Text message codes vs authenticator apps: which is safer?
In short
- Any second step beats none, but the NCSC says text messages aren’t the most secure kind.
- Authenticator apps don’t need a signal or a text to arrive, and can’t be redirected by a SIM swap.
- Since 2026 the NCSC recommends passkeys wherever a service offers them.
Two-step verification adds a second check after your password. How that second check reaches you matters.
Text messages
The UK’s National Cyber Security Centre (NCSC) says text messages aren’t the most secure type of 2-step verification, but still offer a huge advantage over none. One weakness: if someone moves your number to their SIM, the texts go to them. See SIM swap fraud.
Authenticator apps
An app such as Google Authenticator or Microsoft Authenticator makes the codes on your phone. The NCSC points out they don’t need a mobile signal or a wait for a text. Amazon, eBay and Uber all let you use one.
Passkeys
In 2026 the NCSC began recommending passkeys wherever a service supports them, and 2-step verification where it doesn’t. Its reasoning: codes, whether by text or app, can still be phished, while passkeys resist that.
Don’t forget backups
Save backup codes when an app offers them, in case you lose your phone. See backup and recovery codes.
Where one-time numbers fit
A one-time number from ReserveSMS is for a code you need once. Never make it the number your two-step codes go to: add an authenticator app or passkey instead.
Common questions
Are text message codes safe?
Safer than nothing. The NCSC says they still offer a huge advantage over no 2-step verification, but aren’t the most secure kind.
Why is an authenticator app safer than SMS?
The codes are made on your phone, so they don’t depend on a signal or a text, and a SIM swap can’t redirect them.
What does the NCSC recommend now?
Passkeys wherever a service supports them, and 2-step verification where it doesn’t.