Comparison
TOTP vs SMS: which second factor should you choose?
Compare authenticator codes and text messages across phishing resistance, account recovery, travel, and everyday convenience.
SMS depends on your mobile account
SMS verification sends a code through the telephone network to a number registered with your account. It is familiar and requires no authenticator setup, but it adds dependencies: mobile coverage, roaming, message delivery, and control of the phone number.
Attackers sometimes target the mobile account itself through SIM-swap or number-porting fraud. Carrier protections have improved in many places, but the risk is outside the control of the website you are signing into.
TOTP keeps generation on your device
TOTP codes are calculated from a secret already stored in the authenticator. They work without cellular coverage and do not reveal a phone number to the service. Moving to a new phone, however, requires a secure transfer, encrypted backup, or re-enrolment with each service.
Neither SMS nor TOTP automatically protects against real-time phishing. If you type a current code into an attacker-controlled page, it may be used immediately. Always verify the domain before entering credentials.
- Choose TOTP over SMS when both are available and stronger methods are absent.
- Protect your authenticator backup with a strong, unique password.
- Keep recovery codes offline so a lost phone does not become a lockout.
Where passkeys and security keys fit
Passkeys and FIDO security keys bind authentication to the legitimate website. A fake domain cannot ask the browser or key to authenticate as the real one, which makes these methods substantially more resistant to phishing.
For high-value email, password-manager, financial, developer, and cloud-administration accounts, prefer a phishing-resistant option when available. TOTP remains a useful fallback and a major improvement for services that still offer only passwords, SMS, or authenticator codes.