Two-factor authentication adds a second proof after your password. Most accounts offer at least two ways to get that proof: a text message with a code, or an authenticator app that generates one. Both are far better than a password alone – but they are not equal, and the difference matters most exactly when someone is trying to get into your account.
How SMS codes work – and where they break
The site texts a one-time code to your phone number. It is familiar and needs no setup, which is why it is the default almost everywhere. The weakness is the phone number itself: attackers can convince a carrier to move your number to their SIM (a SIM-swap), and text messages can be intercepted on parts of the mobile network. If someone takes over your number, your second factor arrives on their phone.
How authenticator apps work
An app like Bitwarden, Google Authenticator or Authy generates a new six-digit code every 30 seconds, computed on your device from a secret shared at setup. Nothing travels over the mobile network, so there is no number to swap and no message to intercept. The codes work offline, which also means they work when you have no signal.
The trade-off: your phone becomes the key
An app’s strength is also its risk: the secret lives on your device. Lose the phone without a backup and you can be locked out of every account at once. This is manageable: save the recovery codes each account gives you at setup, store them somewhere separate, and turn on the app’s own encrypted backup or transfer feature before you need it.
Which should you pick?
For accounts that matter – email, banking, your password manager – use an authenticator app or a passkey where offered, and keep SMS only as a fallback. For low-stakes accounts that offer nothing else, SMS is still far better than no second factor at all. The real mistake is leaving two-factor off because the choice felt complicated.
Whatever you pick, spend the setup’s last minute on the boring step: download the recovery codes and file them where a lost phone cannot reach them. That one habit is the difference between a security upgrade and a future lockout.
