Two-Factor Authentication Explained: SMS, Authenticator Apps, Passkeys and Security Keys

Passwords leak. They get reused, phished and dumped in data breaches, which is why almost every major service now offers two-factor authentication. But not all second factors are equal. A code by text message, a code from an app, a passkey on your phone and a physical security key protect you against different attacks. This guide explains each method in plain language, compares them side by side, and gives practical recommendations for different kinds of accounts, including what to do when you signed up with a number you won't keep.

What is two-factor authentication?

Two-factor authentication requires two different kinds of proof to sign in: something you know, like a password, plus something you have, like your phone or a security key, or something you are, like a fingerprint that unlocks a passkey. If an attacker steals your password, they still can't get in without the second factor.

Services call it different things: 2-Step Verification, two-step verification, login approvals, multi-factor authentication. The idea is the same.

It's worth separating 2FA from the one-time phone verification many apps ask for at sign-up. Sign-up verification checks that you're a real person with a working number. 2FA protects every future login. You can verify once with one method and protect the account with a completely different, stronger one.

How do the methods compare?

The main differences are how easy each method is to steal or trick you out of, and how easy it is to recover if you lose a device.

Why is SMS the weakest option?

SMS codes depend on your phone number, and phone numbers can be stolen. In a SIM swap, a criminal convinces or bribes a carrier to move your number to their SIM, and then receives your codes. SMS codes can also be phished: a fake login page asks for your code and passes it to the real site in real time.

There's also a quieter risk: losing the number. If you change carriers, let a prepaid line lapse, or used a temporary number to sign up, codes will go to whoever holds the number next. Despite these issues, SMS 2FA still blocks most automated password attacks, so it's much better than nothing.

Authenticator apps, passkeys and security keys

Authenticator apps generate a new six-digit code every 30 seconds from a secret shared when you scan a QR code. They don't depend on your phone number, work offline, and many can back up or sync codes. They can still be phished by a convincing fake page, so check the address before typing a code.

Passkeys replace passwords with a cryptographic key stored on your device or in your password manager and unlocked with your face, fingerprint or PIN. Because a passkey only works on the real website, it can't be phished. Hardware security keys work the same way in a physical device and are the standard for high-risk users. Register at least two, or a key plus another method, so losing one doesn't lock you out.

What should you use?

For your email, password manager and primary accounts, use passkeys where available and an authenticator app otherwise. Add a hardware key if you're a likely target, such as an administrator, journalist or public figure. Turn off SMS as a fallback when the service lets you and you have other methods set up, and store backup codes offline or in a password manager.

If you verified an account with a temporary number, for example a Noir SMS number used to sign up without sharing your personal number, switching to an authenticator app or passkey right away is essential, because the temporary number is recycled and can't be your recovery method. Noir SMS itself offers optional two-factor authentication with an authenticator app for your Noir SMS account. Use temporary numbers only for your own legitimate accounts.

• Email and password manager: passkey or security key, plus backup codes.
• Social and messaging: authenticator app or passkey; WhatsApp: two-step PIN.
• Low-value accounts: authenticator app; SMS is acceptable if it's your own number.
• Accounts created with a temporary number: move to an authenticator or passkey immediately.