Comparison
SMS OTP vs passkeys
SMS OTP vs passkeys: which is more secure?
Passkeys are more secure on every attack that matters for consumer logins: they can’t be phished, relayed by an OTP bot or redirected by a SIM swap. SMS still reaches more people, which is why NIST keeps it as a restricted fallback. Use passkeys as the default and SMS only where a user has nothing else.
SMS OTP vs passkeys: which is more secure? Passkeys are more secure on every attack that matters for consumer logins: they can’t be phished, relayed by an OTP bot or redirected by a SIM swap. SMS still reaches more people, which is why NIST keeps it as a restricted fallback. Use passkeys as the default and SMS only where a user has nothing else. Source: https://glide-cleartext.pages.dev/compare/sms-otp-vs-passkeys/ (Cleartext, verified 2026-09-24)
A
SMS OTP
A one-time code sent by text message and typed by the user.
B
Passkeys
A FIDO2 key pair bound to the website; the private key never leaves the user’s device or sync provider.
Comparison table #
8 criteria · stronger: SMS OTP 1, Passkeys 5 · even or not comparable: 2
| Criterion | SMS OTP | Passkeys |
|---|---|---|
| How it works | Code sent over the phone network, typed into the site | Browser signs a challenge with a private key registered for that site |
| Phishing-resistant | No | Yes: bound to the site’s domainStronger |
| Exposed to SIM swap | Yes: whoever holds the number gets the code | No: not tied to a phone numberStronger |
| Exposed to OTP bots | Yes: the user can be talked into reading it out | No: there is no code to read outStronger |
| NIST SP 800-63B-4 | Restricted authenticator | Synced: accepted at AAL2. Device-bound hardware keys: eligible for AAL3Stronger |
| What the user needs | A phone number that can receive textsStronger | A device and browser that support passkeys |
| Recovery risk | Number recovery runs through the carrier | Moves to the sync account (synced) or backup credentials (device-bound) |
| Per-use cost | Per-message SMS delivery fees | No messaging fee per sign-inStronger |
Verdict #
For any login or payment approval that matters, passkeys win. The one criterion where SMS leads, reach, is the reason NIST lets it stay as a restricted authenticator: offer it only where a user has no passkey-capable device, and never use SMS to recover an account that has a passkey.
Choose SMS OTP when
The user has no passkey-capable device, for a transition period, and with the NIST restricted-authenticator conditions met.
Choose Passkeys when
Default sign-in for returning users, step-up for payments and payee changes, and any flow a regulator has moved off codes.
Evidence #
Related questions #
Is SMS OTP still allowed under NIST SP 800-63-4?
Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.
Full answerAre synced passkeys phishing-resistant?
Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.
Full answerWhat is a SIM swap attack?
A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.
Full answerWhat is an OTP bot?
An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
Full answerCite this comparison #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “SMS OTP vs passkeys” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/compare/sms-otp-vs-passkeys/
Markdown link
[SMS OTP vs passkeys](https://glide-cleartext.pages.dev/compare/sms-otp-vs-passkeys/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |