Two-factor authentication: SMS, app or hardware key? Which one to choose
Not all second factors are equal. A comparison of SMS codes, authenticator apps, push notifications, passkeys and hardware keys, with a recommendation for each type of account.
Two-factor authentication (2FA) adds a second check after the password: something you have, on top of something you know. Turning it on is the most effective defence against account theft, but the method you choose makes a big difference.
SMS: better than nothing, but the weakest
A code by text is convenient and universal, but it has two weak points: it can be intercepted through SIM swapping (a scammer convinces the carrier to move your number to a new SIM), and it can be captured by a phishing site that asks you to enter it. Use it only when the service offers nothing else.
Authenticator app: the good compromise
Apps like Google Authenticator, Microsoft Authenticator, Aegis (Android) or 2FAS generate a six-digit code that changes every 30 seconds, no network needed. They are not vulnerable to SIM swapping. They remain exposed to real-time phishing (if you enter the code on a fake site, the scammer uses it immediately), so always check the site’s address. Tip: choose an app that supports encrypted backups of your codes, otherwise losing the phone means losing access.
Push notification: convenient, with a caveat
Some services (Google, Microsoft, many banks) send a “Are you signing in?” notification with a Yes or No button. It is fast and phishing-resistant, but beware of MFA fatigue: scammers send dozens of requests hoping you’ll tap Yes to make them stop. If you receive a notification you didn’t request, tap No and change your password.
Passkeys and hardware keys: the top tier
Passkeys and physical keys such as YubiKey or Google Titan use public-key cryptography: they only work on the genuine site, so phishing is impossible by design. A hardware key costs between 25 and 60 euros and connects via USB or NFC. It is the right choice for your main email account, for anyone handling money or other people’s data, and for anyone who might be an attractive target.
In practice
For your main email and your bank, use passkeys or a hardware key, with an authenticator app as backup. For social media and shopping, an authenticator app is more than enough. Leave SMS only where there is no alternative. And in every case, store your recovery codes somewhere safe away from the phone: they are your way back in if you lose the device.