Two-factor authentication: which second factor to choose
Why the type of second factor matters
Two-factor authentication protects you by requiring something beyond your password. But the different methods resist different attacks. The most common real-world threat is phishing — a fake login page that captures whatever you type. Against that, the method matters enormously: a code you can be tricked into typing is far weaker than a key that simply refuses to authenticate to the wrong site.
That single distinction — can this factor be relayed by a phishing page? — is the most useful lens for choosing. It separates SMS and app codes (relayable) from hardware keys and passkeys (bound to the real site and effectively unphishable).
A sensible order of preference
For most accounts, an authenticator app is the right default: free, offline, and far stronger than SMS. Move your important accounts — email, banking, your password manager — to a hardware key or passkey where offered, because those are the accounts whose compromise unlocks everything else.
Keep SMS only where nothing else is supported, and treat it as better-than-nothing rather than safe. Wherever you enable two-factor, save the recovery codes somewhere durable; being locked out of your own account is the failure mode people actually hit.