# SMS OTP vs passkeys

> **Verdict in brief:** Passkeys are more secure on every attack that matters for consumer logins: they can’t be phished, relayed by an OTP bot or redirected by a SIM swap. SMS still reaches more people, which is why NIST keeps it as a restricted fallback. Use passkeys as the default and SMS only where a user has nothing else.

- URL: https://glide-cleartext.pages.dev/compare/sms-otp-vs-passkeys/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

**A. SMS OTP:** A one-time code sent by text message and typed by the user.

**B. Passkeys:** A FIDO2 key pair bound to the website; the private key never leaves the user’s device or sync provider.

## Comparison table

| Criterion | SMS OTP | Passkeys |
|---|---|---|
| How it works | Code sent over the phone network, typed into the site | Browser signs a challenge with a private key registered for that site |
| Phishing-resistant | No | Yes: bound to the site’s domain (stronger) |
| Exposed to SIM swap | Yes: whoever holds the number gets the code | No: not tied to a phone number (stronger) |
| Exposed to OTP bots | Yes: the user can be talked into reading it out | No: there is no code to read out (stronger) |
| NIST SP 800-63B-4 | Restricted authenticator | Synced: accepted at AAL2. Device-bound hardware keys: eligible for AAL3 (stronger) |
| What the user needs | A phone number that can receive texts (stronger) | A device and browser that support passkeys |
| Recovery risk | Number recovery runs through the carrier | Moves to the sync account (synced) or backup credentials (device-bound) |
| Per-use cost | Per-message SMS delivery fees | No messaging fee per sign-in (stronger) |

Cleartext comparison. NIST classifications from SP 800-63B-4[^1]; phishing resistance per CISA[^2].

## Verdict

For any login or payment approval that matters, passkeys win. The one criterion where SMS leads, reach, is the reason NIST lets it stay as a restricted authenticator: offer it only where a user has no passkey-capable device, and never use SMS to recover an account that has a passkey.

- **Choose SMS OTP when:** The user has no passkey-capable device, for a transition period, and with the NIST restricted-authenticator conditions met.
- **Choose Passkeys when:** Default sign-in for returning users, step-up for payments and payee changes, and any flow a regulator has moved off codes.

## Sources

[^1]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html
[^2]: Implementing Phishing-Resistant MFA (fact sheet). CISA, 2022-10. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
[^3]: NIST cites phishing resistance of synced passkeys in digital identity guidelines update. FIDO Alliance. https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/ (secondary)

## Related questions

- [Is SMS OTP still allowed under NIST SP 800-63-4?](https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/)
- [Are synced passkeys phishing-resistant?](https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/)
- [What is a SIM swap attack?](https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/)
- [What is an OTP bot?](https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/)

## Cite

Cleartext. “SMS OTP vs passkeys” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/compare/sms-otp-vs-passkeys/

## Changelog

- 2026-09-24: First published.