SMS
Better than nothing if the service offers nothing else. For email and banking, it's worth choosing something more secure.
Eberprot P / comparisons
Comparisons
The first comparison in this section covers ways to confirm a sign-in to your account. In short: any second factor is better than a password alone; hardware keys and passkeys offer the best protection against phishing, and SMS is the most vulnerable option.
This comparison is based on open standards (RFC 6238, FIDO2/WebAuthn) and the NIST SP 800-63B guidelines. Services support different methods — check your own account settings.
Criteria
- Phishing resistance: can the code be tricked out of you on a fake site?
- Dependence on your mobile carrier and SIM card
- Works without internet on the device
- How hard recovery is if you lose the device
- Convenience for everyday sign-ins
- How widely services support it
Comparison table
| Criterion | Password only | SMS code | App (TOTP) | Hardware key / passkey |
|---|---|---|---|---|
| Phishing resistanceObjective criterion | No | No: the code can be entered on a fake site | No: the code can be entered on a fake site | Yes: the signature is bound to the real site's address |
| Depends on SIM and carrierObjective criterion | No | Yes: vulnerable to SIM swapping by fraudsters | No | No |
| Works without internet on the deviceObjective criterion | — | Requires mobile service | Yes: the code is time-based | Yes |
| Recovery after lossEditorial assessment | Via password reset | Easy: a new SIM with the same number | Requires backup codes or a transfer | Requires a second key or a backup method |
| ConvenienceEditorial assessment | High | High | Medium | High once set up |
| Service supportEditorial assessment | Everywhere | Very wide | Wide | Growing, but not everywhere |
Which option suits whom
Authenticator app
A sensible default: it doesn't depend on your carrier and works offline. Be sure to save your backup codes.
Passkey
Convenient and phishing-resistant, if the service supports it. Syncs through a password manager or your device ecosystem.
Hardware key
For your most valuable accounts: email, domains, admin work accounts. Buy two keys: a primary and a spare.
Things to keep in mind
- Store backup codes separately from your phone — printed out, for example
- Before switching phones, transfer your authenticator, or you'll lose access
- If a service lets you sign in via SMS instead of a stronger factor, your overall protection is only as good as SMS
- No factor will help if you approve a sign-in yourself because "support" asked you to
Sources and verification
- RFC 6238: TOTP — Time-Based One-Time Password Algorithm
- FIDO Alliance specifications (FIDO2/WebAuthn)
- NIST SP 800-63B: Digital Identity Guidelines
Software and service interfaces change. We list the versions we tested commands on; on other versions the steps may differ.