One-Time Passwords: How SMS Codes, App Codes and Keys Differ
A six-digit code looks the same whichever way it reaches you, but texts, authenticator apps and hardware keys protect you in quite different ways.
The basic idea
A one-time password is a password that is valid for only one login session or transaction. Because it cannot be reused, a code that leaks after it has been used is worthless to an attacker. That is the whole appeal: even if your ordinary password is stolen, the thief also needs the fresh code.
Where OTPs fit in two-step login
Multi-factor authentication asks for two or more different kinds of evidence: something you know, such as a password; something you have, such as a phone or key; and sometimes something you are, such as a fingerprint. A one-time code is the usual way of proving "something you have".
The code can reach you in three common ways, and they are not equally strong.
1. Codes by text message
The service generates a code and texts it to your number. It is easy because almost every phone can receive it, and it is far better than nothing. Its weakness is that the code travels over the phone network and is tied to your number, so anyone who takes over the number can receive it too. See the piece on number porting and SIM swaps.
2. Codes from an authenticator app
Here the code is calculated on your device. A common method is the time-based one-time password, where the app and the service share a secret during setup and each combines it with the current time to produce the same short-lived code. Nothing is sent over the phone network, so a stolen phone number alone does not reveal it, and it works without signal.
3. Security keys and passkeys
A physical key or a passkey stored on your device proves possession with cryptography rather than with a code you type. Its big advantage is that it checks which website is asking, so it will not hand anything to a lookalike page.
Which one should you use?
- For email, your phone's account, password managers and anything holding money, choose an authenticator app or a key where the service allows it.
- Keep SMS as a backup method rather than the only one, if the service lets you choose.
- For low-value accounts, SMS codes are still a sensible step up from a password alone.
Save your recovery codes
Most services give you backup codes when you turn on two-step login. Store them somewhere you can reach without your phone, such as a password manager on another device or a printed copy kept safe. Losing your phone without them can mean a long and uncertain account recovery.
The limit of every code
A code proves you were present; it cannot judge where you typed it. If you enter a code into a convincing fake page, the attacker can relay it to the real site within seconds. That is why the habit of checking the address before you type matters as much as the code itself.
No legitimate support agent needs your one-time code. Anyone asking for it is trying to log in as you.