Two-factor authentication (2FA) is one of the most effective security measures available — it prevents over 99% of automated account takeovers, according to Google research. But not all 2FA methods are equally secure. Here is what you need to know.
What is Two-Factor Authentication?
2FA adds a second verification step beyond your password. Even if an attacker knows your password, they cannot access your account without also passing the second factor. There are three main types used by consumers today: SMS text codes, authenticator apps, and hardware security keys.
SMS-Based 2FA — Convenient but Vulnerable
SMS 2FA sends a one-time code to your phone number via text message. It is widely supported and easy to use — but it has well-documented security weaknesses:
- SIM swapping: Attackers can convince your mobile carrier to transfer your phone number to a SIM card they control, intercepting all your SMS codes.
- SS7 attacks: The global telephone network (SS7) has known vulnerabilities that allow interception of text messages.
- Phishing: Real-time phishing attacks can capture SMS codes as you enter them on fake sites.
SMS 2FA is still far better than no 2FA — but for sensitive accounts (banking, email, password manager), use a stronger method.
Authenticator Apps — The Sweet Spot
Apps like Google Authenticator, Authy, and Microsoft Authenticator generate Time-based One-Time Passwords (TOTP) locally on your device. Codes change every 30 seconds and never pass through any network — making them immune to SIM swapping and SS7 attacks.
- ✅ Codes generated offline, no network required
- ✅ Immune to SIM swapping
- ✅ Free and widely supported
- ⚠️ Still vulnerable to sophisticated real-time phishing
- ⚠️ Losing your phone can lock you out (backup codes are essential)
Hardware Security Keys — Maximum Security
Physical devices like YubiKey use the FIDO2/WebAuthn standard and provide phishing-resistant authentication. They are the gold standard used by security-conscious organisations and individuals.
- ✅ Phishing-resistant (verifies the site's domain)
- ✅ No codes to intercept or phish
- ⚠️ Cost $25–$70
- ⚠️ Requires physical device at login
Our Recommendation
Enable 2FA on every account that supports it. Use an authenticator app (Authy or Google Authenticator) as a minimum for all important accounts. For email, banking, and your password manager, use a hardware key if possible. Always save backup codes when setting up 2FA — store them in your password manager vault.
Combined with a strong unique password from our password generator, authenticator-app 2FA makes your accounts nearly impossible to breach remotely.
Related: What Makes a Password Strong? → · 10 Password Mistakes →