MFA decision guide

Passkeys vs Security Keys vs Authenticator Apps

The best MFA program considers phishing resistance, user experience, recovery risk, administrator exceptions, and rollout practicality together.

PasskeysSecurity KeysMFA

When this helps

What this covers

Authenticator apps are stronger than SMS but still phishable in real-time attacks.
Security keys provide strong phishing resistance for administrators and high-risk users.
Passkeys can improve both usability and phishing resistance when recovery workflows are mature.

Decision matrix

Use this matrix to identify the best fit before turning the decision into a technical implementation plan.

Method	Phishing resistance	Operational strength	Main weakness	Best fit guidance
Authenticator app TOTP	Medium to low; codes can still be proxied in real time.	Easy to deploy and familiar for users.	Phishable, recovery abuse, shared-seed handling.	Good baseline, but not enough for administrators or high-risk users.
Push MFA with number matching	Medium; stronger than simple push but still social-engineerable.	Good usability and broad workforce fit.	MFA fatigue, device compromise, weak recovery workflows.	Good standard method when paired with risk controls and controlled enrollment.
FIDO2 security keys	High; strong origin binding and phishing resistance.	Excellent for admins and high-risk users.	Hardware logistics, backup keys, support process.	Best fit for privileged users, finance, executives, and sensitive systems.
Passkeys	High when implemented with strong recovery and device controls.	Strong usability with modern platform support.	Recovery, sync trust, enrollment governance, mixed ecosystem support.	Best fit for broad rollout when identity governance and recovery controls are mature.
SMS OTP	Low.	Very easy to roll out.	SIM swap, carrier fraud, phishing, delivery reliability.	Use only as a temporary fallback or lower-assurance transition method.