If a service offers two-factor authentication, you usually get a choice: a six-digit code by text message, or a code from an authenticator app. Both are better than a password alone. They are not equally good, and the gap between them matters more than most people realise.
The short answer: use an authenticator app (or a passkey) whenever a service offers one. Use SMS only when nothing stronger is available.
What both methods actually do
Both methods add a second proof after your password: something you have, usually your phone. A thief with only your password still cannot get in, because they would need the code too. For the full picture of how 2FA fits into account security, our two-factor authentication guide covers the basics.
The difference is where the code comes from — and that one detail changes how hard the code is to steal.
Why SMS codes are the weakest common option
An SMS code travels over the mobile phone network, which means it can be redirected or intercepted:
- SIM swapping. An attacker convinces your carrier to move your number to a SIM card they control. After that, your texts — including verification codes — go to them. Carriers have added verification steps in recent years, but SIM swaps still succeed often enough to be a real threat.
- Phishing. SMS codes are not phishing-resistant. A fake website can collect your password and ask for the code you just received, then use both on the real site within the 30–60 second window. Scammers pressure you for codes by text — see our guide to smishing bank text scams for the pattern.
- SS7-style interception. In some regions, the signalling network that routes SMS can be abused directly, though carriers have been closing these holes.
None of this makes SMS useless. If a service only offers SMS, use it — it is still far better than no 2FA. But treat it as a fallback, not a preference.
How authenticator apps work
An authenticator app never receives a code over a network. When you enable it, the service gives you a secret key (usually via a QR code). The app stores that key and uses it to generate a six-digit code on your device that rotates every 30 seconds.
Because the code is generated locally, SIM swapping does not help an attacker. The code also expires quickly, so a stolen screenshot or phished code is only useful for seconds.
The trade-off: the codes live on your phone. If the phone is lost, wiped, or stolen, you need a recovery path — which is why backup codes matter (more below).
What changed recently: passkeys and passwordless logins
The comparison has shifted in the last few years. Passkeys — public/private key pairs synced to your phone or password manager — are now the recommended option on Google, Apple, and Microsoft accounts, and Google now prompts passkeys by default on compatible devices. Passkeys are both more secure and easier than app codes: there is nothing to type, and they are resistant to phishing because they only work on the site they were created for.
If a site offers a passkey, use it. If it offers a hardware security key (YubiKey-style), that is equally strong. An authenticator app is the best option when neither is available, and it is still clearly above SMS.
Step-by-step: set up an authenticator app
Setup is the same across services. Using Google Authenticator (free, on iOS and Android) as an example:
- In the service's security settings, choose Authenticator app or Two-factor authentication and select the app option.
- Open Google Authenticator and tap the + button, then Scan QR code.
- Scan the code shown on the service's page. The app adds the account and starts showing six-digit codes.
- On the service's page, enter the current code from the app to confirm it works.
- Before closing the page, save the backup codes the service shows you. Print them or store them in a password manager, never in a screenshot on your phone.
Two things to keep in mind:
- If the service asks, keep the phone app, not the SMS option, as your primary method.
- If you use a password manager, many (1Password, Bitwarden, Dashlane) can generate TOTP codes for you inside the vault. This is convenient, but it means your 2FA codes and your passwords live in the same place — acceptable for most people, and worth knowing. The password manager guide covers the trade-offs.
Plan for a lost phone before it happens
The single biggest downside of app codes is that a lost phone can lock you out. Before that happens:
- Save backup codes. Nearly every service gives you single-use backup codes. Print them, keep them somewhere safe but separate from your phone, and replace them after use.
- Set a recovery method. Add a recovery email or phone number to your account so you can prove who you are if the authenticator is gone.
- Migrate deliberately. When you get a new phone, move your authenticator accounts before wiping the old one. Google Authenticator and Authy support encrypted account transfer; Authy's cloud backup is end-to-end encrypted. If your app does not back up, use your saved backup codes to log in, then disable and re-enable 2FA on the new phone so it generates fresh codes.
When you might still choose SMS
There are legitimate reasons to rely on SMS: no smartphone, older accounts that only support SMS, or when you are setting up 2FA for a relative who will never open an authenticator app. In those cases, add SMS as a second factor and keep the phone number locked down — report lost numbers to your carrier immediately, and consider a carrier PIN if yours supports it.
Which should you pick? (decision table)
| Situation | Best choice |
|---|---|
| Site offers a passkey | Passkey |
| Site offers an authenticator app | Authenticator app |
| Site offers only SMS | SMS (better than nothing) |
| You are setting up an account for a less technical person | SMS, or an app with saved backup codes |
| You frequently lose or change phones | App + printed backup codes |
| High-value account (email, bank, crypto) | App or passkey, plus backup codes |
Quick answers
Is SMS two-factor better than nothing? Yes — use it if nothing else is offered. But it is the weakest common option and vulnerable to SIM swapping and phishing.
Can an authenticator code be phished? Yes. Codes typed into a fake website can be forwarded to the real one. Passkeys and hardware keys are phishing-resistant; app and SMS codes are not.
Do I still need backup codes if I use an app? Yes. They are often the only way back in after a lost or wiped phone. Print them and keep them safe.
Should my 2FA codes be in my password manager? It is convenient and fine for most people. Just be aware that whoever gains access to your password manager then has both factors.
Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026. Sources: FTC Consumer Advice, EFF Surveillance Self-Defense, Google: Turn on 2-Step Verification.