Home / 2FA Explained: SMS vs Authenticator App vs Hardware Key

2FA Explained: SMS vs Authenticator App vs Hardware Key

A password alone isn't enough — here's what the three common second factors actually protect against.

Two-factor authentication (2FA) asks for something beyond your password when you log in — a code, a tap, or a physical key — so that a stolen password alone isn't enough to break into your account. Not all 2FA is equally strong, though. Here's how the three common methods actually compare.

SMS text codes

A code sent by text message to your phone. It's better than no 2FA at all, but it's the weakest option: SIM-swapping (an attacker convincing your carrier to move your number to their SIM) and SS7 network interception can both defeat it without touching your device. Use it only when a service offers nothing better.

Authenticator apps (TOTP)

Apps like Google Authenticator, Authy or the ones built into Proton Pass, Bitwarden and 1Password generate a 6-digit code that changes every 30 seconds, computed locally on your device from a shared secret — nothing is transmitted to receive it, which already defeats SIM-swapping. Its weak point is phishing: a fake login page can still trick you into typing the code into the attacker's site in real time.

Hardware security keys (FIDO2 / WebAuthn)

A physical key (YubiKey, Google Titan, and others) that you tap or insert to confirm login. Unlike a code, it cryptographically checks that you're on the real site before it responds — a fake page simply doesn't get a valid answer, which makes this the only common method that's genuinely phishing-resistant. The cost is buying a key and carrying it.

Passkeys — the newer alternative

Passkeys use the same FIDO2 technology as hardware keys but store the credential on your phone or computer instead of a separate device, unlocked with your fingerprint, face or PIN. They're phishing-resistant like hardware keys and don't require buying anything, but support varies by site and by how you back them up across devices — see our glossary entry for the details.

Which should you actually use?

In order of what to reach for: a hardware key or passkey for your most important accounts (primary email, your password manager, banking, work); an authenticator app for everything else; SMS only when a service truly doesn't offer anything better. Most password managers — including the ones in our password manager comparison — can now store and generate authenticator codes themselves, so you don't need a separate app.

Related terms: Two-factor authentication (2FA) · Passkey (FIDO2) · Master password

FAQ

Is any 2FA better than none?

Yes. Even SMS, the weakest common option, stops the huge majority of automated attacks that only have a stolen password. Turn on whatever a service offers rather than skipping 2FA to wait for a better option.

Can I use my password manager instead of a separate authenticator app?

Yes — Proton Pass, Bitwarden and 1Password can all generate authenticator codes directly, which is more convenient. The one trade-off: if someone gets into your password manager, they'd have both factors in one place.

What happens if I lose my hardware key or phone?

Every reputable service lets you register a backup method — a second key, backup codes, or a second phone — set one up before you need it, not after.

Do passkeys replace passwords entirely?

That's the goal, but adoption is gradual — most sites that support passkeys still let you fall back to a password, and many sites don't support them yet at all.