BlogMessaging
Two-factor authentication by SMS: strengths and limits
By Micah Ondiwa, Senior Software Engineer 1 min read
SMS codes are far better than passwords alone, but authenticator apps and passkeys are stronger. Know when each fits.
Adding a second factor to sign-in stops most attacks that rely on stolen passwords. SMS codes are the most familiar option.
Strengths
- Work on any phone, without an app.
- Familiar to users.
- A large improvement over passwords alone.
Limits
SMS codes can be intercepted through SIM-swap fraud or tricked out of users by phishing pages that relay codes in real time.
Stronger options
Authenticator apps and passkeys resist interception better. Offer them, especially for administrators and high-value accounts.
Implementation tips
- Expire codes quickly and allow only a few attempts.
- Rate-limit code requests.
- Never put codes in message previews with other sensitive details.
- Provide a secure recovery path.
See our SMS and security integration work.
About the author
Micah Ondiwa
Senior Software Engineer
Micah Ondiwa writes about software engineering — application architecture, APIs and integration, data and AI-assisted development, and reliable delivery.