# SMS Codes, Authenticator Apps or Passkeys? | ZafeConnect

> Compare SMS one-time codes, authenticator apps and passkeys as a second factor: reach, security, cost and effort, and how to combine them.

Canonical URL: https://www.zafeconnect.com/blog/sms-codes-authenticator-apps-passkeys
Language: en
Last modified: 2026-11-09

## SMS codes, authenticator apps or passkeys? Picking a second factor

URL: https://www.zafeconnect.com/blog/sms-codes-authenticator-apps-passkeys

Published: 2026-11-09

No second factor is best everywhere. The right mix depends on who your users are, what you protect and how much friction they accept.

Key takeaways:
- SMS codes reach almost everyone and need no app, but they are weaker against SIM swap and real-time phishing.
- Authenticator apps do not depend on the phone network, but need setup and can still be phished.
- Passkeys resist phishing and are quick to use, but not every user or device is ready.
- Offer more than one method and match the strength to the risk of the action.

### The three options side by side

 | SMS code | Authenticator app | Passkey
Reach | Almost every mobile phone | Smartphone users who install an app | Modern devices and browsers
Setup effort for the user | Very low | Medium | Low to medium
Depends on the phone network | Yes | No | No
Main weaknesses | SIM swap, interception, real-time phishing, delays | Real-time phishing, lost device | Device loss and recovery, uneven support
Cost per sign-in | A message each time | None | None

### Where SMS is the right answer
SMS is hard to beat for reach and low friction. It works for people who will never install an authenticator, for first-time verification of a phone number, and as a recovery or fallback method.

Standards bodies take a careful view of it. For example, NIST guidance treats codes sent over the telephone network as a restricted method, to be used with an understanding of the risk. For many services that is acceptable, for high-value ones it is not enough alone.

### Where to prefer something else

- High-value actions such as large payments or changes to security settings
- Privileged or administrator accounts
- Users who travel and often have no reliable mobile coverage
- Services that are frequent targets of SIM-swap fraud

### A practical mix

- Offer passkeys or an authenticator app first, with SMS as the universal option
- Use SMS for phone number verification and for recovery
- Raise the requirement for risky actions instead of for every sign-in
- Tell users when their number or security settings change, using a separate channel
- Watch the cost and abuse side of SMS codes, covered in our article on SMS pumping

### How ZafeConnect fits
ZafeConnect delivers SMS one-time codes and other A2P messages to 190+ countries, with intelligent routing and fallback and delivery reports from the operators. How you combine SMS with other factors is a decision for your security team.

FAQ:
Q: Is SMS two-factor authentication still worth using?
A: Yes, for reach and low friction, as one option among several. For high-value actions combine it with stronger methods.

Q: What is a passkey?
A: A sign-in credential based on public-key cryptography that is tied to a website and unlocked with a device, typically using a fingerprint, a face or a PIN. It resists phishing.

Q: Can I drop SMS completely?
A: Only if all your users can use another method. Many services keep SMS for recovery and for users without a compatible device.