Pair your authenticator app with a password manager like NordPass for complete account security — it generates and stores strong passwords while you handle 2FA codes separately.

{"type":"result","subtype":"success","is_error":false,"api_error_status":null,"duration_ms":25448,"duration_api_ms":26941,"ttft_ms":2851,"ttft_stream_ms":1978,"time_to_request_ms":273,"num_turns":1,"result":"

How Security Keys and Authenticator Apps Actually Work

\n

Before choosing between the two, it helps to understand the mechanics. An authenticator app like Google Authenticator, Microsoft Authenticator, or Authy generates a time-based one-time password (TOTP) — a six-digit code that refreshes every 30 seconds using a shared secret stored on your phone. A hardware security key, by contrast, uses public-key cryptography based on the FIDO2/WebAuthn standard. When you register a key with a service, it creates a unique cryptographic key pair; the private key never leaves the device, and authentication happens with a physical tap rather than a code you type.

\n

This distinction matters more than most people realize. TOTP codes can be phished — if a fake login page tricks you into entering your code, an attacker can replay it within the 30-second window. A FIDO2 security key is bound to the exact domain it was registered with, so even a pixel-perfect phishing site simply cannot complete the handshake. That single property is why security keys are considered phishing-resistant and authenticator apps are not.

\n\n

The Data: Why Phishing Resistance Wins

\n

Google famously rolled out hardware security keys to all 85,000+ employees and reported zero successful account takeovers via phishing afterward — down from a steady stream of incidents the year before. Microsoft's research has repeatedly shown that any form of MFA blocks more than 99.2% of automated account-compromise attacks, but the residual risk almost always traces back to phishable methods like SMS and, to a lesser degree, TOTP codes.

\n

Here is how the common second factors stack up in 2026, from weakest to strongest:

\n

\n
• SMS one-time codes — better than nothing, but vulnerable to SIM-swapping and interception. Avoid where alternatives exist.
\n
• Authenticator app (TOTP) — strong against credential stuffing and bulk attacks; still phishable by a determined adversary.
\n
• Push-based approval — convenient, but susceptible to \"MFA fatigue\" attacks where users approve a flood of prompts.
\n
• Hardware security key (FIDO2) — phishing-resistant, the current gold standard for high-value accounts.
\n
• Passkeys — the consumer-friendly evolution of FIDO2, increasingly built into phones and password managers.
\n

\n\n

When an Authenticator App Is the Right Choice

\n

Security keys are excellent, but they are not always the practical pick. An authenticator app makes more sense when you need to protect dozens of lower-risk accounts, when budget is a concern, or when you frequently log in from devices without USB-A, USB-C, or NFC support. Apps are free, instant to set up, and work offline. For most people securing a streaming service, a forum login, or a secondary email, TOTP is a perfectly reasonable and meaningful upgrade over a password alone.

\n

A few practical tips to get the most from your authenticator app:

\n

\n
• Save your backup codes the moment you enable MFA, and store them offline — printed or in an encrypted vault.
\n
• Choose an app with encrypted cloud backup so a lost phone doesn't lock you out of every account.
\n
• Never screenshot a QR setup code and leave it in your camera roll, where malware or a cloud sync could expose it.
\n

\n\n

When to Invest in a Hardware Security Key

\n

Reserve security keys for the accounts that would cause the most damage if breached: your primary email (the reset hub for everything else), your password manager, your financial and crypto accounts, and any admin or developer dashboards. A pair of keys from a reputable maker typically costs between $25 and $70 each. Always register at least two — one to carry and one to store safely as a backup — so you are never locked out if one is lost.

\n

For the strongest setup in 2026, many security professionals adopt a layered approach: a hardware key as the primary factor for critical accounts, an authenticator app for the broad middle tier, and passkeys wherever a service supports them natively.

\n\n

The Bottom Line

\n

There is no single \"best\" MFA method for every situation — the right answer depends on the value of what you are protecting. Use a hardware security key for your most sensitive accounts, lean on an authenticator app for everyday logins, and retire SMS codes wherever you can. Whichever you choose, pairing strong MFA with unique, generated passwords from a trusted password manager closes the loop on account security and makes you a dramatically harder target than the average user.

","stop_reason":"end_turn","session_id":"6430f954-de46-44a5-ad13-2feb770b9296","total_cost_usd":0.115708,"usage":{"input_tokens":8492,"cache_creation_input_tokens":2319,"cache_read_input_tokens":15362,"output_tokens":1660,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":2319,"ephemeral_5m_input_tokens":0},"inference_geo":"not_available","iterations":[{"input_tokens":8492,"output_tokens":1660,"cache_read_input_tokens":15362,"cache_creation_input_tokens":2319,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":2319},"type":"message"}],"speed":"standard"},"modelUsage":{"claude-haiku-4-5-20251001":{"inputTokens":787,"outputTokens":18,"cacheReadInputTokens":0,"cacheCreationInputTokens":0,"webSearchRequests":0,"costUSD":0.0008770000000000001,"contextWindow":200000,"maxOutputTokens":32000},"claude-opus-4-8[1m]":{"inputTokens":8492,"outputTokens":1660,"cacheReadInputTokens":15362,"cacheCreationInputTokens":2319,"webSearchRequests":0,"costUSD":0.114831,"contextWindow":1000000,"maxOutputTokens":64000}},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","uuid":"ffe23114-49f4-468d-8e83-9d21b60a2c61"} {"type":"result","subtype":"success","is_error":true,"api_error_status":401,"duration_ms":792,"duration_api_ms":0,"num_turns":1,"result":"Invalid API key · Fix external API key","stop_reason":"stop_sequence","session_id":"cb68fcaa-7d7d-4490-9ffa-a27d16f60baf","total_cost_usd":0,"usage":{"input_tokens":0,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":0,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":0,"ephemeral_5m_input_tokens":0},"inference_geo":"","iterations":[],"speed":"standard"},"modelUsage":{},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","uuid":"6ae6f9b7-fe9f-46ce-9d25-f3348b0d17fc"}