The safest two-factor authentication methods are passkeys and hardware security keys, because they cannot be phished. Authenticator apps are a solid middle option, push prompts are convenient but vulnerable to MFA fatigue, and SMS codes are the weakest but still far better than a password alone. This comparison shows how each method works, what attacks it stops, and which to choose.
Key takeaways
- Any second factor is much better than a password alone.
- Passkeys and FIDO2 security keys are phishing-resistant; codes and push prompts are not.
- SMS codes can be stolen through SIM swapping and real-time phishing.
- Use number matching if you rely on push notifications.
What are the main two-factor authentication methods?
The main two-factor authentication methods are SMS codes, email codes, authenticator app codes, push notifications, hardware security keys and passkeys. They all add a second check after your password, but they differ sharply in how well they resist phishing.
| Method | How it works | Phishing-resistant? | Main weakness |
|---|---|---|---|
| SMS code | Code sent by text | No | SIM swapping, real-time phishing |
| Email code | Code sent by email | No | Only as safe as the email account |
| Authenticator app (TOTP) | Code generated on your phone | No | Real-time phishing kits |
| Push notification | Approve a prompt in an app | No (better with number matching) | MFA fatigue |
| Hardware security key | USB or NFC key (FIDO2) | Yes | Must keep a backup key |
| Passkey | Device-held key confirmed with biometrics | Yes | Needs account recovery planning |
Which two-factor authentication method is the most secure?
Passkeys and FIDO2 hardware security keys are the most secure two-factor authentication methods, because they only work on the real website and cannot be typed into a fake one. CISA recommends phishing-resistant MFA for high-value accounts.
For a deeper look at the standards behind them, see FIDO2 vs WebAuthn.
Is SMS two-factor authentication still safe?
SMS two-factor authentication is safer than no second factor, but it is the weakest option. Attackers can take over your phone number through SIM swapping, or capture codes with phishing pages that relay them in real time.
The US National Institute of Standards and Technology classifies SMS as a “restricted” authenticator in NIST SP 800-63B. Use it only where nothing better is offered.
What is MFA fatigue and how do you prevent it?
MFA fatigue is an attack where criminals with a stolen password send repeated push prompts until the victim approves one. It was used in a widely reported breach at Uber, where a contractor accepted a prompt after many requests.
Prevent it by turning on number matching, limiting how many prompts can be sent, and training staff to report unexpected prompts instead of approving them. Moving to passkeys removes the risk entirely. Our social engineering guide covers the human side.
How should a business roll out two-factor authentication?
A business should roll out two-factor authentication to administrators first, then finance and email for everyone, then all remaining systems. Use phishing-resistant methods for admins and an authenticator app or passkeys for other staff.
- Turn on MFA for all admin and remote access accounts.
- Enforce MFA on email for every user.
- Issue security keys or passkeys to administrators.
- Disable SMS where better options are available.
- Document account recovery so lost phones do not lock people out.
See our identity and access management guides for tools that manage this at scale.
Frequently asked questions
Is 2FA the same as MFA?
Two-factor authentication (2FA) uses exactly two factors, while multifactor authentication (MFA) means two or more. In everyday use the terms are interchangeable, because most MFA setups use two factors.
Should I use Google Authenticator or a password manager for codes?
Both work. A dedicated authenticator app keeps codes separate from passwords, which some people prefer. A password manager is more convenient and backs codes up. Either is better than SMS.
What if I lose my phone with my authenticator app?
Use the recovery codes you saved when setting up 2FA, or a second registered method. Set up backups before you need them: a second device, a security key or printed codes.
Do security keys work on phones?
Yes. Most FIDO2 security keys support NFC for phones or come in USB-C versions. Passkeys stored on the phone itself are often the easiest option for mobile users.
Next steps
Any two-factor authentication method is a big step up from a password alone, but the strongest choice is a passkey or security key. Turn on an authenticator app today where passkeys are not available, and plan phishing-resistant MFA for admins. Check the rest of your setup with the free Cybersecurity Readiness Assessment.
