Comparison · Identity and access
Passkeys, authenticator apps, hardware keys and text message codes compared
Last updated 25 October 2026 · 2 sources listed · Reading time about 3 minutes
Short answer
Methods differ mainly in how resistant they are to phishing and in how easy they are to deploy and recover. Passkeys and hardware security keys bind sign-in to the genuine site and resist phishing. Authenticator app codes are a solid, widely supported middle option. Text message codes are better than a password alone but are exposed to interception and number takeover, so reserve them as a fallback.
Who this is for: A security or IT lead choosing which multi-factor authentication methods to allow for staff and customers.
What to evaluate
Phishing resistance
Attackers commonly trick users into handing over codes on fake sites.
How to check: Prefer methods that cryptographically verify the site address rather than relying on users to type codes.
User experience
Friction drives workarounds and support calls.
How to check: Pilot with a representative group and measure sign-in time and help desk contacts.
Recovery and loss handling
Lost devices are the most common failure, and weak recovery undermines strong methods.
How to check: Document how a user regains access, and require identity verification for resets.
Device and platform coverage
Not every browser, app or legacy system supports every method.
How to check: Test across your operating systems, shared devices and older applications.
Cost and logistics
Hardware keys require purchasing, distribution and replacement.
How to check: Plan spares, shipping and lifecycle for any physical authenticators.
Fallback exposure
Attackers target the weakest permitted method.
How to check: Audit which fallback methods remain enabled and restrict them for privileged accounts.
Comparison
| Method | Strength | Main weakness |
|---|---|---|
| Passkey on device or password manager | Phishing resistant and convenient | Recovery and cross-device sync need planning |
| Hardware security key | Strong phishing resistance and no battery | Needs distribution and spares |
| Authenticator app one-time code | Widely supported and no carrier involvement | Codes can be phished and relayed |
| Push approval prompt | Easy for users | Fatigue attacks unless number matching is used |
| Text message code | Familiar to everyone | Interception and number takeover risk |
Decision worksheet
Rate up to three options against this guide’s own criteria. It runs in your browser and saves only on this device. It is a thinking aid, not a recommendation.
1. Have you checked each criterion?
0 of 6 criteria checked.
2. Compare options (0 = fails or unknown, 3 = meets it well)
| Criterion | |||
|---|---|---|---|
| Phishing resistance | |||
| User experience | |||
| Recovery and loss handling | |||
| Device and platform coverage | |||
| Cost and logistics | |||
| Fallback exposure | |||
| Total (max 18) | 0 | 0 | 0 |
Questions to ask before you commit
- Which methods does each of our critical applications actually support?
- How do users register a second method so one lost device does not lock them out?
- What identity checks apply when someone requests a reset?
- Can policies require stronger methods for administrators and finance roles?
- How are shared or kiosk devices handled?
- Do customers need different options from staff?
- What is the plan to retire the weakest methods over time?
Typical trade-offs
Phishing-resistant methods only versus allowing familiar codes
- Upside
- Closes the most common takeover route.
- Downside
- Needs broader device support and user education.
Hardware keys for all staff versus only privileged users
- Upside
- Strongest protection everywhere.
- Downside
- Distribution and replacement overhead scales with headcount.
Synced passkeys versus device-bound keys
- Upside
- Synced credentials survive device loss and are convenient.
- Downside
- Security depends on the account that syncs them.
Common mistakes
- Enabling strong methods but leaving text codes as an equal alternative; restrict fallbacks for sensitive roles.
- Approving prompts by habit; enable number matching and train users to deny unexpected requests.
- Ignoring recovery; a weak help desk reset process becomes the attack path.
- Excluding service and legacy accounts; inventory them and apply compensating controls.
Related questions
Are text message codes still acceptable?
They provide a meaningful improvement over passwords alone and may be a pragmatic fallback for consumers or users without other options. However, they can be intercepted through number porting, social engineering of carriers, or relay phishing. For administrators, finance staff and anyone with sensitive access, prefer phishing-resistant methods and limit text codes to carefully controlled recovery cases.
What makes a method phishing resistant?
The authenticator checks the genuine website identity as part of sign-in, so a lookalike page cannot obtain a usable response. Passkeys and hardware security keys built on standards such as FIDO work this way. One-time codes and approvals can be relayed in real time by an attacker proxy, because the user is the one transferring them.
Do passkeys replace passwords completely?
They can, but adoption is gradual. Many services still offer passwords alongside passkeys, and account recovery frequently falls back to email or other methods. For an organisation, the practical path is to enable passkeys where supported, require them for sensitive roles, and tighten recovery so that the remaining password paths do not undermine them. Whatever you decide, write the reasoning down, name who is accountable for the follow-up, and revisit the choice after a realistic trial period so that early assumptions are tested against what actually happens in practice.
How should I roll out a change in methods?
Start with a pilot group and gather feedback, then communicate timelines, provide clear guides and train the help desk. Make users enroll a backup method during rollout, and phase out weaker options with advance notice. Monitor registration and failure data so that stragglers and problem applications are identified before enforcement begins. Whatever you decide, write the reasoning down, name who is accountable for the follow-up, and revisit the choice after a realistic trial period so that early assumptions are tested against what actually happens in practice.
Sources and further reading
These pages were reachable when we last checked. They informed definitions and rules referred to above; they do not endorse this guide. Where rules differ by country, check the authority for your location.
- FIDO Alliance — FIDO Alliance, retrieved 27 October 2026
- Cybersecurity Best Practices — Cybersecurity and Infrastructure Security Agency, retrieved 27 October 2026
Related guides
How to choose · Identity and access
How to choose a single sign-on and identity provider
Choose an identity provider by checking which of your applications support standard federation, how provisioning and deprovisioning work, what authentication methods and policies are available, and how the provider behaves when it fails. The directory you already run, the number of unsupported legacy apps, and your admin capacity shape the best fit more than feature lists do.
Suitability · Identity and access
Does your organisation need privileged access management
Privileged access management becomes worthwhile when powerful accounts are numerous, shared, long-lived or poorly audited. It vaults credentials, issues time-limited access, and records sessions. Smaller environments may achieve much of the benefit with separate admin accounts, strong authentication and just-in-time role activation built into existing platforms before buying a dedicated product.
Problems & fixes · Identity and access
Why former employees keep access and how to close the gaps
Orphaned access usually survives because accounts are created outside central identity, ownership is unclear, and offboarding depends on manual steps across many tools. Fix it with a single authoritative trigger from HR, central sign-in for as many apps as possible, regular access reviews, and a reconciled list of accounts that bypass single sign-on, such as shared logins, API keys and personal-email registrations.
Requirements · Endpoint protection
Endpoint protection requirements for remote work, personal devices, Mac and Linux
Set requirements by device role rather than by operating system alone. Every device touching company data needs encryption, automatic updates, a screen lock and the ability to be located or wiped. Managed company devices add endpoint agents and central policy, while personal devices rely on app-level controls. Linux servers and Mac laptops need explicit coverage, not assumed immunity.
Comparison · Backup and recovery
Backup vs replication vs file sync vs snapshots
Backup keeps independent, versioned copies you can roll back to. Replication mirrors data to another site for fast failover but copies mistakes and corruption. File sync keeps files consistent across devices and also propagates deletions. Snapshots capture a point in time on the same storage and are fast but share its fate. Strong protection combines mechanisms rather than treating them as interchangeable.
How to choose · Backup and recovery
How to choose a business backup solution
Choose backup by what you must restore and how fast, then test it. Look for protection of every data source including cloud applications, immutable or offline copies that attackers cannot erase, separate credentials from your main environment, encryption, and restore testing you can actually perform. A backup that has never been restored is an assumption, not a control.
Comparison · Network security
Traditional VPN vs zero trust network access for remote staff
A traditional remote-access VPN places a user's device on the internal network, so a compromised laptop can reach much more than it needs. Zero trust network access verifies user and device for each application and grants only that access. The second model limits lateral movement but needs good identity, device inventory and application mapping, so many organisations adopt it in stages.