Two-Step Verification Methods: SMS vs App vs Passkey
Table of contents
Two-step verification means that logging in requires a second proof in addition to your password. But "two-step verification" is not one single method: SMS codes, authenticator apps and security keys or passkeys offer quite different levels of security and convenience. In this article we compare two-step verification methods and explain which one makes sense for which account.
Why does two-step verification matter?
Passwords can be exposed through data breaches, phishing pages or reuse across sites. A second step makes it harder to open your account with a stolen password alone. So any two-step verification is better than none. The real question is not "should I turn it on?" but "which method should I choose?"
When you evaluate a method, look at three things: how well it resists impersonation and phishing, how easy it is to use every day, and how you get back into your account if you lose your phone.
Method 1: SMS codes
A six-digit code arrives on your phone number and you type it in. It is the easiest method to set up, needs no extra app, and everyone understands how it works.
Pros: Very simple to set up, available on almost every service, no technical knowledge required.
Cons: Security depends on who controls your number. Moving the number to another card at the carrier (a SIM swap), messages that fish for codes, and being talked into reading a code out to someone are the main risks. You may also fail to receive codes abroad or without coverage.
SMS is far better than nothing and sometimes it is the only option. But it should not be your first choice for valuable accounts.
Method 2: Authenticator apps (TOTP)
An app on your phone generates short-lived codes that change every 30 seconds. The codes are produced on your device, so no SMS or network connection is needed.
Pros: Even if your phone number is taken over, the codes do not go to the attacker. It works offline. Many services support it.
Cons: If the phone is lost or reset, access to the codes goes with it, so backup codes or the app's backup feature are essential. If you type a code into a fake login page yourself, there is still risk, so it is not fully immune to phishing.
For most people this is the best balance of security and convenience.
Method 3: Security keys and passkeys
A security key (a physical device that works over USB or NFC) and a passkey (a credential stored on your phone, computer or password manager and unlocked with a fingerprint or face) belong to the same family. You do not type a code; the device talks to the real address you are logging in to.
Pros: The most phishing-resistant method, because it does not work on a fake site. With no code to type, it is fast and comfortable.
Cons: Not every service supports it. If you lose the physical key or lose access to the account where your passkey is stored, you need a recovery plan. A physical key costs money, and buying a spare is recommended.
Comparison table
| Method | Phishing resistance | SIM swap risk | Convenience | If you lose the device |
|---|---|---|---|---|
| SMS code | Low | Yes | Very high | Recoverable by getting the number back |
| Authenticator app | Medium | No | High | Needs backup codes or an app backup |
| Security key | Very high | No | Medium-high | A spare key is essential |
| Passkey | Very high | No | Very high | Depends on the account it syncs with |
The ratings show general tendencies; implementation details can vary from one service to another.
Which method for which account?
- Email, banking, crypto, password manager: A passkey or security key if possible; otherwise an authenticator app. Your email is the recovery key to everything else, so it should be your best-protected account.
- Social media and messaging: An authenticator app or passkey. SMS only when nothing else is offered.
- Shopping, subscriptions, gaming: An authenticator app is enough; use a passkey if offered.
- Throwaway, one-off accounts: SMS is acceptable, as long as you do not reuse the same password elsewhere.
If an account lets you register more than one method, set one as the main method and another as a backup.
Virtual numbers and two-step verification
Single-use virtual numbers used to receive verification codes do not give you permanent ownership. That makes the number unsuitable as the basis of SMS-based two-step verification for your account, because you cannot reuse it later. If you opened an account with a virtual number, add an authenticator app or passkey right after setup and define a recovery email.
Some platforms may not accept virtual numbers, in which case you need to respect the service's terms. If a code does not arrive, read why your SMS code is not coming. For current services and countries, see the pricing page.
A short setup checklist
- Turn on the strongest method on your email account first.
- Then enable it on your bank, social media and password manager.
- Register at least one backup method for every account.
- Store backup codes offline in a safe place; do not leave a screenshot in the cloud.
- When changing phones, do not wipe the old one until you are sure the authenticator app has been moved to the new device.
- Check the "trusted devices" and "active sessions" lists in your account settings now and then.
Common mistakes
Even a good method can be weakened by some habits:
- Having no backup plan: Being locked out of an account for good after losing the phone is the most common problem.
- Leaving backup codes as a screenshot in the cloud: If the account is taken over, the codes go with it.
- Telling a code to someone else: Whatever the method, sharing a code removes the protection.
- Using the same password everywhere: The second step helps but does not replace good password habits.
- Saying "yes" to approval prompts out of habit: Never accept an approval notification that arrives when you did not sign in.
Frequently asked questions
Should SMS two-step verification never be used?
No. SMS is much safer than having no second step. Turn it on when it is the only option, and move to a stronger one when it becomes available.
Does a passkey replace the password?
On many services a passkey lets you sign in instead of a password and also works as the second step. Depending on the service, the password may stay alongside it, so check the settings.
How do I get into my account if I lose my phone?
With backup codes you saved earlier, a second registered device or a spare security key. Preparing these during setup is the most important step.
Can an authenticator app and SMS stay enabled together?
On most services, yes. But as long as the SMS option stays active, attackers may try that path, so if you can, leave SMS only as a last resort.