Best Alternatives to Text Message 2FA: What to Use Instead of SMS Codes

If you are looking for the best alternative to standard text message 2FA, the short version is that you have better options than a six-digit code sent to your phone. Passkeys, hardware security keys and authenticator apps all protect your accounts more reliably, and most of them are free or cheap to set up.

This guide explains why SMS codes are considered the weakest common second factor, ranks the alternatives in plain language, helps you choose by situation, and walks you through switching without locking yourself out. It is general guidance, not a guarantee of security.

The Short Answer

The best alternative to text message 2FA is a passkey or a hardware security key where the service supports them, because they resist phishing. If not, use an authenticator app. Keep SMS only as a last resort, since it is still better than having no second factor.

Why Text Message 2FA Is Weak

Two-factor authentication adds a second proof beyond your password. An SMS code is a proof that you control a phone number. The trouble is that a phone number is not the same as a phone, and the code can be captured in several ways.

SIM swapping and port-out fraud

In a SIM swap, a criminal persuades your mobile carrier to move your number to a SIM card they control. A port-out does the same by transferring your number to a different carrier. Once they have your number, they receive your text codes. The US Federal Communications Commission has described consumer harm from these attacks and adopted rules in 2023 requiring carriers to authenticate customers more securely before SIM changes and port-outs. Those rules help, but the weakness of the method remains.

Phishing and real-time relays

A fake login page can ask for your password and then your text code, and pass both to the real site immediately. The code is valid, so the attacker gets in. CISA, the US cybersecurity agency, ranks SMS and voice codes at the bottom of its list of multifactor methods for this reason.

Interception and other weaknesses

Text messages travel over phone networks that were not designed for secure authentication. Messages can also appear on a lock screen, be read by malware on your phone, or arrive on a number you no longer control after you change plans.

But it is still better than nothing

This point matters, and many guides skip it. Security vendors and researchers consistently say that SMS-based 2FA is much better than relying on a password alone. If a service offers only SMS, turn it on. The advice here is to upgrade where you can, not to switch off a protection you have.

How the Alternatives Compare

CISA’s guidance describes a hierarchy. FIDO and WebAuthn methods, which include passkeys and security keys, are at the top because they are bound to the real website. One-time code apps and push approvals with number matching come next. Push without number matching ranks lower, and SMS and voice codes rank lowest. The table translates that into everyday terms.

Method	Phishing-resistant?	Affected by SIM swap?	Ease of use	Best for
SMS or voice code	No	Yes	Very easy	Last resort when nothing else is offered
Email code or link	No	No, but depends on email security	Easy	Weak on its own; only as good as your email account
Authenticator app code (TOTP)	No	No	Easy	Most people, as a solid upgrade
Push with number matching	No, though it resists approval spam	No	Very easy	Services that offer it without passkeys
Passkey	Yes	No	Easy	Most consumer accounts where supported
Hardware security key	Yes	No	Moderate	High-value and high-risk accounts

 

A note on the phrase “phishing-resistant.” It means the sign-in cannot be tricked into working on a fake site, because the credential is tied to the real domain. Codes and approvals can be passed along by a convincing fake page, even when they come from an app.

Option 1: Passkeys

A passkey replaces your password, or backs it up, with a cryptographic key stored on your device. You unlock it with your fingerprint, face or device PIN. Because the key only works for the genuine website, a fake page gets nothing useful.

Strengths: phishing-resistant, no code to type, and supported by major platforms such as Apple, Google and Microsoft. Trade-offs: synced passkeys depend on your cloud account for recovery, which some security guidance cautions against for the most sensitive or privileged accounts. Not every site supports them yet.

Choose it if the service offers passkeys, and you want strong protection with less effort.

Option 2: Hardware Security Keys

A security key is a small physical device, often USB or NFC, that proves your identity when you plug it in or tap it. It uses the same FIDO standards as passkeys, with the key stored inside the device itself.

Strengths: among the strongest options, phishing-resistant and unaffected by SIM swaps. Trade-offs: you must buy them, which usually costs tens of dollars each, you can lose them, and not every service supports them. Plan to register at least two keys and store one safely.

Choose it if you protect email, financial, cryptocurrency or work accounts, or you are a likely target.

Option 3: Authenticator Apps

An authenticator app generates a short-lived code on your phone, based on a secret shared with the service. The code is created on the device, not sent over the phone network, so a SIM swap does not expose it.

Strengths: free, widely supported, and a big step up from SMS. Trade-offs: the codes can still be entered on a fake site and relayed, so they are not phishing-resistant. Losing your phone can lock you out if you have no backup, so check how your chosen app handles backups and transfers.

Choose it if a passkey is not offered and you want a simple, free improvement.

Option 4: Push Approvals With Number Matching

Some services send a notification to an app on your phone that you approve. Number matching asks you to type a number shown on the login screen into the app, which helps defeat attacks where criminals flood you with approval requests until you tap yes by mistake.

CISA treats number matching as a useful interim step, not as phishing-resistant. If you see a push request you did not start, deny it and change your password.

What About Email Codes and Biometrics?

Email codes are convenient, but they are only as secure as your email account. If an attacker gets into your email, they can read the codes. Protect your email with a strong second factor first.

Fingerprints and face scans are best seen as a way to unlock a passkey or your phone, not as a separate second factor over the internet. They are convenient and useful, but the security comes from the cryptographic key they unlock.

How Real-Time Phishing Works, and Why Passkeys Stop It

Understanding the attack makes the ranking easier to trust. In a real-time phishing attack, you receive a message pointing to a page that looks exactly like your bank or email login. You type your password, the attacker’s system immediately types it into the real site, and the real site sends you a code. You enter that code on the fake page, and the attacker uses it a second later.

Nothing about the code is wrong. The weakness is that a human has to decide where to type it. A passkey or security key removes that decision. The device checks the website address before it answers, and a look-alike domain does not match, so there is nothing to hand over. This is what the phrase “origin binding” means in security documents, and it is why CISA places these methods above codes and approvals.

That does not make you invincible. Attackers can still try to trick you into approving prompts, installing malware or handing over recovery details. But it closes the most common route.

Choosing an Authenticator App

If you go with an authenticator app, pick one thoughtfully, since the app now holds the keys to your accounts. Many options exist, including built-in choices from major platforms, dedicated apps and password managers that store codes. Rather than recommend a brand, here is what to look for.

• Backup and recovery: can you restore your accounts on a new phone, and is that backup encrypted?
• Multi-device support: can you use it on a second device in case your phone breaks?
• Standard codes: apps that follow the common time-based code standard are easier to move between tools.
• App lock: can it require a fingerprint, face or PIN before showing codes?
• Export options: can you leave the app later without re-enrolling every account?
• Separation: storing passwords and codes in the same place is convenient, but it reduces the benefit of having two separate factors.

Whichever you choose, test the restore process once before you depend on it.

When a Service Only Offers SMS

Many services still offer nothing beyond text codes. In that case, take a layered approach instead of giving up.

• Turn the SMS code on, since it is better than a password alone.
• Use a long, unique password stored in a password manager, so the code is not your only protection.
• Lock down your mobile account with a carrier PIN and port-out protection.
• Enable account alerts for logins and password changes if the service offers them.
• Tell the provider you want stronger options, and check back occasionally, because support improves over time.

For accounts that matter a great deal, such as money or primary email, favor providers that support stronger methods when you have a choice.

Helping Family and Less Technical Users

If you are setting this up for parents or relatives, simplicity matters more than perfection. A method people understand and keep using beats a stronger one they abandon. Passkeys can be easier than codes for many people, because they unlock with the same fingerprint or face scan used for the phone.

Write down a simple recovery plan and keep it in a safe place. Include which accounts matter most, where backup codes are kept, and who to call if a phone is lost. Review it together once a year.

Which Should You Choose? A Quick Guide

Situation	Suggested approach
Main email account	Passkey or hardware security key; authenticator app as a fallback
Banking and finance	Passkey or security key if offered; otherwise an authenticator app
Cryptocurrency or high-value accounts	Hardware security keys, two of them, with backups stored safely
Social media and everyday accounts	Passkey or authenticator app
Work accounts	Follow your employer’s policy; ask whether phishing-resistant options are available
Service only offers SMS	Enable it, protect your phone number, and ask the provider for better options
Low-risk accounts you rarely use	Authenticator app or SMS is acceptable; do not skip 2FA

 

How to Switch Away From SMS: Step by Step

1. List your important accounts. Start with email, then banking, cloud storage, social media and anything that can reset other accounts.
2. Begin with your email. It is the key to account recovery for almost everything else.
3. Check what each service supports. Look in the security settings for passkeys, security keys and authenticator apps.
4. Add the stronger method before removing SMS. Never delete your only working second factor until the new one is tested.
5. Register a backup. Add a second security key or a second device, and save the backup codes the service provides.
6. Store backup codes safely. Keep them in a password manager or printed copy in a secure place, not in an unprotected note on your phone.
7. Test signing in. Sign out and sign back in using the new method to confirm it works.
8. Remove SMS where allowed. If the service lets you, disable SMS as a sign-in option and as a recovery option.
9. Review recovery settings. Make sure password reset does not fall back to a weak method that undoes your work.

Protect Your Phone Number Anyway

Even if you move most accounts off SMS, your number may still be linked to some of them, and it can be misused to impersonate you. Take a few steps with your carrier.

• Set an account PIN or passcode that is not your date of birth or a number tied to your identity.
• Turn on any port-out or SIM lock protection your carrier offers.
• Ask whether the carrier notifies you of SIM change requests.
• Be cautious about carrier app and eSIM settings, since attackers can abuse self-service tools if your account is weakly protected.
• If your phone suddenly loses service unexpectedly, contact your carrier immediately.

Rules and protections differ by country, so check what your carrier and regulator offer.

A Hypothetical Example

The following is an illustration, not a real case. Imagine a person whose email account uses SMS codes. A criminal collects their name and phone number from a data leak, convinces the carrier to move the number to a new SIM, and requests a password reset. The code arrives on the criminal’s device, and the email account is taken over. From there, the criminal resets other accounts that use that email address.

If the email account used a passkey or security key instead, the reset would not have worked with the phone number alone. That is the practical difference between a code you can receive and a credential tied to a device you hold.

Plan for Losing Your Phone or Key

Recovery is the weak point of many security setups. Before you rely on a new method, plan for loss.

• Register more than one security key or device where the service allows it.
• Keep backup codes offline or in a trusted password manager.
• Know how your authenticator app backs up, and whether it can move to a new phone.
• Keep your password manager and email protected with your strongest method.
• Review account recovery options, since a weak recovery path can bypass strong sign-in.

A secure setup that you cannot recover is a risk too. Spend ten minutes testing recovery, and you will thank yourself later.

Common Mistakes

• Removing SMS before testing the new method. You can lock yourself out.
• Having only one security key. Losing it could mean losing access.
• Ignoring email security. Email is often the master key for everything else.
• Trusting any code request. Never share a code with anyone who contacts you, including callers claiming to be support.
• Approving unexpected push requests. Deny and change your password.
• Treating app codes as phishing-proof. Always check the web address before signing in.
• Skipping backup codes. They are your safety net when a device is lost.
• Giving up on 2FA because it is not perfect. An imperfect second factor still beats a password alone.

What Businesses Should Know

If you manage accounts for an organization, the direction of official guidance is clear. CISA’s fact sheet recommends phishing-resistant authentication, and NIST’s digital identity guidelines require it at the highest assurance level and, in the revised version, expect an option to be offered at the middle level too, according to published summaries. Where an application cannot yet support FIDO, CISA suggests number matching as an interim control and tracking the risk.

A practical rollout starts with administrators, executives and anyone with access to money or sensitive data, then expands. Offer more than one option, plan for lost devices, and retire SMS and voice codes for high-risk access.

Conclusion

The best alternative to text message 2FA depends on the account and the service, but the order of preference is simple: passkeys and security keys first, then an authenticator app, then number-matching push, and SMS only when nothing else is available. The key is to add the stronger method, back it up, test it, and then retire SMS.

Start today with your main email account. Check its security settings, add a passkey or authenticator app, save backup codes, and protect your phone number with your carrier. Then work through your other important accounts.

Frequently Asked Questions

Is SMS 2FA still safe to use?

It is better than no second factor, but it is the weakest common option because of SIM swapping, phishing and interception. Use it only when nothing stronger is available, and move to a passkey, security key or authenticator app when you can.

What is the most secure alternative to SMS 2FA?

Passkeys and hardware security keys, which use FIDO standards, are considered the most phishing-resistant options by CISA. A hardware key is generally the strongest choice for high-value accounts.

Are authenticator apps safe?

They are much safer than SMS because codes are created on your device and are not affected by SIM swaps. They are not phishing-resistant, though, because a fake site can capture and relay a code.

What happens if I lose my phone?

That depends on your preparation. Keep backup codes, register a second device or key, and know how your authenticator app backs up its data. Test recovery before you need it.

Do I need a hardware security key?

Not for every account. Most people do well with passkeys and an authenticator app. Consider keys for email, finance, cryptocurrency and work accounts, and buy at least two.