Two-factor authentication (2FA) means proving your identity with two different types of evidence — usually something you know (your password) and something you have (a code or device). Not all forms of 2FA are equally secure, though, and understanding the differences helps you decide where to spend the extra effort of setting up the strongest option.
SMS codes: better than nothing, but the weakest option
A text message with a one-time code is the most common form of 2FA, mainly because it requires no extra app — just a phone number. Its weakness is a technique called SIM swapping, where an attacker convinces (or bribes, or social-engineers) your mobile carrier into transferring your phone number to a SIM card they control, letting them intercept your codes. This isn't a common attack against random individuals, but it's a real, documented one against people with valuable accounts (cryptocurrency holders, executives, public figures). SMS 2FA is still meaningfully better than no 2FA at all — it's just the weakest link in this list.
Authenticator apps: a solid default for almost everyone
Apps like Google Authenticator, Microsoft Authenticator, or Authy generate a new six-digit code every 30 seconds, computed locally on your device using a shared secret established when you first set up 2FA — no text message, no network request involved in generating the code. This eliminates the SIM-swapping risk entirely, since there's no phone number for an attacker to hijack. The tradeoff is that if you lose the device without a backup, recovering access can be more involved than for SMS. Most authenticator apps now support encrypted cloud backup specifically to address this — turn it on when you set up the app, not after you've already lost a device.
Hardware security keys: the strongest option, worth it for your most critical accounts
A physical device (like a YubiKey) that you plug in or tap via NFC provides the strongest protection available, because it's specifically designed to resist phishing — even if you're tricked into entering your password on a convincing fake login page, the attacker can't complete login without physically possessing your key. This is meaningfully different from a code you type in, which a sufficiently convincing phishing site can capture and relay in real time. Hardware keys cost money and require carrying a physical object, which is why they're most commonly recommended specifically for your highest-value accounts — primary email, password manager, and financial accounts — rather than every single login you have.
A sensible way to prioritize, rather than doing all of this at once
- Your primary email account first. It's usually the account that can reset every other account's password, making it the single highest-value target.
- Your password manager. If this is compromised, everything stored inside is at risk.
- Financial accounts. Banking, and anything tied to money movement.
- Everything else, using whatever 2FA method that service supports — even SMS-based 2FA here is a meaningful improvement over a password alone.
For the first two or three, an authenticator app or hardware key is worth the setup time. For everything else, don't let the search for the "perfect" method stop you from turning on whatever 2FA is available.
Save your backup codes — really
Every reputable 2FA setup process offers a set of one-time backup codes for the scenario where you lose your device entirely. Save these somewhere durable and separate from the device itself (a password manager's secure notes feature, or printed and stored physically) — this is the detail people skip that causes genuine account-lockout headaches later.
This article does not recommend a specific paid hardware key or authenticator app. See our Disclaimer for our editorial approach.