# TOTP vs push notifications

> **Verdict in brief:** Neither is phishing-resistant. Push is easier to use but adds a specific weakness, MFA fatigue, where attackers send prompts until the user approves; number matching reduces it. TOTP has no push-bombing risk but can be typed into a fake site. CISA treats number-matching push as an interim step toward phishing-resistant MFA.

- URL: https://glide-cleartext.pages.dev/compare/totp-vs-push-notifications/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

**A. TOTP codes:** Six-digit codes computed in an authenticator app from a shared secret and the time.

**B. Push notifications:** An approve-or-deny prompt sent to the user’s authenticator app.

## Comparison table

| Criterion | TOTP codes | Push notifications |
|---|---|---|
| How it works | User types a code shown in the app | User taps approve on a prompt |
| Phishing-resistant | No | No |
| MFA fatigue (push bombing) | Not applicable (stronger) | Yes; reduced by number matching |
| Relay by a fake site | Yes, within the code’s validity window | Yes; the user approves the attacker’s login |
| Works offline | Yes (stronger) | No; needs a network connection |
| User effort | Open app, read and type six digits | One tap (plus a number, with number matching) (stronger) |
| Standard | Open standard, RFC 6238 (stronger) | Vendor-specific |

Cleartext comparison. TOTP per RFC 6238[^1]; push and number matching per CISA[^2]; phishing resistance per CISA[^3].

## Verdict

If you use push, turn on number matching; CISA recommends it as an interim measure for organizations that can’t yet deploy phishing-resistant MFA. If you use TOTP, know that it stops credential stuffing but not real-time phishing. Plan the move to passkeys or security keys either way.

- **Choose TOTP codes when:** Offline use, open-standard interoperability, and where push fatigue has been a problem.
- **Choose Push notifications when:** Workforce MFA with number matching enabled, while phishing-resistant MFA is being rolled out.

## Sources

[^1]: RFC 6238: TOTP: Time-Based One-Time Password Algorithm. IETF, 2011-05. https://www.rfc-editor.org/rfc/rfc6238
[^2]: Implementing Number Matching in MFA Applications (fact sheet). CISA, 2022-10. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf
[^3]: Implementing Phishing-Resistant MFA (fact sheet). CISA, 2022-10. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf

## Related questions

- [What is phishing-resistant MFA?](https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/)
- [Are synced passkeys phishing-resistant?](https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/)

## Cite

Cleartext. “TOTP vs push notifications” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/compare/totp-vs-push-notifications/

## Changelog

- 2026-09-24: First published.