Security
Two-Factor Authentication Methods Compared
Any second factor beats a password alone, but some are much harder to defeat than others. Here is how the common options rank.
Last updated October 23, 2026 · By Harbor Privacy
Strongest to Weakest
- Hardware security key or passkey. Cryptographic and tied to the real site, so phishing pages cannot capture it. The best choice where offered.
- Authenticator app. A six-digit code that changes every 30 seconds, generated on your device. Strong, but a fake login page can trick you into typing the code.
- Push approval. Convenient, but attackers can spam prompts until a tired user taps Approve. Prefer prompts that make you match a number.
- SMS or voice code. Better than nothing, but vulnerable to SIM swaps and to interception.
- Email code. Only as secure as the email account that receives it.
Which Should You Use?
01
Email and primary accountsUse a security key or passkey if offered, otherwise an authenticator app.
02
Banks and moneyUse the strongest option the bank supports. If it only offers SMS, enable it, then add alerts.
03
Everything elseAn authenticator app is a good default. Avoid SMS where an app is available.
04
BackupSave the recovery codes offline, and register a second key or device.
Where Passkeys Fit
Passkeys combine the sign-in and the second factor in one step and resist phishing. Read what passkeys are and how to start.
Common Mistakes
- Leaving a phone number as the only recovery option for an important account.
- Not saving backup codes, then losing the phone.
- Approving a prompt you did not trigger.
- Using the same authenticator app on a single device with no backup.
For the basics, see passwords and two-factor authentication.
Common Questions
Is SMS two-factor authentication safe?
It is much better than no second factor, but weaker than an authenticator app or security key because phone numbers can be hijacked.
What is the safest two-factor method?
A hardware security key or passkey, because it cannot be phished.
Do authenticator apps need internet?
No. The codes are generated on your device from a shared secret, so they work offline.
What happens if I lose my authenticator app?
You need your saved recovery codes or another registered method. Set both up before you need them.
Should I turn on two-factor everywhere?
Prioritize email, banking, your phone carrier, and your password manager, then add the rest.
START WITH YOUR EMAIL
Your email resets every other account, so protect it first. Read the password and two-factor guide.