By receive-sms.app · Based on how this directory collects and displays public SMS.
Most accounts now offer more than one way to prove it is really you. The three you will meet most often are a code sent by SMS, a code generated by an authenticator app, and a passkey or hardware security key. They differ a great deal in how much protection they give, how much effort they take, and what happens when you lose your phone. This guide compares them honestly, explains where each one breaks down, and walks through how to move an account from a weaker method to a stronger one without locking yourself out.
What two-factor authentication is for
A password is something that can be guessed, reused across sites, leaked in a breach or captured by a fake login page. Two-factor authentication adds a second proof that an attacker who has only your password does not have. The second factor is usually something you possess, such as a phone or a key. The point is not that the second factor is unbreakable, but that it forces an attacker to compromise two separate things. Different methods raise that bar by very different amounts, which is why the choice matters.
From our team · RevalVIN
Buying a used car?
RevalVIN gives a free VIN preview and pay-per-check history reports: mileage, stolen status, recalls and more. No subscription.
How SMS codes work and why people use them
With SMS two-factor authentication the service sends a short code to your phone number each time you log in, and you type it back. Its great strength is reach: nearly everyone has a phone that can receive a text, there is nothing to install, and it is easy to understand. That is why it is the default for so many services, and why it is still far better than having only a password. A password alone leaves you exposed to every credential leak, whereas an SMS code at least blocks attackers who do not also control your number.
Where SMS falls short
SMS messages are not end-to-end encrypted, and they depend on the phone network and on the carrier that controls your number. An attacker who convinces a carrier to move your number to a different SIM, known as a SIM swap, can receive your codes. Messages can also show on a locked screen, and they can be forwarded by malware on the phone. Finally, SMS is exposed to phishing, since a fake site can ask for the code and pass it to the real site in seconds. NIST's guidance on digital identity treats codes sent over the public telephone network as a restricted authenticator for these reasons.
How authenticator apps work
An authenticator app generates a new code every thirty seconds or so from a secret stored on your device and the current time. This method, called TOTP and described in RFC 6238, is calculated locally, so there is no message to intercept and no phone number to hijack. Setup is usually a one-time scan of a QR code. Because the secret lives on the device, an attacker who merely takes over your number gains nothing. This makes an authenticator app a clear step up from SMS for most people, at the cost of a few minutes of setup.
Where authenticator apps fall short
The main weakness of app codes is that they can still be phished: if you type the six digits into a convincing fake page, the attacker can use them immediately on the real one. The other practical risk is losing the device. If the app is on a phone that is lost, broken or replaced, and you have no backup, you can be locked out. Some apps offer encrypted backups or let you copy the secret to a second device, and services normally provide one-time recovery codes. Store those recovery codes somewhere safe and offline.
How passkeys and security keys work
Passkeys and hardware security keys use public key cryptography, based on the FIDO2 and WebAuthn standards. When you register, your device creates a key pair and gives the service only the public half. At login, your device signs a challenge that is tied to the real website address. Because the signature only works for the genuine site, a fake page gets nothing useful, which makes this method resistant to phishing in a way that typed codes cannot match. You usually approve the login with a fingerprint, face scan, device PIN or a tap on a physical key.
Where passkeys and keys fall short
Passkeys are newer, and not every service supports them yet. Behaviour also differs by platform: some passkeys are stored in a cloud keychain and sync across your devices, which is convenient but makes the security of that account important, while hardware keys are device-bound and can be lost. A physical key costs money, and you should register at least two so one can be a backup. Recovery paths on some services remain weaker than the passkey itself, and an attacker can sometimes target the recovery process instead.
A practical ranking
For most accounts the order from weakest to strongest is: password alone, SMS code, authenticator app, then passkey or hardware security key. That ranking is a general guide, not a law. A passkey on a device you cannot recover may be worse for you than a well-managed authenticator app, and SMS can be acceptable for accounts of low value. Match the method to the stakes: email, banking, cryptocurrency, your domain registrar and your password manager deserve the strongest option, while a forum account does not need the same effort.
How to migrate an account step by step
Log in and open the security or sign-in settings. If a passkey or security key option exists, add it first, and register a second one as a backup. Otherwise enable an authenticator app by scanning the QR code, entering the first code to confirm, and saving the recovery codes. Test the new method in a private window or a second device before you change anything else. Only after that should you remove SMS, or keep it as a last-resort fallback if the service would otherwise leave you without any recovery route.
Where public numbers fit in
A public receive-SMS number can never be a second factor for an account that matters. Anyone can read the messages sent to it, so a code sent there protects nothing. Public numbers have a role only for throwaway sign-ups and for testing software you control. Once an account is worth protecting, move it to an authenticator app or a passkey, and if the service insists on a phone number, use one that only you control, such as your own SIM or eSIM.