You have decided to turn on two-factor authentication and immediately hit a choice: an app on your phone showing six-digit codes, or a small physical key you plug into a USB port. Both beat nothing, but they fail differently. Here is what actually separates them, and which accounts deserve which.
The three mainstream second factors
SMS codes
A code texted to your phone number. It is the weakest common option, and the reason is the number itself: it is an account with your mobile operator, and operators can be talked into moving a number to a new SIM. A SIM swap hands an attacker every code sent afterwards, and SMS also arrives on a lock screen anyone nearby can read. Keep it where a site offers nothing else — it still stops password-reuse attacks — but do not choose it when something better exists.
Authenticator apps (TOTP)
When you scan a QR code during setup, the site and your app agree on a shared secret. From then on both sides combine that secret with the current time to derive the same six digits, which change every thirty seconds. Nothing is transmitted, so there is no message to intercept and no phone number to steal. It works offline, it is free, and one app holds as many accounts as you like. Our online TOTP code generator takes a setup secret and shows the codes ticking over; our explainer on what a TOTP code is covers the maths behind the countdown.
Hardware security keys (FIDO2)
A small device — USB-A, USB-C, NFC or Lightning — holding a private key and producing a cryptographic signature when you touch it. It displays nothing and there is nothing to type. During enrollment the key generates a fresh keypair for that site, keeps the private half locked inside its secure element, and hands the public half over. Signing in means the site sends a challenge and the key signs it.
The one property that genuinely separates them
Everything above is detail. The difference that changes outcomes is origin binding.
A security key records the exact domain it was registered to and will only sign a challenge from that domain. Land on a convincing lookalike and the key simply does not respond — not because it detected fraud, but because the origin does not match the credential and there is nothing to hand over. You cannot be talked into approving it, because approving it is not possible.
A TOTP code has no such protection. It is six digits, valid for thirty seconds, and it works anywhere the correct secret is expected. A phishing page that asks for your password and then your code can relay both to the real site in real time, well inside the window — modern kits do this automatically. That is the practical gap: a security key resists phishing by construction, while an authenticator app relies on you noticing a fake domain in the address bar.
The real downsides of security keys
- You need two. Register a pair on every account — one on your keyring, one in a safe. A single key is a single point of failure, and losing it can lock you out permanently.
- They cost money. An authenticator app does not.
- Support is uneven. Major email, cloud and developer platforms handle keys well; plenty of smaller sites, banks and government portals still do not.
- Mobile can be awkward. Without NFC you are hunting for the right adapter.
- Enrollment is per account. Two keys across fifteen services is an afternoon of clicking.
Where authenticator apps still win
They are free, they cover unlimited accounts, they work on any site that supports 2FA at all, and they need no extra hardware to carry. They are also easier to keep recoverable: store each setup secret safely at enrollment — in an encrypted password manager, or printed and locked away — and you can re-add every account to a new phone yourself. Losing a phone with no backups is the classic way people lock themselves out, and it is entirely avoidable. Whichever factor you pick, generate the recovery codes the site offers and store them offline.
How passkeys fit in
Passkeys use the same FIDO2 cryptography as a hardware key, with one change: the private key lives in your phone, laptop or password manager rather than a separate dongle, unlocked by your fingerprint, face or device PIN. You get the same origin binding and phishing resistance without buying anything, and syncing across devices removes most of the lock-out risk. The trade-off is that the key material now sits in a general-purpose device and, if synced, in a cloud account — for most people an excellent bargain. See our introduction to passkeys for how enrollment works in practice.
The password underneath still matters
A second factor protects a login; it does not repair a bad first factor. Sites lose password databases, and a reused password turns one breach into ten compromised accounts. Every account needs its own long, random password stored in a manager — and where you must type or remember one, a multi-word passphrase from a password and passphrase generator beats a short string of substituted symbols on both strength and usability.
A recommendation ladder
- Turn on any second factor, everywhere. Even SMS beats a password alone. Do this first.
- Make an authenticator app your default. Free, universal and immune to SIM swapping. Save the setup secrets and recovery codes as you enroll — the TOTP generator is a convenient way to confirm a saved secret still produces the codes a site expects.
- Add security keys or passkeys to your highest-value accounts. Primary email first, then your password manager, domain registrar, financial accounts, and any developer or cloud console — these can reset everything else.
- Register the backup key and store recovery codes offline. Not in the same drawer as the primary key.
Be honest about the recovery path
None of this helps if your recovery email is weak. An attacker who controls the mailbox that receives password resets never has to defeat your security key — they go around it. Protect that mailbox with the strongest factor it supports, and check which addresses and numbers each service will accept a reset through.
The same reasoning applies in reverse: not every signup deserves your real address. Forums, one-off downloads and trials you will never revisit can go to a temporary inbox instead, so a breach at some abandoned service never lands near the mailbox your identity depends on.
