Compare the methods
| What matters | Sign In AppTOTPAuthenticator app | PasswordUsed alone | SMSTexted code | EmailCode or link | PushNumber matching | PasskeysSynced | Security keyFIDO2 / WebAuthn |
|---|---|---|---|---|---|---|---|
| Everyday ease | |||||||
| Setup effort | |||||||
| Phishing resistant | |||||||
| No phone number | |||||||
| No delivery wait | |||||||
| No extra hardware |
TOTP · No delivery wait
Codes, even offline.
TOTP generates codes on your device using a shared secret and the current time. The authenticator needs no cellular signal or internet connection to generate a code. The website you sign into still needs a connection.
What does TOTP mean?
TOTP means Time-based One-Time Password: a short-lived verification code calculated from a secret setup key and the current time. Sign In generates these codes on your device, so you do not need cellular service or an internet connection to get a code after setup. The service you sign into still needs to be reachable.
TOTP is commonly used alongside a password as a second factor. It avoids SMS delivery and phone-number takeover risks in the code-generation process, but a live code can still be phished. Passkeys and FIDO2 security keys provide phishing-resistant sign-in. Keep recovery codes or another supported recovery method available whichever option you choose.
Scope and sources
The labels describe typical implementations and are qualitative assessments, not numerical scores or an overall security ranking. SMS, TOTP, and push are generally used alongside a password. The password column is a single-factor baseline; email means a sign-in code or link. Security keys here use FIDO2/WebAuthn, rather than displaying OTP codes.
“No delivery wait” means no separate SMS, email, or push message is needed. It does not mean a website works offline. Passkey syncing and cross-device flows may require connectivity. Recovery and fallback options can weaken any method. NIST does not permit email as an out-of-band authenticator under its guidelines.
- NIST SP 800-63B-4: Authenticator requirements — security classifications and phishing resistance.
- FIDO Alliance: Passkeys — passkey behavior and device support.
- RFC 6238: Time-Based One-Time Password Algorithm — the TOTP definition and algorithm.