Most people think of MFA as "on" or "off." The type you choose matters enormously — here's the real ranking, and why.
Multi-factor authentication means proving who you are with more than just a password — a second factor that, in theory, only you have access to. But "MFA" covers a range of methods with very different real-world strength. Turning on any MFA is better than none, but not all of it holds up equally against a determined attacker.
A code sent to your phone by text message. The core weakness is SIM swapping — a social-engineering attack where someone convinces your mobile carrier to transfer your phone number to a device they control, letting them receive your codes directly. SMS can also be intercepted through vulnerabilities in the telecom network itself. It's still far better than no MFA at all, but it's the method security experts trust least.
Apps that generate a time-limited code directly on your device, without relying on your phone carrier at all — which closes off the SIM-swapping risk entirely. The remaining weakness is sophisticated phishing: a fake login page can prompt you to type in your authenticator code in real time and immediately relay it to the real site, defeating the protection. Still, this closes the most common attack path and is a meaningful upgrade over SMS.
A physical device (like a YubiKey) that you plug in or tap to approve a login. Security keys use cryptographic verification tied to the specific website you're logging into, which makes them resistant to the real-time phishing relay that can defeat authenticator apps — the key simply won't respond to a fake site pretending to be the real one, even if it looks identical.
Upgrading everything to a hardware key at once isn't realistic or necessary. A more useful approach is prioritizing by what an attacker could do the most damage with first:
Start with: your email account (it's often the recovery method for everything else), your password manager, and any financial accounts. These are worth the strongest available method — ideally a hardware key, or at minimum an authenticator app.
Authenticator app is sufficient for: most everyday accounts — social media, shopping sites, subscriptions — where an authenticator app closes off the majority of realistic attack paths without the cost or friction of a physical key.
Always keep backup codes saved somewhere safe for any account you set MFA on — losing your phone or security key shouldn't mean losing access entirely.