This article is written by the team that builds Casdoor, so we are not neutral, and we say where we think Casdoor fits and where it doesn't. Facts about other products come from their own websites as of November 1, 2026 (listed under Sources) and may have changed. Spotted something out of date? Tell us.
"MFA" covers half a dozen methods with very different security properties. Choosing one by convenience is how organizations end up with a second factor that a phishing kit can relay in real time.
This article compares the methods that matter and suggests what to deploy for whom.
The comparison
| Method | Phishing-resistant | Usability | Cost | Recovery |
|---|---|---|---|---|
| SMS code | No | High — everyone has a phone | Per-message fees | Phone number change |
| Email code | No | High | Low | Mailbox access |
| TOTP app | No (relayable in real time) | Medium — app + copy code | Free | Backup codes |
| Push approval | No (fatigue attacks) | High — one tap | Free with app | Enrolled device |
| Passkeys (WebAuthn) | Yes | High — biometric | Free | Second device or platform account |
| Hardware key (FIDO2) | Yes | Medium — carry the key | Per key | Backup key |
Phishing-resistant here means the authenticator checks the origin, so a lookalike site cannot get a usable response. Only WebAuthn-based methods (passkeys and hardware keys) qualify.
SMS and email codes
Still the most common second factor, and the weakest:
- SMS is vulnerable to SIM swap, porting and interception. NIST classifies it as a restricted authenticator rather than a default.
- Email inherits the security of the mailbox — which is often the same password, and sometimes the same device.
They remain useful as a fallback for users who cannot install an app, but not as the primary factor for privileged accounts.
TOTP apps
A shared secret, a 30-second code. Better than SMS: no carrier involvement, works offline.
But the code is typed into whatever page asks for it. A real-time phishing proxy can relay it to the real site within the window. TOTP is also a support burden — lost phone means backup codes or a reset.
Push approvals
One tap on a registered device is the best user experience in the list, and the reason MFA fatigue attacks exist. Without number matching and context in the prompt, users approve prompts they did not initiate. See MFA fatigue.
If you use push, turn on number matching and show application and location context.
Passkeys
A WebAuthn credential: the private key stays on the device or in the platform keychain, and the server verifies a signature against a stored public key. Because the signature is bound to the origin, phishing does not work.
- Synced passkeys survive device loss but depend on the platform account.
- Device-bound passkeys live on one authenticator and need a backup.
For most users this is the best combination of security and usability available today, and CISA's guidance points at phishing-resistant MFA as the target state.
Hardware security keys
FIDO2 keys are the strongest option for administrators and high-value accounts: phishing-resistant, portable, and independent of the phone platform. The cost is logistics — buy two per person and plan enrollment.
What to deploy
| Group | First factor | Second factor |
|---|---|---|
| All users | Password or passkey | Passkey preferred; TOTP fallback |
| Administrators | Passkey or hardware key | Hardware key |
| Shared/kiosk devices | Password | Hardware key |
| Users without smartphones | Password | Email code or TOTP |
The migration path: offer passkeys alongside the existing factor, make enrollment easy, require passkeys for admins first, then retire the weakest factor — not the other way around.
Recovery is the deciding factor
Every method above has a "lost my device" story. The recovery flow decides the real security level:
- Multiple enrolled authenticators.
- A documented re-enrollment process with identity verification.
- Logging of every enrollment and recovery event.
- No silent fallback to a single email link.
How Casdoor handles MFA
Casdoor supports TOTP, SMS, email and RADIUS second factors plus WebAuthn/passkeys, configured per organization. That lets one deployment require passkeys for administrators and allow TOTP for everyone else, with the same user directory.
See the MFA documentation.
Related reading: MFA vs 2FA, what MFA covers and passkey vs password.
Casdoor is open source and self-hostable, with a hosted option from $9 per month and no per-user fees.
Sources
- NIST SP 800-63B: Authentication
- CISA: Implementing phishing-resistant MFA
- FIDO Alliance: Passkeys
- W3C: Web Authentication (WebAuthn)
Product names are trademarks of their respective owners.