What a second factor adds
A password is something you know. Two-factor authentication asks for a second, different kind of proof, so that knowing the password alone is not enough. The usual categories of proof are something you know (a password or PIN), something you have (a phone or a physical key) and something you are (a fingerprint or face). A login that combines two different categories is much harder to break than one that relies on a single password, even though no method is perfect.
The methods below all supply the “something you have” part in different ways. They differ in convenience, in cost and, most importantly, in how well they hold up against particular attacks.
Text message codes
The service sends a short numeric code by SMS, and you type it in.
Strengths. Nearly everyone can use it, because it needs only a phone number and no extra app. It is easy to understand and a big improvement over a password alone.
Weaknesses.
- Text messages are not designed to be secure. They can sometimes be intercepted through weaknesses in the phone network, or read from a lock screen.
- An attacker who convinces a mobile provider to move your number to another SIM, known as SIM swapping, receives your codes instead of you.
- You cannot receive codes without signal, or when travelling abroad without roaming.
- The code can be handed over to a scammer who persuades you to read it out.
Text codes are better than nothing and a reasonable choice when nothing else is offered, but they are generally regarded as the weakest of the common options.
Authenticator apps
An authenticator app on your phone generates a short code that changes every thirty seconds or so, based on a secret shared with the service when you first set it up, plus the current time. You type the current code when you log in.
Strengths.
- Codes are generated on your device, so they do not travel over the phone network and cannot be intercepted that way.
- They work without signal.
- Setup is usually a one-time scan of a QR code.
Weaknesses.
- If you lose or replace your phone without preparing, you can be locked out. Some apps allow encrypted backups or syncing to another device, which helps but adds its own account to protect.
- The codes can still be typed into a fake website. If a convincing phishing page asks for the code and passes it to the real site at once, an attacker can sometimes log in.
- Setting up each account takes a few minutes.
Authenticator apps are a solid middle ground for most people.
Approval prompts
Some services send a notification to a trusted phone asking you to approve or deny a login, sometimes with a number to match.
Strengths. Very convenient, with no code to type. Showing the location or a number to match helps you spot unexpected requests.
Weaknesses. Attackers sometimes trigger repeated prompts hoping you will approve one out of annoyance or confusion, a tactic sometimes called prompt bombing. The safe response to a prompt you did not start is always to deny it and then change your password. Prompts also depend on that one trusted device.
Hardware security keys
A hardware key is a small physical device, often connecting by USB or tapping wirelessly, that you touch or tap to confirm a login. Under the hood it uses public-key cryptography, with the key proving its identity only to the genuine website.
Strengths.
- Strong resistance to phishing, because the key checks the website’s real address and will not respond to a lookalike page. The same idea underlies passkeys.
- No code to type or intercept.
- Works independently of the phone network.
Weaknesses.
- You need to buy one, and it is sensible to buy at least two so a spare exists.
- You must carry it, and not every service or device supports it.
- If you lose all your keys and have no recovery method, you can lose access to the account.
Keys are often recommended for the most important accounts, particularly email, or for people who face targeted attacks.
Passkeys and biometrics
Passkeys can serve as a strong login on their own, and often combine a device you hold with a fingerprint, face or PIN used to unlock it. They share the phishing resistance of hardware keys. They are covered in more detail separately and support is still growing. Biometric checks on a phone are a convenient way to unlock the second factor, but they are not usually the second factor sent to a website.
Backup codes and recovery
Whichever method you choose, plan for the day it fails. Most services offer one-time backup codes when you enable two-factor authentication. Store them somewhere safe and separate from your phone, such as in a password manager or printed and kept in a secure place. Know what recovery options exist if you lose your phone, and keep a second method registered where possible, such as both an app and a key. Recovery routes are attractive to attackers, so they deserve the same care as the main login.
A quick comparison
| Method | Convenience | Resistance to fake login pages | Main weakness |
|---|---|---|---|
| Text message code | High | Low | Number hijacking, interception |
| Authenticator app | Medium | Low to moderate | Lost phone, code can be phished |
| Approval prompt | High | Low to moderate | Prompt fatigue |
| Hardware key | Medium | High | Cost, losing the key |
These ratings are general guides rather than measurements, and real-world results depend on how each service implements them.
Choosing sensibly
Turning on any second factor is better than none. If you can, use an authenticator app or a hardware key for your email, financial and other important accounts, keep text codes as a fallback only where that is the sole option, and store your backup codes safely. A stronger method that you will actually keep using is better than a perfect one you abandon.