Two-factor authentication for crypto: SMS vs. authenticator apps vs. passkeys
Last updated
Two-factor authentication (2FA) means logging in takes something besides your password. For exchange accounts and the email behind them, it’s essential. But not all 2FA is equal.
From weakest to strongest
| Method | How it works | Main weakness |
|---|---|---|
| SMS codes | A code is texted to your phone | SIM swaps and interception |
| Email codes | A code is emailed to you | Only as safe as your email account |
| Authenticator app | An app on your phone generates a code every 30 seconds | You can still be tricked into typing a code on a fake site |
| Passkey | Your device signs you in with a fingerprint, face or PIN | Needs a supported site and a backed-up device |
| Hardware security key | A physical key you tap or plug in | Must keep a backup key |
Best choice: passkeys or a hardware security key wherever an exchange supports them. Both are tied to the real website, so a phishing site can't trick them into working.
Test each method against real attacks
Against a fake login site, only passkeys and hardware security keys hold up: SMS, email and authenticator-app codes can all be typed into the fake site and reused. Against a SIM swap, every second step except SMS holds. Against a leaked password, any second step helps.
How to set it up
- Start with your email. It can reset your other accounts, so protect it first.
- In each exchange’s security settings, turn on the strongest method it offers.
- Remove SMS as a backup method once a stronger one is active, if the site allows it.
- Save the backup codes the site gives you, written down and stored with your important papers, not in a screenshot.
- If you use a hardware security key, register two keys and keep one somewhere safe.
Authenticator app tips
- Use an app that lets you back up or transfer codes to a new phone, and test that the backup works.
- Never type an authenticator code because someone on the phone or in a chat asked you to. Real support never needs it.
What 2FA doesn’t protect
2FA guards accounts, like exchanges and email. It doesn’t protect a self-custody wallet, which is controlled entirely by its seed phrase.