Multi-Factor Authentication: Which Method to Choose

Multi-factor authentication adds another proof of identity after a password. The available methods do not all resist attacks equally, but almost any second factor is better than a password alone.

Prefer phishing-resistant options

Passkeys and hardware security keys bind authentication to the legitimate site, making them highly resistant to look-alike login pages. Use them where important accounts support them.

Authenticator apps and text messages

Time-based codes from an authenticator app work offline and avoid phone-number takeover risks. Text-message codes are weaker, but remain useful when stronger choices are unavailable.

Plan for recovery

Register a backup method, store recovery codes securely and add a second hardware key if an account is critical. Never share a one-time code with someone who contacts you.

The bottom line

Begin with your email account because it can reset many other accounts. Then protect financial, work and cloud-storage services.