Ranking Two-Factor Methods, From Worst to Best

Before anything else: any second factor beats no second factor. Even the worst option on this list stops the most common attack, which is someone trying a password they found in an old breach. So if you only have SMS available on some account, turn it on. Then come back and read the rest.

That said, the methods are not equal, and the differences matter most against the attacks that actually work today. Here's how I'd rank them.

6. Security questions

These aren't really a second factor, but sites treat them like one, so they get a spot. Your mother's maiden name, the street you grew up on, your first pet. All of it is either public, guessable, or something you've posted about. If a site forces these on you, make up answers, store them in your password manager, and treat them like extra passwords. "What city were you born in?" can be answered with a string of random words.

5. SMS codes

The code gets texted to your phone. The weakness is that your phone number isn't really yours. It belongs to your carrier, and carriers can be talked into moving it to a new SIM. That's SIM swapping, and once someone has your number, they get your codes. SMS can also be intercepted in other ways, and the codes are easy to phish: a fake login page asks for your code and the attacker uses it immediately.

Still worth having over nothing. Just not where I'd stop for anything important.

4. Email codes

Better or worse than SMS depending entirely on how well your email is protected. If your email has strong 2FA, an emailed code is reasonably solid. If your email is protected by a reused password, it's worthless. It's also phishable in exactly the same way as SMS.

3. Push notifications

You log in, and an app on your phone pops up asking "Is this you?" Convenient, and it removes the SIM swap problem. The weakness is people. Attackers who have your password can trigger prompt after prompt, sometimes late at night, until someone taps "Approve" just to make it stop. It's called MFA fatigue and it's worked against some big companies. Versions that make you type a number shown on the login screen into the app are much better, because a random prompt with no matching screen in front of you is obviously fake.

2. Authenticator apps (TOTP)

The six-digit codes that change every thirty seconds, from apps like Aegis, 2FAS, Google Authenticator, or built into password managers like Bitwarden, 1Password and Proton Pass. The code is generated on your device from a secret shared once during setup, so there's nothing to intercept over the phone network and no SIM to steal.

The remaining weakness is phishing. A convincing fake site can still ask for the current code and relay it in real time. It's a narrow window, but attackers have automated it. Also, back up your setup. If your codes live on one phone and that phone dies, you'll want either the backup codes the site gave you or an authenticator that syncs or exports.

1. Passkeys and hardware security keys

These are tied for the top, and they're on top for the same reason: they're phishing-resistant. Both use public-key cryptography under the FIDO2/WebAuthn standard, and both are bound to the real domain. A passkey or security key registered for your bank won't respond to a lookalike site at all. There's no code for you to read off and type into the wrong place, so there's nothing to trick out of you.

Passkeys sync through your password manager or your phone's ecosystem, which makes them easy to live with. A hardware key, like a YubiKey or similar, keeps the secret on a physical device that never syncs anywhere. That's slightly more hassle and slightly more control. For your most important accounts (email, password manager, anything with money), I'd use a hardware key if you're willing, and register two of them so losing one doesn't lock you out.

What I'd actually do

Upgrade your email first, since it's the reset button for nearly everything else. Then your password manager, then banking. Move each one as high up this list as the site allows. Save the backup codes somewhere that isn't the same phone. And delete SMS as a fallback option on any account where you've set up something better, because an attacker will happily choose the weakest door you've left open.