MFA Methods Compared: TOTP, SMS, Passkeys, and More

Not all multi-factor authentication (MFA) methods deliver the same security, user experience, or implementation cost. Time-based One-Time Passwords (TOTP) require no external service and works offline. Passkeys are phishing resistant in ways that SMS and email codes are not. SMS is familiar to nearly every user but depends on carrier reliability and carries real per-message costs. 

This guide compares the most common MFA methods — TOTP, SMS, email, voice, and passkeys — on security, phishing resistance, usability, and deployment complexity, with implementation examples using FusionAuth.

What Is Multi-Factor Authentication (MFA)?

Multi-factor authentication requires users to verify their identity using at least two independent factors from different categories: 

• Something they know (a password or PIN)
• Something they have (a phone or hardware key)
• Something they are (a fingerprint or face scan)

Requiring at least two factors means a compromised password alone is not enough for an attacker to gain access.

MFA Methods Compared

TOTP (Time-Based One-Time Passwords)

TOTP is the most widely deployed software MFA method for web and mobile applications. During enrollment, the server and an authenticator app share a secret key. The app generates a 6-digit code every 30 seconds, derived from that shared secret and the current timestamp. This behavior is defined in RFC 6238.

The main advantages are simplicity and cost. TOTP requires no external service, no SMS gateway, and no per-message fee. Codes work offline, which makes TOTP reliable in low-connectivity environments. The ecosystem of compatible apps is broad. Google Authenticator, Microsoft Authenticator, Authy, 1Password, and LastPass Authenticator all implement the same standard, so any TOTP-compliant app works with any TOTP-compliant server.

The one limitation is phishing resistance. A user can be socially engineered into entering a valid TOTP code on a fake site, and that code remains valid for 30 seconds, long enough to replay. TOTP is significantly stronger than a password alone, but it is not phishing resistant in the strict FIDO2 sense.

FusionAuth supports TOTP on all plans, including the free Community plan.

SMS Authentication

SMS delivers a one-time passcode to the user's registered phone number. No app installation is required, which makes SMS the most familiar second factor for broad consumer audiences.

The practical disadvantages are well documented. SIM swapping, where an attacker convinces a mobile carrier to transfer a victim's number to an attacker-controlled SIM, can redirect SMS messages entirely. Carrier delays cause codes to arrive late or out of sequence, generating support volume. Each message carries a per-transaction cost tied to an external provider.

NIST SP 800-63B classified SMS as a "restricted" authenticator due to these risks and advises organizations in high-assurance environments to use stronger alternatives.

FusionAuth integrates natively with Twilio and also supports a generic messenger interface for other SMS providers. SMS MFA is available on Starter and Enterprise plans.

Email MFA

Email MFA sends a one-time link or code to the user's registered email address. It requires no app, no phone number, and no cost beyond standard SMTP infrastructure, making it the lowest-barrier second factor to deploy.

The security of email MFA depends entirely on the security of the user's email account. If an attacker has already compromised the inbox, email MFA provides no additional protection. It’s also not phishing resistant. For consumer-facing applications where email already serves as the primary account recovery channel, email MFA is a reasonable default. For high-security applications, treat it as a stepping stone toward stronger methods.

FusionAuth supports email MFA via SMTP on Starter and Enterprise plans.

Voice Authentication

Voice MFA calls the user's phone and reads a one-time code aloud. It addresses a real accessibility need for users who cannot receive SMS messages, do not have a smartphone, or have visual impairments that make app-based authenticators difficult. In regulated industries where a phone call is a familiar interaction, voice MFA also faces less user friction than newer methods.

Like SMS, voice MFA depends on an external voice provider and carries per-call costs. It’s also not phishing resistant. Its primary use case is accessibility and fallback coverage, but shouldn’t be the primary MFA method for new deployments.

FusionAuth supports voice MFA via external voice providers on Starter and Enterprise plans.

WebAuthn and Passkeys

WebAuthn is a W3C standard that defines an API for public-key credential-based authentication. During registration, a cryptographic key pair is generated on the authenticator device. The private key never leaves that device. During login, the server sends a challenge, and the authenticator signs it, proving possession without transmitting a secret.

Passkeys are a specific implementation of WebAuthn credentials designed for consumer usability and the foundation of passwordless authentication (The term "passkey" sometimes causes confusion: all passkeys are WebAuthn credentials, but not all WebAuthn credentials are passkeys). Unlike hardware security keys, passkeys can sync across devices via iCloud Keychain, Google Password Manager, or a password manager like 1Password, which makes them practical for everyday users. 

Passkeys are the highest-security MFA option available today and the only method on this list that’s fully phishing resistant. 

Authenticators fall into two categories. Platform authenticators are built into a device, such as Touch ID, Face ID, and Windows Hello. Cross-platform authenticators (also called roaming authenticators) are external hardware security keys like YubiKeys that connect across multiple devices. Both are cryptographically bound to the origin domain, so a passkey registered on app.example.com cannot be used on app-phishing.com. There is no code to intercept or relay. 

FusionAuth supports platform authenticators (such as device biometrics and passkeys) with a free Community license and above. Cross-platform / roaming authenticators (such as hardware security keys and YubiKeys) are supported on the Enterprise plan.

MFA Methods at a Glance

No single MFA method is best for every application. The right choice depends on security requirements, user experience, deployment complexity, and operational cost.

Choosing the Right MFA Method for Your Application

The right MFA method depends on your security requirements, your users, and your infrastructure constraints.

• Start with TOTP if you want the lowest implementation cost and no external service dependency. It’s a strong default for most web and mobile applications, and every major authenticator app already supports it.

• Choose passkeys when your application handles sensitive data or when phishing-resistant authentication is a hard requirement. The user experience (a fingerprint or face scan that replaces both a password and a second-factor code) is better than any other MFA option. The main implementation consideration is WebAuthn support in your client environment, which is now available in all major browsers and most native platforms.

• Use SMS when your user base expects it and when no-app-required enrollment matters more than maximum security. Budget for SMS provider costs and account for delivery delays in your UX. Avoid SMS for applications where account compromise could have severe consequences.

• Enable Email MFA when you have existing SMTP infrastructure and want to reduce the barrier to MFA adoption. Combine it with strong email security guidance for users.

• Integrate Voice MFA as an accessibility fallback, ensuring users who lack smartphones or have specific needs can still authenticate reliably via phone call. 

Intelligent and Risk-Based MFA

Not every login carries the same risk. Intelligent, risk-based MFA adjusts the authentication challenge based on contextual signals such as login location, device fingerprint, time of day, or behavioral anomalies. A user signing in from a recognized browser on their home network might not need a second factor. The same user signing in from an unrecognized device in a new country almost certainly should.

For B2B SaaS products, intelligent, risk-based MFA is often a procurement requirement. Enterprise buyers in financial services, healthcare, and other regulated industries frequently require evidence that MFA can be enforced selectively without degrading the experience for ordinary, low-risk sessions. The key capability to evaluate is per-tenant MFA policy configuration, which enables each customer organization to set its own authentication requirements without custom development.

FusionAuth supports both tenant- and application-level Intelligent MFA policy configurations, allowing different customer organizations (tenants) or individual applications to enforce distinct MFA requirements from a single deployment.

Conclusion

Choosing the right multi-factor authentication method means balancing security, user experience, deployment complexity, and cost. TOTP offers the best combination of security and simplicity for most applications, with no external dependencies, offline operation, and compatibility with every major authenticator app. Passkeys deliver phishing-resistant, passwordless MFA with user experience that no other method currently matches. SMS and email remain practical when broad accessibility and familiarity outweigh the need for maximum security. Voice MFA covers the gap for users who need an alternative to app-based or code-based methods.

FusionAuth supports the full range of MFA methods, from free TOTP on the Community plan to passkeys and WebAuthn on paid tiers — so development teams can implement the level of multi-factor authentication their application actually requires, and expand it as requirements grow.

Frequently Asked Questions

Which MFA method is the most secure?

Passkeys and hardware security keys using the FIDO2/WebAuthn standard are the most secure MFA methods available today. They are cryptographically bound to the origin domain, which makes them immune to phishing attacks, the most common technique used to bypass other MFA factors in real-world breaches. TOTP is the strongest practical alternative for applications that cannot yet support WebAuthn.

Does FusionAuth support passkeys and WebAuthn?

Yes, FusionAuth supports WebAuthn and passkeys. Platform authenticators and biometrics (such as Touch ID, Face ID, and Windows Hello) are supported starting on the free Community plan (version 1.52.0+). Roaming and cross-platform hardware security keys (such as YubiKeys) are supported under the Enterprise plan.

Does FusionAuth work with Google Authenticator, Microsoft Authenticator, and Authy?

Yes. FusionAuth's TOTP implementation follows RFC 6238, which means it is compatible with any standards-compliant TOTP app, including Google Authenticator, Microsoft Authenticator, Authy, 1Password, and LastPass Authenticator. Users can enroll with whichever app they already use.

Can I use my own SMS provider with FusionAuth?

Yes. FusionAuth includes a native Twilio integration and also supports a generic messenger interface that allows teams to connect their preferred SMS provider. SMS MFA is available on Starter and Enterprise plans.

Can I require MFA for some applications but not others?

Yes, on the Enterprise plan. FusionAuth allows you to configure MFA policies at both the tenant level and the application level.

• Per-application MFA policies: On the Enterprise plan, application-level settings override tenant defaults. You can set an application's MFA login policy to Disabled, Enabled, Required, or risk-based (Challenge On Medium/High Risk), as well as configure application trust policies (Any, This Application, or None) directly in the admin UI without custom code.
• Per-tenant MFA policies: On all plans, you can isolate distinct customer organizations or product lines into separate tenants, each with its own default MFA policy.

Can users enroll in more than one MFA method?

Yes. FusionAuth allows users to register multiple MFA methods. A user might configure TOTP as their primary second factor and SMS as a backup, giving them flexibility without reducing the overall security of their account.