Updated 5 November 2026

Authenticator app vs SMS: which second factor is safer?

A small sealed paper letter beside a brass hourglass with an antique key between them, on cream handmade paper.

Short answerAn authenticator app is safer than SMS. Its codes are calculated on the phone, so SIM swap and SS7 attacks do not apply, while SMS codes can be redirected. Both can be phished in real time, which only FIDO security keys resist.

In the authenticator app vs SMS comparison, the app is the safer second factor. Its codes are calculated on the phone from a secret key and the clock, so there is no text message to redirect or intercept. Neither method stops a fake login page that passes the code on at once. Of the widely available methods, only FIDO/WebAuthn, such as a security key, resists that. A code sent by SMS is still far better than having no second factor.

NIST's SP 800-63B-4 Digital Identity Guidelines, published in July 2025, name sending a code over the public telephone network as the one restricted authenticator. They also state that one-time codes are not phishing-resistant, whether they arrive by SMS or come from an app. The guidance used here is mainly from the US (NIST, CISA) and the UK (NCSC).

Four methods side by side

CISA ranks forms of multifactor authentication by their exposure to phishing, push bombing, SS7 and SIM swap attacks. The table follows that ranking and adds practical limits.

Method	How it works	Real-time phishing	SIM swap and SS7	Other limit
SMS code	Code texted to the registered number	Vulnerable	Vulnerable	Needs mobile coverage
Authenticator app (TOTP)	App calculates a code from a stored secret and the time	Vulnerable	Not applicable	Codes are lost with the phone unless backed up
Push approval	Tap approve in an app	Vulnerable	Not applicable	Push bombing unless number matching is on
FIDO security key	Key proves possession cryptographically, no code is typed	Resistant	Not applicable	Needs a spare or backup codes

CISA puts SMS or voice last and calls it a last-resort option. The UK's National Cyber Security Centre (NCSC) takes a more consumer-minded line: text messages are not the most secure type, but they still give a large advantage over using no second step.

Why SMS is the weak link

An SMS code is only as safe as control of the phone number. In a SIM swap, attackers convince the mobile carrier to move the victim's number to a SIM card they control. SS7 is a second route: CISA says attackers exploit weaknesses in this signalling protocol to obtain codes sent by text or voice. NIST lists the same outcome among its threats: an attacker who has persuaded the operator to redirect the phone receives the SMS code. It also names a malicious app on the phone that reads the code.

NIST's guidelines add conditions. A service must offer an alternative authenticator type, should weigh signs such as a SIM change or number porting before sending a code, and must treat a change of the registered number as binding a new authenticator. Coverage is a limit too: NIST notes that people in areas with limited telephone coverage may not receive codes, and the NCSC lists not needing a mobile signal as an advantage of apps.

What an authenticator app fixes, and what it does not

The standard behind time-based codes is RFC 6238 (TOTP), published in May 2011. The app and the service share a secret key and both calculate the code from that key and the current time. The RFC recommends a default time step of 30 seconds, and a service must not accept the same code twice once it has been validated.

That removes the intercepted-message problem but not phishing. In the attack CISA describes, a fake website mimics a company's login portal and the victim submits the username, password and the 6-digit code from the authenticator app. RFC 6238 itself warns that a code exposed to a third party before it is used can be used within its time-step window. NIST adds that codes typed in by hand are not bound to the session, so an impostor can relay them.

Push approvals and security keys

Push approval avoids typing a code but has an attack of its own. In push bombing, attackers who already hold the password trigger prompt after prompt until the user approves, by accident or out of annoyance (CISA). Number matching, where the user must enter a number shown on the login screen into the app, counters this. CISA still treats it as an interim measure that is not as strong as phishing-resistant MFA, and NIST adds that services should limit how many push notifications are sent.

CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication. NIST defines phishing resistance as keeping secrets and valid authenticator outputs from an impostor website without relying on the user's vigilance. The authenticator can be a separate USB or NFC token or sit inside a laptop or phone, and it can add a PIN or biometric check.

Losing the phone: backups for each method

A lost phone can take the app and the push approvals with it, so recovery has to be arranged beforehand:

Keep two separate means. NIST advises services to encourage at least two, for example a code generator plus look-up secrets such as backup codes, so a lost authenticator does not force a full account recovery.
Print backup codes. The NCSC says each code works once and must be stored somewhere safe. NIST says saved recovery codes are meant to be kept offline, printed or written down.
Check how the app is backed up. Google Authenticator can save codes in a Google Account, which Google says guards against lockout when changing devices. Without an account the codes stay on that device and must be transferred manually.
Move to a new phone cleanly. NIST advises binding the app on the new device to the account and invalidating the old one.
Cover security keys too. Register a second key or keep backup codes.

If the phone is already gone, sign in with a backup code or the second method, then add the new authenticator and remove the old one.

Which method fits which account

Situation	Choice	Basis
Email or admin account that offers a security key	Security key	CISA: strongest form; NCSC: email access lets criminals reset other passwords
Service offers an app	Authenticator app	CISA ranks app-based above SMS
Only SMS is offered	Use SMS rather than nothing	NCSC: large advantage over none; CISA: last resort
Travelling or weak signal	Authenticator app	Google: codes work without internet or mobile service
Push prompts offered	Prefer number matching	CISA

This text summarises guidance from NIST, CISA and the NCSC as of November 2026. Which methods are available depends on each service, and the text is not individual security advice.

Common questions

Is an authenticator app safer than SMS?

Yes. In CISA's ranking, app-based codes sit above SMS or voice. Apps are not open to SIM swap or SS7 attacks, but both methods remain open to phishing that relays the code in real time.

Is SMS two-factor authentication still worth using?

Yes, when nothing better is offered. The NCSC says text messages are not the most secure type but give a large advantage over no second step, while CISA calls SMS or voice a last-resort option.

What is a SIM swap?

A form of social engineering in which attackers convince a mobile carrier to move the victim's phone number to a SIM card they control. Texted codes can then reach the attacker, as CISA and NIST describe.

Do authenticator apps work without mobile signal?

Yes. The code is calculated on the phone from a secret key and the time, and Google says its app generates codes without an internet connection or mobile service. The NCSC lists this as an advantage over SMS.

What happens to the codes if the phone is lost?

Without a backup, access depends on your other methods. Keep single-use backup codes offline and a second method registered; NIST advises services to encourage at least two separate means of authentication.

Sources