Two-factor authentication, ranked
Not all second factors are equal. Here they are in order, and where each one fails.
Updated 2026-09-26
Adding a second factor to your accounts is the single highest-value security change most people can make. But the options are not equal, and the differences matter.
In order, best first
1. Passkeys. Your device proves who you are using a key it never hands over, and the check is tied to the real website's address. That last part is why passkeys are the only option on this list that cannot be phished — a fake site cannot ask for something it is not able to receive. Use them wherever they are offered.
2. A hardware key. A physical key you plug in or tap. Same phishing resistance as passkeys, useful where passkeys are not yet supported. Worth it if you hold something genuinely valuable.
3. An authenticator app. The six-digit codes from Google Authenticator, 1Password, Authy and similar. Vastly better than nothing, and not interceptable the way SMS is. It can still be phished: a convincing fake login page can ask for the code and use it within its thirty-second life.
4. SMS codes. The weakest, because a determined attacker can move your number to their SIM, and because the code arrives somewhere a phishing page can ask for it. Still far better than no second factor at all — most attacks are bulk and automated, and SMS stops those.
Where to start
Your email account, today. Everything else resets through it, so whoever controls your inbox controls your other accounts regardless of how those are protected. Then banking, then anywhere your money or identity lives.
The failure everyone forgets
Recovery codes. When you turn on a second factor you are given a set of one-time codes. Save them somewhere offline — printed, or in a password manager you can reach from another device. People lose access to their own accounts by changing phones more often than they lose them to attackers.
What it does not fix
A second factor protects the moment of signing in. It does nothing about malware already on your device, a session token stolen after you signed in, or you handing money to someone convincing. It closes one very large door. There are others.
Check a password Free, and it needs no account.