Authenticator App vs SMS Codes: Which 2FA Should Families Use?

An authenticator app is safer than SMS text codes. The app creates each code on your phone, so a SIM swap can't redirect it to someone else. A SIM swap is when a criminal hijacks your phone number. Text codes are still far better than no second step, so in a family the best method is the one each person will keep using.

Two-factor authentication (2FA) means a site asks for a second proof after your password, usually a short code, so a stolen password isn't enough on its own. Choosing between an authenticator app vs SMS comes down to where that code comes from and who else could get hold of it.

Authenticator app vs SMS at a glance

Here's how the two compare on the things that matter at home:

• SIM swaps: The app wins. Text codes follow your phone number, and thieves can hijack a number.
• Scam calls and fake sites: A tie. A scammer can talk you out of either kind of code, or trick you into typing it on a fake site.
• Setup: SMS wins. There's nothing to install or scan.
• New phone: SMS wins. Texts follow your number, but app codes have to be moved or set up again.
• No signal: The app wins. Its codes work offline, even on a plane.

Passkeys, covered below, beat both wherever a site offers them.

How SMS codes work and how they get stolen

With SMS, the site texts a short code to your phone number, usually six digits. It's simple, which is why it's everywhere. But the code is tied to your phone number, not the phone in your hand, and numbers can be hijacked.

So is SMS 2FA safe? It's far safer than a password alone, and CISA, the US government's cybersecurity agency, recommends turning on 2FA. But text codes are the easiest kind for a thief to steal, usually in one of three ways:

• SIM swaps: A thief moves your number to their phone.
• Fake support calls: A scammer talks you into reading the code aloud.
• Fake login pages (phishing): A lookalike site records your password and code, and the thief uses both within seconds.

SIM swaps and fake support calls

Your SIM card is what links your phone to your number. Many newer phones use an eSIM, which is a digital SIM built into the phone. In a SIM swap, a thief pretends to be you and gets your mobile carrier to move your number to their own SIM or eSIM. From then on, every text you're sent goes to them, including login codes.

The first sign is often that your phone suddenly shows no service. If that happens for no clear reason, call your carrier from another phone right away.

A fake support call needs no technical skill. The caller says they're from your bank, your carrier, or a "fraud team" and asks you to read back the code you just got. That code is really the thief signing in to your account at that moment.

Our guide to verification code scams explains the other common tricks.

How to add SIM swap protection

Whatever method you use, these steps lower your SIM swap risk:

• Ask your carrier to add a PIN or passcode that's needed before anyone can change your account.
• Ask about number lock or port-out protection, which stops your number from being moved to another phone or carrier without extra checks.
• Don't make your phone number the only way to recover your email or bank accounts.

How authenticator apps work

An authenticator app, such as Google Authenticator or Microsoft Authenticator, shows a six-digit code that changes about every 30 seconds. To set one up for an account, you scan a QR code (a square barcode) that the site shows you. You do this once for each account.

The scan gives the app a shared secret, which is a hidden key that only the app and the site know. The app and the site both combine that key with the current time to make the same code. That's why your phone's clock should be set automatically.

Authenticator apps have real tradeoffs, too:

• Codes can still be phished. If you type one into a fake site or read it to a scammer, it's stolen.
• They live on your phone. Lose, break, or wipe your phone without a plan, and you can get locked out.
• There's a learning curve. Some older relatives find the extra app confusing at first.

Some authenticator apps can back up or sync your codes, and some can't. Find out which kind you have before you need it.

Passkeys and security keys: the step beyond codes

A passkey is a newer way to sign in. It usually replaces both the password and the code with a quick Face ID, fingerprint, or screen-lock check. It only works on the real site it was made for, so a lookalike site gets nothing, and there's no code for a scammer to ask for.

A hardware security key is a small device you plug in or tap against a phone. It protects you the same way and makes a good backup if a phone goes missing.

Where a site offers passkeys, they're usually the best 2FA method available, but many sites don't offer them yet. Our plain-English guide to passkeys shows how they work, and passkey vs 2FA explains how they compare with codes.

Pinzen, our family password manager, has no account password to forget or phish. You sign in with a passkey, Google, or a one-time email link. To reveal a saved password, PIN, or card number, you approve with Face ID, a fingerprint, or a code from an authenticator app.

Choosing a method for each family member

Two-factor authentication for family members works best when the method fits the person. The right choice between an authenticator app and text message codes is often different for a teen than for a grandparent.

Teens

Teens handle apps easily but replace phones often. Use passkeys where they're offered and an authenticator app everywhere else, and save backup codes where a parent can find them.

A teen's email account matters most, because it can reset almost every other account. Teach them that a friend asking for a code is a red flag: the friend's account has probably been hacked.

Busy parents

Start with email, banking, and your password manager, using passkeys or an authenticator app. Then work through your other accounts.

One catch: an app won't stop a SIM swap if the site still offers "text me a code instead." If your email or bank lets you turn off that text option, consider doing it. Save your backup codes first, because it removes one way back into your account.

Grandparents and older parents

For many older adults, simple wins. A passkey with Face ID or a fingerprint is often the easiest option of all, because there's nothing to read or type.

If a site doesn't offer passkeys and an app would just cause frustration, text codes are a sensible choice. They keep working on a new phone as long as the number stays the same.

Set it up together, and teach one rule: never give a code to anyone who contacted you first.

Getting a new phone without getting locked out

A new phone is a common time to get locked out, because your authenticator codes are on the old one. Follow these steps in order:

1. Keep the old phone working. Don't erase it, trade it in, or hand it down yet.
2. Changing numbers? Update your accounts first. Add the new number while the old one still works, because signing in may need a code sent to the old number. Carriers eventually give old numbers to new customers, so any account you forget to update could send your codes to a stranger.
3. Move your authenticator codes. If your app can transfer or restore codes on the new phone, do that.
4. If not, set up 2FA again. Go to each important site's security settings and connect the authenticator app on your new phone. Start with email.
5. Test every account. Sign out and back in with the new phone before moving on.
6. Only then erase the old phone.

If the old phone is already lost, you'll need backup codes, which are covered next. For passkeys, see what happens to passkeys if you lose your phone.

Where to keep backup codes

When you turn on 2FA, many sites offer backup codes. Each one works once and gets you in if your phone is gone.

Good places to keep them:

• On paper, somewhere safe. A labeled envelope in a home safe or locked drawer is out of reach of online thieves.
• A second copy with someone you trust. A spouse, adult child, or sibling is ideal.
• In a password manager. A secure note in an encrypted vault is easy for you to find and hard for anyone else to read.

In Pinzen, secure notes are kept in vaults, and a family vault lets several adults reach the same codes. Free accounts can join a family vault someone else created; creating one is part of Pinzen+.

Places to avoid:

• A text or email to yourself.
• A screenshot in your camera roll.
• Only on the phone the codes are meant to rescue.

One caution: keep a copy of the codes for your password manager itself outside the vault, plus the codes for the email account that can recover it. Otherwise you could be locked out of the very place you kept them.

The same goes for Pinzen's Recovery Kit, a spare-key file you save during setup. Keep a copy somewhere safe, away from your phone. You can read how vault encryption and recovery work, or create a free vault to see the three setup steps.

Frequently asked questions

Is an authenticator app safer than text message codes?

Yes. An authenticator app creates codes on your phone, so they can't be stolen through a SIM swap or an intercepted text. But app codes can still be stolen through a fake site or a scam call, so never share a code with anyone who contacts you.

Is SMS two-factor authentication still worth using?

Yes. Text codes stop most attacks that rely only on a stolen password, so they're far better than nothing. Use them when a site offers nothing else or when it's the only method someone will actually use. Move email and banking to an authenticator app or passkey when you can.

What happens to my authenticator app if I lose my phone?

Unless your app backs up your codes, they're lost with the phone. Get back in with your saved backup codes or each site's account recovery steps, then set up the authenticator on your new phone. If the phone was stolen, sign it out of your accounts and call your carrier.

Should my parents use an authenticator app?

If they're comfortable with apps, yes, especially for email and banking. If not, a passkey with Face ID or a fingerprint is often easier, and text codes are better than skipping 2FA. Set it up together, save the backup codes, and teach one rule: never give a code to anyone who contacted them first.