Turning on two-factor authentication is the single best security upgrade most people can make. But "two-factor" is not one thing — it spans methods that range from genuinely strong to barely better than nothing. Treating them as interchangeable is a mistake, and knowing the difference tells you which to use where.
Why a second factor helps at all
A password is one factor: something you know. Two-factor adds a second, usually something you have, so that a stolen password alone is not enough to log in. The attacker would also need your second factor. That extra step blocks the most common attacks, where credentials leak in a breach and get replayed. Any second factor is far better than none — but the methods are not equally strong.
SMS codes: better than nothing, but weak
The most common method texts a code to your phone. It is convenient and stops basic attacks, but it has a serious flaw: the code is delivered to a phone number, and phone numbers can be hijacked. In a "SIM swap," an attacker convinces your carrier to move your number to their device, and now the codes come to them. SMS codes can also be intercepted or phished in real time. They are the weakest common option — worth using if nothing else is available, but not where it counts most.
Authenticator apps: a real step up
An authenticator app generates a rotating code on your device itself, with no phone number and no text message in the loop. That removes the SIM-swap and interception risks entirely, because the code never travels over the carrier network — it is computed locally from a shared secret. For most people on most accounts, an authenticator app is the sensible default: a big security gain with minimal hassle.
Hardware keys and passkeys: the strongest
The top tier is a physical security key or a passkey, both built on the same phishing-resistant cryptography. Their crucial advantage is that they verify the real website's identity, so they simply will not authenticate on a fake look-alike site. That closes the hole the other methods leave open: even a convincing phishing page that captures your password and tricks you into entering a code cannot fool a hardware key. For your most important accounts — email, finances, anything that unlocks everything else — this is the method to use.
The attack the weaker methods miss
The thread connecting all this is phishing. A determined attacker can build a fake login page that relays your password and your SMS or app code to the real site in real time, defeating those methods. Hardware keys and passkeys are the only common options that resist this, because they are cryptographically bound to the genuine site. That is why the security gap between "second factor" methods is wider than it looks.
Why it matters
Two-factor authentication is essential, but choosing the method is part of the decision. Use SMS only when nothing better is offered, prefer an authenticator app as your everyday default, and put a hardware key or passkey on the accounts that matter most. The goal is not just "two factors" — it is a second factor that holds up against the attack you are actually likely to face.
Analysis by GenZTech.