What a second factor adds
Two-factor authentication asks for something more than a password when you sign in. The usual idea is to combine two different kinds of proof: something you know (a password), something you have (a phone or a key) and sometimes something you are (a fingerprint or face). If a password leaks, the attacker still needs the second item.
It is not all-or-nothing. Methods differ in how easy they are to use and in how well they stand up to different attacks. Any second factor is generally much better than none, and the differences below matter most for accounts that control other things, such as email, code hosting, cloud dashboards and device management.
Text-message codes
The service sends a short code by SMS, which you type in.
Convenience: Very easy. It works on nearly any phone and needs no extra app.
Weak points: Messages can be intercepted in some situations, and attackers may persuade a mobile provider to move your number to a different SIM, which is known as SIM swapping. Codes can also be requested by an attacker and then tricked out of you through a fake page or a phone call. Messages need signal and can be delayed.
Verdict: Better than nothing, and sometimes the only option offered. Use something stronger where you can.
Authenticator app codes
An app on your phone generates a short code that changes every thirty seconds or so, based on a secret shared when you set up the account.
Convenience: Fairly easy. It works offline and does not depend on your mobile number. You must open the app and type the code, and you need a plan for moving to a new phone.
Weak points: A fake website can ask for the code and pass it on in real time, so a phishing page can still succeed. The shared secret, if stored carelessly or copied, can be stolen. Backups of the app may be less protected than you expect.
Verdict: A solid choice for most accounts and a clear step up from text messages. Still, it does not prevent every phishing attack.
Push prompts
The service sends a notification to an app, and you tap approve or deny. Some versions ask you to match a number shown on the login screen.
Convenience: Very easy, with a single tap.
Weak points: If an attacker has your password, they can trigger repeated prompts and hope you approve one by accident or to stop the noise. This is often called prompt bombing. Number matching reduces the risk by requiring you to enter what the login screen shows. Prompts depend on a network connection.
Verdict: Convenient and reasonably strong when number matching is on. Deny any prompt you did not start, and change your password if they keep arriving.
Hardware security keys
A small physical device, connected by USB or tapped wirelessly, that you press or touch to approve a login. Many follow common open standards, so one key can work with many services.
Convenience: Moderate. You must have the key with you, and you should own a spare. Not every site supports them, and some older devices lack the right port or wireless support.
Strengths: These are generally regarded as the most resistant to phishing, because the key takes the website address into account and will not respond to a lookalike site. The secret never leaves the device, so there is nothing to read out or type.
Weak points: Loss or damage, which is why a backup key matters. Cost, though basic models are usually modest. Support varies by service, so check what your key and accounts both offer.
Verdict: The strongest common option, especially for email, password manager and developer accounts, and worth the extra step for accounts you cannot afford to lose.
Passkeys and device-based sign-in
Many services now offer passkeys, which replace the password with a credential tied to your device and unlocked by a fingerprint, face or device PIN. They use similar ideas to hardware keys and also check the site address, so they resist fake pages. Support and recovery behaviour differ between providers and platforms, so read how yours handles lost devices before relying on one.
Biometrics and backup codes
A fingerprint or face scan is usually used to unlock a device or key locally, and not as a stored secret on a remote server. It is convenient, but you cannot change a fingerprint if it is compromised, so it works best as a local unlock combined with another factor.
Backup codes are one-time codes you get when you enable two-factor authentication. They are your way back in if a phone is lost. Store them offline or in a password manager, and treat them like passwords.
Quick comparison
| Method | Ease of use | Resists fake login pages | Main concern |
|---|---|---|---|
| Text-message code | Very high | Low | Interception, SIM swapping |
| Authenticator app code | High | Low to moderate | Real-time relaying by fake pages |
| Push prompt | Very high | Moderate | Approval fatigue |
| Hardware key | Moderate | High | Loss, support and cost |
| Passkey | High | High | Recovery and platform differences |
This is a general summary, and real-world strength depends on how each service implements it.
Choosing sensibly
Start with the accounts whose loss would hurt most: email first, since it can reset everything else, then password manager, code hosting, cloud and device accounts. Use the strongest method each offers, keep at least one backup method, and store recovery codes safely. Combine it with unique passwords from password managers, and stay alert to phishing attacks, since even good second factors can be bypassed by a careless approval. No choice is perfect, but moving from no second factor to any second factor is a large improvement.