SMS or email, which an attacker may target instead.

Comparison Table

Recommendations by Use Case

Your main email and password manager

These unlock everything else. Use a security key or passkey if supported, with a second key or a TOTP authenticator as backup, and store backup codes offline. Remove SMS as a fallback if the service allows it.

Banking and financial accounts

Use the strongest method the bank offers. Many banks still rely on SMS or their own app; if so, protect your phone number with a carrier port-out PIN or SIM lock.

Work and admin accounts

Phishing-resistant methods matter most here, since a compromised admin account affects other people. Follow your organization's policy; many now require security keys or passkeys for administrators.

Everyday accounts

An authenticator app is a strong, practical default. Save the setup keys or backup codes somewhere safe so a lost phone doesn't become a lockout.

If SMS is the only option

Turn it on anyway. It still stops attacks that rely only on stolen passwords, which are very common. Add the carrier protections above and switch to a stronger method when the service supports one.

Habits That Matter as Much as the Method

• Type important addresses yourself or use bookmarks instead of clicking login links in messages.
• Never read a code to someone who calls you, even if they claim to be from the service.
• Deny any push prompt you didn't start, and change your password if they keep coming.
• Register more than one method so you're never down to a single point of failure.

FAQ

Is an authenticator app really safer than SMS?

Yes, for most people. It removes SIM swap and network interception risks. Both can still be phished in real time, so stay alert to fake login pages.

Are passkeys the same as security keys?

They use the same FIDO2 technology. A hardware key keeps the credential on a dedicated device; a passkey is usually stored and synced by your phone, computer, or password manager.

Can a security key be phished?

The signing step is bound to the real website's domain, so a look-alike site can't obtain a usable response. Attackers may instead target weaker recovery options on the same account, so lock those down too.

Should I use more than one 2FA method on the same account?

Yes. A primary method plus a backup, such as a second key, an authenticator, or stored backup codes, protects you from lockouts. Just avoid leaving SMS as a fallback on high-value accounts if you can remove it.