Two-factor authentication: SMS, app or hardware key? Which one to choose

Two-factor authentication (2FA) adds a second check after the password, something you have on top of something you know. Turning on a second factor is one of the most effective defences against account theft. But the method you choose makes a big difference, because they do not all protect against the same things. And one of the five compared here, the passkey, strictly speaking does not belong in the category. It works as a different way in, and it can take the password’s place rather than reinforce it. We will get there.

SMS: better than nothing, but the weakest

A code by text is convenient and works everywhere, but it has two weak points. It can be intercepted through SIM swapping, meaning a scammer who convinces the carrier to move your number to a new SIM. And it can be captured by a phishing site that asks you to enter it. Use it only when the service offers nothing else.

Authenticator app: the good compromise

Apps like Google Authenticator, Microsoft Authenticator, Aegis (Android) or 2FAS generate a six-digit code that changes every 30 seconds, with no network needed. They are not vulnerable to SIM swapping. They remain exposed to real-time phishing, because if you enter the code on a fake site the scammer uses it straight away, so always check the site’s address. Choose an app that supports encrypted backups of your codes, otherwise losing the phone means losing access.

Push notification: convenient, with a caveat

Some services (Google, Microsoft, many banks) send a “Are you signing in?” notification with a Yes or No button. It is more convenient than copying a code and it clears away the risks tied to SMS, but it has a weakness all of its own, MFA fatigue: scammers send dozens of requests hoping you will tap Yes to make them stop. If you receive a notification you didn’t request, tap No and change your password.

Passkeys and security keys: a different category

Here the comparison changes character, and it is worth pausing before lining passkeys up with the other three.

A passkey stands where the password stood. SMS, apps and push notifications are all second factors, they come after the password and exist to reinforce it; a passkey is an authentication method in its own right, built on public-key cryptography, and on a site that supports it fully the password drops out of the process.

The mechanism, in two lines. Your device creates a pair of keys, a private one that stays protected by the system and is never shown to the site, and a public one the site keeps. When you sign in, the site sends a challenge and your device signs it with the private key, after asking you for a fingerprint, a face or the unlock code. No secret travels that could be copied, so a lookalike site has nothing it can talk you into handing over. In the other three methods something secret still passes through your hands, and whatever passes can be diverted.

Security keys such as YubiKey or Google Titan work on the same principle, with the private key inside an object you keep in your pocket rather than inside your phone. They can act as a passkey proper, or, on services that still insist on a password, as a second factor. Same piece of hardware, two different roles.

Both are designed to resist phishing, and against lookalike sites they are the strongest protection you can have. What stays outside their reach are the other ways into an account, from a phone call to a password reset by email. They secure the sign-in and stop there. And for as long as the password stays active on your account as a fallback, whoever is trying to trick you will aim at that.

Security keys start at a few tens of euros for the basic models and connect via USB or NFC; the fuller-featured ones cost more, so it is worth checking the maker’s price list before buying. They are the right choice for your main email account, for anyone handling money or other people’s data, and for anyone who might be an attractive target.

What I would advise, account by account

For your main email and your bank, use a passkey where there is one, or a security key, with an authenticator app as backup. Where the service lets you, once the passkey works on two devices, turn the password off, because that is the step that makes the protection real. For social media and shopping, an authenticator app is more than enough. Leave SMS only where there is no alternative.

And in every case, store your recovery codes somewhere safe away from the phone. They are your way back in if you lose the device.