Two-factor login adds a second proof after your password. There are several ways to do it, and they are not equally strong. This comparison is part of our two-factor login and passkeys guide. If this is all new, start with what 2FA is.
The main methods at a glance
| Method | How it works | Stops password theft | Stops fake login pages |
|---|---|---|---|
| SMS code | Code sent by text | Mostly | No |
| Email code | Code sent to your inbox | Mostly | No |
| Authenticator app | Your phone makes a timed code | Yes | No |
| Push approval | Tap "approve" on your phone | Yes | Partly |
| Security key | Tap a physical device | Yes | Yes |
| Passkey | Your device proves who you are | Replaces the password | Yes |
SMS codes
These are easy and work on any phone. Their weaknesses are SIM swap attacks, in which a criminal moves your number to their own phone, and fake sites that ask for the code in real time.
Authenticator apps
An authenticator app creates a new six-digit code every 30 seconds, with no phone signal needed. It is a strong everyday option, and it is free. A very convincing fake site can still trick you into typing the current code.
Push approvals
Your phone asks "Is this you?", and you tap yes. It is convenient, but attackers can flood you with prompts until you give in, an attack called MFA fatigue. Prompts that make you match a number are safer.
Security keys
A hardware security key plugs in or taps your phone. It checks the real website address, so a fake site gets nothing. It is the strongest option for your most important accounts.
Passkeys
Passkeys use the same anti-phishing technology, with the key held on your phone or computer. They can replace passwords altogether. See passkeys vs passwords vs 2FA.
Which to use where
- Email, Apple or Google account: a passkey or security key, or at least an app.
- Banking: whatever your bank offers, using the strongest option available.
- Social media: an app or passkey.
- Crypto exchanges: a security key if possible, and never SMS alone. See securing exchange logins.
- Everything else: whatever is available.
Our guide on which accounts need 2FA first gives you the order. Whichever you pick, keep your backup codes safe.