The two are usually ranked as better and worse versions of the same thing. They are built differently, and the difference is not about cryptography.
A TOTP code is computed on your device, from a secret stored there. It never travels.
An SMS code is generated by the service and delivered to a phone number. It travels across networks you do not control, to an address that someone else administers.
Everything that follows comes from that.
Why the delivery route is the problem
A phone number is not a possession. It is an entry in a database at a mobile operator, and that entry can be changed by a person at a support desk.
The attack has a name and no technical requirement: a convincing caller persuades the operator to move the number to a new SIM. From that moment, every code the service sends arrives on someone else's phone, and the codes are perfectly valid.
Nothing is broken. The system does exactly what it was designed to do, for the wrong person. And the defence has to be mounted by an operator employee under time pressure, which is not a defence you control.
Delivering a secret to an address is a different act from computing it where you stand. The box is not the weakness. The weakness is that its contents belong to whoever the postal system currently believes lives there.
What TOTP actually fixes, and what it does not
Fixes: the delivery problem entirely. There is no message, no network hop, no operator, and no support desk to talk into anything. The secret sits on your device and the six digits are arithmetic.
Does not fix: phishing. A convincing fake login page can ask for those six digits and relay them to the real service inside the thirty-second window. TOTP has no idea which site it is being read to.
That limit is not a detail. It means TOTP removes one entire attack class and leaves the most common one standing. The technology that closes it is the passkey, because it is bound to the domain and will not be offered on a page with the wrong address.
Where the criticism of SMS goes too far
Read enough security writing and SMS starts to sound worthless. It is not.
Against the attack most people actually face, a password stolen in a breach and tried in bulk, SMS stops it cleanly. The attacker has your password and no way to receive the code.
It fails against a targeted attacker who knows your number, your operator, and is willing to spend twenty minutes on the phone.
Those are very different threat models, and conflating them produces bad advice in both directions. If SMS is the only second factor a service offers, turn it on today.
The practical order
- Passkey where available. Removes phishing, which is the attack that works.
- TOTP app where it is not. Removes the SIM swap route.
- SMS where nothing else exists. Far better than a password alone.
- Check what stayed enabled underneath. Many services keep SMS as a recovery path after you add an app, so the weaker route is still live whether or not you use it. That check is worth more than the choice above it.
Before you remove anything
Confirm you can still get in. An account you cannot recover is worse than an account with a slightly weaker second factor, and that trade gets made backwards constantly by people tidying up their security on a Sunday evening.
Write down the recovery codes, store them somewhere that is not the device holding your authenticator, and only then remove the old method.
★ Audit Cure53 2024 · ✓ Plan gratuit · Cross-platform
A manager with built-in 2FA & passkeys → NordPassStore TOTP & passkeys · XChaCha20 · free tier→Frequently asked questions
What is the difference between TOTP and SMS 2FA?
A TOTP code is computed on your device from a secret stored there, so it never travels anywhere. An SMS code is generated by the service and delivered across the mobile network to a phone number. That is the whole structural difference and it produces every practical consequence: one depends on possession of a device, the other on control of a number, and those are not the same thing.
Why is SMS 2FA considered weak?
Because a phone number can be transferred to someone else without any technical skill. A convincing caller persuades a mobile operator to move the number to a new SIM, and every code then arrives on the attacker's phone. This is called SIM swapping and it targets the support desk rather than the cryptography. SMS traffic can also be intercepted on some networks, but the operator route is the one that actually happens.
Is SMS 2FA better than no 2FA?
Substantially better, and this deserves to be said plainly because the criticism of SMS often reads as though it were worthless. Against a stolen password from a data breach, SMS stops the attack. Against someone who has specifically targeted you and is willing to call your operator, it does not. If SMS is the only second factor a service offers, turn it on.
Can an authenticator app be phished?
Yes, and this is the honest limit of TOTP. A convincing fake login page can ask for the six digits and relay them to the real service within their validity window. TOTP removes the SIM swap risk and does not remove phishing. The technology that removes phishing is the passkey, because it is bound to the domain and simply will not be offered on the wrong one.
Should I remove SMS once I have set up an authenticator app?
Check first, because on many services SMS stays enabled as a recovery method even after you add an app, which means the weaker route is still live whether you use it or not. Removing it is usually right, and only after you have confirmed you can still get in another way. An account you cannot recover is worse than an account with a slightly weaker second factor.
