Most secure two factor authentication methods compared

What two-factor authentication means

Passkeys and hardware security keys are usually the most secure types of two-factor authentication. These options can’t be tricked by a fake website because you never type a code or password into a page at all. Two-factor authentication (2FA) adds a second proof of identity alongside your password, so even if someone gets your password, they still can’t sign in without the second factor.

Each proof fits one of three categories: it’s either something you know (like a password or a PIN), something you have (such as a phone or a hardware key), or something you are (like your fingerprint or a face scan). If you’ve ever used strong online payment in the EU, you’ve seen this approach, as described under strong customer authentication.

How the main 2FA methods compare

SMS codes: These are quick to turn on but are considered the least secure. Text messages can be tapped or redirected, and someone could take control of your phone number using a SIM swap attack.
Authenticator apps: These create codes that appear on your phone for just a short time. Criminals find these much harder to steal than SMS, but you could still accidentally enter a code on a fake login page.
Push approvals: Here, you just tap to approve in an app. Only do this when you started the login, attackers send repeated requests hoping you’ll accept just to clear them.
Passkeys and hardware security keys: These use cryptographic secrets linked to the real website. They simply won’t work if the website is a fake, which stops phishing attempts outright.

Setup and backup tips for stronger 2FA

It’s smart to pick the strongest method your service allows and add a backup, so you can still get in if you lose a device. Store recovery codes safely, preferably in a password manager, not in a screenshot where someone else could find them.

If you can’t access your authenticator app because you lose your phone, your saved recovery codes can get you back in. Without them, you’ll have to pass identity checks, which may take a while. Remove old numbers and devices in your account settings if you don’t use them anymore.

Even a strong form of 2FA can’t protect you if you enter your code on a bogus site, so it helps to recognize phishing bank messages as well.

Frequently asked questions

Is SMS two-factor authentication safe enough?

SMS codes are safer than relying on just a password, but this method is usually the least secure of all the common options. Texts can be intercepted and numbers are sometimes stolen with fraud. For any account where money is at risk, choose an authenticator app, a passkey, or a security key if you have that choice.

Are authenticator apps safer than SMS codes?

Yes, usually they are. Authenticator apps generate codes right on your phone, nothing travels across the mobile network, so interception isn’t a risk in transit. Just remember: if you put the code into a fake site, even a code from your own app can be stolen, so check the website address every time.