# SMS OTP vs authenticator apps

> **Verdict in brief:** Authenticator apps are better than SMS because the code is generated on the device, so a SIM swap or intercepted text can’t expose it. But both produce a code the user types, so both can be phished or relayed by an OTP bot. An authenticator app is an upgrade step, not the end state.

- URL: https://glide-cleartext.pages.dev/compare/sms-otp-vs-authenticator-apps/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

**A. SMS OTP:** A one-time code sent by text message.

**B. Authenticator app (TOTP):** A time-based code generated on the device from a secret shared at enrollment (RFC 6238).

## Comparison table

| Criterion | SMS OTP | Authenticator app (TOTP) |
|---|---|---|
| Where the code comes from | Sent by the service over the phone network | Computed on the device from a shared secret and the time |
| Phishing-resistant | No | No |
| Exposed to SIM swap | Yes | No (stronger) |
| Code travels over a network | Yes | No (stronger) |
| Exposed to OTP bots | Yes | Yes |
| NIST SP 800-63B-4 | Restricted authenticator | Allowed at AAL2 when combined with another factor (stronger) |
| Works without signal | No | Yes, if the device clock is correct (stronger) |
| Setup | Nothing beyond a phone number (stronger) | Install an app and scan a QR code |
| Lost phone | Recover the number through the carrier (stronger) | Secrets are lost unless the app backs them up |

Cleartext comparison. TOTP per RFC 6238[^1]; NIST classifications from SP 800-63B-4[^2].

## Verdict

Moving users from SMS to an authenticator app closes the SIM-swap and interception routes, and it is cheap. It does not close phishing or OTP-bot relay, so treat it as a step toward passkeys, not a replacement for them.

- **Choose SMS OTP when:** Users who can’t or won’t install an app, as a restricted fallback.
- **Choose Authenticator app (TOTP) when:** Workforce and power users where passkeys aren’t yet available, and as an upgrade from SMS.

## Sources

[^1]: RFC 6238: TOTP: Time-Based One-Time Password Algorithm. IETF, 2011-05. https://www.rfc-editor.org/rfc/rfc6238
[^2]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html
[^3]: Implementing Phishing-Resistant MFA (fact sheet). CISA, 2022-10. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf

## Related questions

- [Is SMS OTP still allowed under NIST SP 800-63-4?](https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/)
- [What is phishing-resistant MFA?](https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/)
- [What is a SIM swap attack?](https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/)

## Cite

Cleartext. “SMS OTP vs authenticator apps” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/compare/sms-otp-vs-authenticator-apps/

## Changelog

- 2026-09-24: First published.