Authenticator app vs SMS codes: which is safer?
Both add a second step, but text messages have weaknesses that authenticator codes don’t. Here is a clear comparison and what to choose.
When you turn on two-step verification, many websites let you choose: get codes by text message, or use an authenticator. Both are far better than a password alone. But they are not equally safe, and the difference matters.
How each one works
Text-message codes are created by the website and sent to your phone number over the mobile network. Whoever receives the text gets the code.
Authenticator codes are created on your own device. When you set up 2FA, you and the website share a secret once, through the QR code. From then on, both sides calculate the same code from that secret and the current time. Nothing is ever sent, so there's nothing to intercept. (More on this in what is two-factor authentication.)
The weaknesses of text messages
SIM swapping
Criminals call a mobile carrier pretending to be you and convince them to move your number to a new SIM card. From that moment, your texts, including your 2FA codes, go to them. This is called SIM swapping, and it has been used to empty bank and crypto accounts.
Interception
Text messages were never designed to be secret. Weaknesses in the phone network and malicious apps on a phone can expose them.
No signal, no code
Traveling, in a basement or abroad without roaming? A text may arrive late or not at all. Authenticator codes work offline, anywhere.
Where both can fail: phishing
Here's the uncomfortable part: any code you type yourself can be phished. A fake sign-in page can ask for your password and then your code, and pass both to the real site within seconds. Neither text messages nor a basic authenticator app can tell the fake page from the real one; they just show the code.
This is where an authenticator that lives in your browser helps. Twofold knows which website each account belongs to and only suggests a code on that website. A lookalike address like mybank-login.com gets nothing. Read how Twofold stops phishing sites for the details.
Side by side
| Text message (SMS) | Authenticator | |
|---|---|---|
| Safe from SIM swapping | No | Yes |
| Works without signal or internet | No | Yes |
| Can be intercepted in transit | Yes | No, nothing is sent |
| Warns you about fake sites | No | With a browser authenticator like Twofold |
| Works if you lose your phone | Only after getting a new SIM | Yes, with a backup or sync |
What should you choose?
- If a website offers passkeys, use them: they're the strongest option. See passkeys explained.
- Otherwise choose authenticator app over text messages.
- If a website only offers text messages, still turn it on. It's much better than nothing.
- Once an authenticator is set up, remove your phone number as a 2FA method where the site allows it, so attackers can't fall back to it.
Making the switch
Switching an account from text messages to an authenticator takes a minute: open the site's security settings, add an authenticator, scan the QR code with Twofold and confirm with a code. Our step-by-step setup guide shows exactly how.