Turning on two-factor authentication is one of the highest-impact things you can do for account security — but not all second factors are equal. The two most common options, a text-message code and an authenticator app, look similar from the user's seat: you log in, you enter a six-digit code. Under the hood they have very different security properties. This guide explains how each works, where SMS falls down, and which to choose for which accounts.
If two-factor authentication is new to you, start with our primer on what two-factor authentication is, then come back here to choose a method.
How SMS two-factor works
With SMS-based two-factor, after you enter your password the service texts a one-time code to your phone number, and you type it in. Its great strength is convenience: it works on any phone, needs no app, and almost everyone understands it. That low friction is why so many services still offer it, and turning it on is genuinely far better than having no second factor at all.
The weakness is that your phone number becomes the security boundary — and a phone number is easier to steal than most people think.
How authenticator apps work
An authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, 2FAS, or the one built into many password managers) generates codes using a standard called TOTP — time-based one-time password. When you set it up, the service shares a secret key with the app, usually by QR code. From then on, the app and the server independently compute the same six-digit code from that shared secret plus the current time, rotating every 30 seconds.
The crucial difference: the codes are generated on your device from a secret that never travels over the network again. There is no text message to intercept and no phone number to hijack.
The core problem with SMS: SIM swapping
The headline weakness of SMS is the SIM swap attack. An attacker gathers a few personal details, calls your mobile carrier impersonating you, and convinces them to transfer your number to a SIM card they control. The instant that happens, every SMS code goes to the attacker — and they often target the SIM swap precisely because they already have your password from a data breach.
SMS has secondary weaknesses too: codes can be intercepted on compromised carrier networks, and real-time phishing kits can relay an SMS code the moment you enter it. Authenticator-app codes can also be phished in real time, which is why neither is fully phishing-proof — but app codes remove the entire SIM-swap and interception category of attack, which is the most common way SMS two-factor is defeated in practice.
Side-by-side comparison
| Property | SMS code | Authenticator app |
|---|---|---|
| Vulnerable to SIM swap | Yes | No |
| Works without phone signal | No | Yes |
| Network interception risk | Yes | No |
| Real-time phishing risk | Yes | Yes |
| Setup effort | None | Scan a QR code |
| Recovery if phone lost | Get a new SIM | Backup codes / app backup |
| Overall security | Better than nothing | Strong |
The even stronger option: hardware keys and passkeys
If an account supports it, the strongest second factor is a hardware security key (such as a YubiKey) or a passkey. These use public-key cryptography bound to the specific website, which makes them phishing-resistant: even if you are tricked onto a fake site, the credential simply will not work there, because the domain does not match. This closes the real-time phishing gap that both SMS and app-based codes still leave open. Reserve hardware keys and passkeys for your highest-value accounts — email, banking, and your password manager.
What about recovery codes?
Whichever app-based method you choose, you must plan for losing your phone. When you enable two-factor, the service offers a set of one-time backup codes — save them in your password manager or print them and store them somewhere physically secure. Many authenticator apps also offer encrypted cloud backup so your secrets survive a lost device. Skipping this step is one of the more painful common security mistakes, because it can lock you out of your own accounts.
Which should you choose?
- Use an authenticator app as your default second factor wherever it is offered. It removes the SIM-swap and interception risks that make SMS fragile.
- Use a hardware key or passkey for your most critical accounts to add phishing resistance.
- Use SMS only when nothing else is available. It is still a meaningful upgrade over a password alone — just not your first choice.
- Always save your backup codes so a lost phone never means a lost account.
Key takeaways
- App beats SMS. Authenticator codes are generated on your device and cannot be SIM-swapped or intercepted.
- SMS is a fallback, not a goal. Better than nothing, weaker than the alternatives.
- Hardware keys and passkeys are the gold standard for high-value accounts because they resist phishing.
- Plan recovery with backup codes before you need them.
Two-factor authentication protects you even when a password leaks — but it works best on top of a strong, unique password. Generate one for every account with our free password generator, store it in a password manager, and turn on app-based two-factor across the board.