SMS codes vs Authenticator apps: what is the difference?

SMS codes vs Authenticator apps in one sentence

SMS codes are one-time numbers sent to your phone by text message, while authenticator apps generate a fresh code on your phone without needing a text or signal.

Side-by-side comparison

What is SMS codes?

With SMS codes, the service texts you a short number when you sign in, and you type it in. It is easy and works on any phone, which is why many banks and shops use it. The weakness is that the code is tied to your phone number. In a SIM swap, a criminal persuades your mobile provider to move your number to their SIM card, and then receives your codes. Texts can also be read on a lock screen.

What is Authenticator apps?

An authenticator app, such as Google Authenticator, Microsoft Authenticator or the code feature in many password managers, creates a new six-digit code every 30 seconds using a secret shared once when you scan a QR code. Because the code is made on your phone, nobody can intercept it in transit or redirect it by stealing your number. You can try the idea with our TOTP tool.

Which one should you use?

Any second step is much better than none, so if SMS is the only option, use it. Where you can, choose an authenticator app for important accounts such as email, cloud storage and social media. Where a service offers passkeys, consider those too, as they resist phishing. Whatever you choose, save the backup codes somewhere safe. Our guide 2-step verification walks through setting it up.

Common mistakes and myths

• "With 2-step verification I cannot be phished." A fake site can ask for your code too; never type a code you did not request.
• Telling anyone your code. No genuine company will ask you to read out a sign-in code.
• Switching phones without moving your authenticator app first.
• "SMS codes are useless." They still stop most password-only attacks.

Learn more

• Strong passwords and MFA
• MFA and passwordless sign-in
• Social engineering