Two factor authentication examples include authenticator-app codes, hardware security keys, SMS codes, push approvals and biometrics. Security keys resist phishing best, while SMS is the weakest common option and works best as a last-resort fallback.
This guide ranks each method by strength and by the account it suits. For wider habits that protect every login, see how to protect yourself from hackers.
How a second factor works
A second factor protects an account because it comes from a different category than the password. NIST’s control language, published on csf.tools, defines multi-factor authentication as using two or more different factors: something you know (a PIN), something you have (a physical authenticator or cryptographic private key) and something you are (a biometric). A password plus a second password is not two-factor, because both come from the same category.
Every method in this guide follows the same sequence:
- Enter the password. This is the knowledge factor and the step an attacker with a leaked password can already complete.
- Receive a second challenge. The service asks for a code, a key tap, an approval or a biometric check.
- Prove possession or identity. You read a code from an app, touch a key, tap Approve or scan a fingerprint.
- The service verifies and grants access. A stolen password alone stops at the second challenge.
The strength of a method depends on how that second proof can fail. A code can be intercepted or relayed, a prompt can be approved by mistake, a phone number can be taken over, and a device can be lost. The ranking below follows those failure modes.
NIST’s older digital identity guideline, SP 800-63B, has been superseded by SP 800-63-4 as of August 1, 2025, so check the newer revision when you need the formal authenticator requirements.
Examples of two-factor authentication, from strongest to weakest
The five methods below cover almost every second factor a consumer or small business meets. Each subsection says how the method fails and who should use it.
Hardware security keys (YubiKey and FIDO2)
A hardware security key is a physical device that proves you hold a private credential, and it is the strongest common choice. YubiKey is the best-known example of this category, and LoginRadius describes security keys as the strongest MFA method available today. The reason is phishing resistance. Frontegg explains that a properly configured WebAuthn credential is bound to the relying party’s origin, so a look-alike site cannot reuse it. The EFF’s 2017 guide made the same point about the older U2F standard: the browser includes the site name when it talks to the key.
Hardware support has changed since that guide, which noted that only Chrome supported U2F and that NFC worked only on Android. Confirm that the browsers and phones you use are supported before buying. A key can also be lost, so Frontegg advises planning for a second enrolled key or a controlled recovery route. A passkey is closely related: it is a WebAuthn credential often used for passwordless sign-in.
Authenticator apps (TOTP)
An authenticator app generates time-based codes (TOTP) and keeps working even when the phone is not connected to a mobile network. The EFF notes that the application produces a new 6-digit code every 30 seconds. The EFF calls Google Authenticator a very popular choice and lists FreeOTP as a free software alternative. LoginRadius also names Authy and Microsoft Authenticator as apps that generate these codes.
The app needs no mobile network, which makes it more dependable than SMS when you travel or the signal is poor. The weakness is real-time phishing: a fake site can ask for the current code and relay it to the real site before it expires. Never type a code into a page you reached from an unexpected message. The guide to Phishing Email Examples: Real Scams, Red Flags, And How To Stop Them In 2026 – Cubeguard shows what those lures look like.
Push approvals
A push approval sends a prompt to your phone, and you tap Approve or Deny. It is fast, but the protection is thinner than it looks. The EFF points out that the location shown in a prompt is only an estimate, so the additional phishing protection provided by push-based 2FA is limited. Frontegg warns that a bare Approve/Deny prompt is open to fatigue attacks, and LoginRadius describes attackers who send repeated requests until the user approves out of frustration or confusion.
Push suits routine sign-ins where nothing stronger is offered. Deny any prompt you did not trigger yourself, and treat an unexpected burst of prompts as a sign that your password is already in someone else’s hands.
SMS codes
SMS sends a short code, typically 5-6 digits, by text to your phone. The EFF warns that phone number takeovers could give attackers access to your account without even knowing your password. It also notes that you cannot log in with SMS if your phone is dead or cannot connect to a mobile network. Frontegg lists SIM swaps, number porting and real-time phishing as relevant threats and notes that NIST treats PSTN-based out-of-band authentication as restricted and calls for alternatives.
So is SMS 2FA safe? It is a real second factor, but it is the weakest of the common options. Use it only where a service offers nothing better, and move email, financial and work accounts to an app or a key.
Biometrics
A fingerprint or face scan is the “something you are” category. Biometrics are quick, but they are best treated as a convenient way to unlock a device or app that holds the actual credential, not as a standalone shield for an important account. Keep a non-biometric fallback, such as a device PIN or a backup key, so a sensor problem does not lock you out.
Choosing a method by account type
The table puts the methods side by side on the criteria that decide the choice.
| Method | Phishing resistance | Main weakness | Planning use |
|---|---|---|---|
| Security key (FIDO2/WebAuthn) | Strong; credential is bound to the site’s origin | Loss of the key without a second key or recovery route | First choice for email, finance and admin accounts |
| Authenticator app (TOTP) | Partial; a code can be relayed before it expires | Lockout if the phone is lost without backup codes | Default for most other accounts |
| Push approval | Limited; the location estimate adds little | Repeated-request fatigue | Routine sign-ins only, never for unexpected prompts |
| SMS code | Weak; exposed to SIM swaps, porting and real-time phishing | Fails with a dead phone or no mobile network | Last-resort fallback |
The comparison draws on the EFF’s guide to common 2FA types and Frontegg’s overview of MFA types.
Which 2FA method is most secure? A hardware security key, because it is the only option here that resists phishing by design. In practice, match the method to what the account would cost you to lose:
- Email and password-manager accounts. Use a security key if the service supports one, with an authenticator app as the backup. Email resets every other account, so it deserves the strongest factor.
- Banking and payment accounts. Prefer a key or an app. Avoid SMS as the only factor where the bank allows alternatives.
- Work and admin accounts. Register more than one key so a single loss does not block access.
- Social media and shopping accounts. An authenticator app gives good protection without extra hardware.
- Services that offer only SMS. Turn it on anyway, and add a stronger factor when the service introduces one.
If you lose your 2FA device
Losing a phone or key is the main way 2FA locks people out, so set up recovery before you need it. The EFF warns that if your phone dies or gets stolen and you do not have printed backup codes, you may lose access to the account. Work through these steps in order:
- Use a printed backup code. Save the codes a service gives you at setup in a safe place away from your phone.
- Use a second enrolled key. Frontegg recommends planning for a second enrolled key or a controlled recovery route when you register a security key.
- Re-enroll from a saved QR image. When you set up an authenticator app, you can save the QR code image to a safe place or print it out as a backup.
- Use the service’s recovery route. If no backup exists, start the provider’s account recovery process from a trusted device.
- Re-enroll and replace. Once back in, register a new device and generate fresh backup codes.
If the phone was stolen or may be compromised, treat that as a separate emergency and follow the checklist in My Phone Was Hacked — What To Do Now: A Practical 2026 Recovery Checklist – Cubeguard before you rebuild your second factors.
Frequently asked questions
Is SMS authentication safe enough to keep using?
It is acceptable as a fallback, but number takeovers and SIM swaps can defeat it, so use an app or key on important accounts.
Do authenticator app codes need an internet connection?
No. LoginRadius notes that the app does not require internet or cellular connectivity, and the EFF says you can use it even when the phone is not connected to a mobile network.
What is a passkey?
A passkey is a WebAuthn credential, often used for passwordless sign-in, and it shares the origin-binding that makes security keys phishing-resistant.
Is NIST SP 800-63B still the current guideline?
No. NIST states that it has been superseded by SP 800-63-4 as of August 1, 2025.
