Three common second steps
Most major services now let you add a second proof of identity after your password. The three methods you will meet most often are codes sent by text message, codes generated by an authenticator app, and physical security keys. They all add protection over a password alone, but they are not equal.
The short version: a text code is the easiest to set up and the weakest of the three, an authenticator app is a solid middle option, and a security key is typically the strongest. The right choice depends on the account, your comfort level and what the service supports.
Text message codes
With this method, the service sends a short numeric code to your phone number, and you type it in.
Strengths
- Nothing to install. Almost everyone can receive a text.
- Simple to explain to family members and less technical users.
- Better than no second step at all.
Weaknesses
- The code depends on your phone number, not on your phone. If a criminal convinces a carrier to move your number to another SIM, they receive your codes. This is covered under SIM swap fraud.
- Messages can appear on a locked screen where others can read them.
- Codes can be tricked out of people. A caller or a fake page may ask you to read or type the code, which hands it over.
- Texts need signal, and can be delayed when you travel.
If a text code is all a service offers, use it. Just treat it as the basic tier, and consider upgrading elsewhere.
Authenticator apps
An authenticator app generates a new code, usually every 30 seconds or so. The code is calculated on your device from a secret shared when you first set the account up, typically by scanning a QR code. No message travels over the phone network.
Strengths
- Not exposed to a stolen phone number.
- Works without a signal.
- Free, and available for most phones and computers.
Weaknesses
- The code can still be typed into a convincing fake page, and the attacker may use it straight away. Apps resist many attacks, but not that one.
- If you lose the phone and have no backup, you can be locked out. Some apps offer encrypted backup or sync between devices; others do not. Check what yours does.
- Setting up a new phone means moving each account across, which takes a little patience.
Some password managers can also store these codes. That is convenient but puts both the password and the second step in one place, so think about whether that trade suits you.
Security keys
A security key is a small hardware device, usually connecting by USB or tapping against a phone. You touch it or press a button when prompted. It uses public-key cryptography and checks the website address, so it generally refuses to work on a lookalike page.
Strengths
- Resistant to phishing, the most common way second steps are bypassed.
- No codes to type or intercept.
- Fast once set up.
Weaknesses
- It costs money and must be kept somewhere safe.
- Not every site supports it.
- If you lose it, you need a backup method. Many people register two keys and keep one in a safe place at home.
- Different connection types (USB-A, USB-C, tap-to-phone) mean checking compatibility with your devices.
Passkeys, which are covered in the guide on passkey basics, are closely related. They use the same underlying idea, but live on your phone or computer rather than a separate gadget.
A comparison at a glance
| Text code | Authenticator app | Security key | |
|---|---|---|---|
| Cost | Free | Free | Purchase needed |
| Ease of setup | Easiest | Moderate | Moderate |
| Works without signal | No | Yes | Yes |
| Exposed to phone number takeover | Yes | No | No |
| Fake sign-in pages | Can be fooled | Can be fooled | Typically resists |
| Recovery if lost | Move number | Needs backup | Needs spare key |
Choosing sensibly
You do not need the strongest option everywhere. A reasonable approach:
- Protect your email, banking and any account that can reset others with the best method available.
- Use an authenticator app for most other important accounts.
- Accept text codes where nothing else is offered.
- Add a security key if you handle sensitive work, have been targeted before, or simply like the extra confidence.
Whichever you pick, save the backup codes the service provides and store them somewhere safe, such as with your other important papers. They are the quiet hero of recovery. Setting up recovery options setup before you need them can save a very stressful day if a phone is lost or broken.
Mistakes to avoid
- Never give a verification code to anyone who contacts you, even if they claim to be from the service. A real provider does not ask for it. This is a common feature of phone call scams.
- Be cautious about unexpected prompts. If you get approval requests you did not start, deny them and change your password, because someone may have it.
- Do not leave an old method active after switching. Remove the phone number you no longer use.
- Do not assume any second step makes you invulnerable. It makes takeover harder, not impossible.
If you are brand new to the topic, the explainer on two-step sign-in covers the basic idea. And if a code request ever arrives that you did not trigger, treat it as an early account takeover signs moment and review your password and recovery details right away.