Which type of two-factor authentication is actually best?

Ranked by resistance to attack: hardware security keys using FIDO2 or WebAuthn are the strongest, because they verify the site's identity cryptographically and therefore cannot be phished, since the key simply will not respond to a lookalike domain. Authenticator apps generating time-based codes are the practical middle, unlinked from your phone number and offline, though a convincing phishing site can still trick you into typing the code. SMS codes are the weakest, vulnerable to SIM swapping, where an attacker convinces or bribes a carrier employee to move your number to their device, and to interception. Push notification approvals sit near authenticator apps but are susceptible to fatigue attacks, where repeated prompts wear a user down into approving one.

The important framing is that any second factor is dramatically better than none, and SMS on an account is far preferable to a password alone, so it is not worth skipping two-factor because the only option is text messages. Two practical items people neglect: save the backup or recovery codes offline when you enable it, because losing your second factor without them can lock you out permanently, and set a PIN or port-out lock with your mobile carrier, which is a free call and is the specific defense against SIM swapping. Passkeys, which replace passwords entirely with device-stored cryptographic credentials, are the direction the industry is moving, and where offered they combine the phishing resistance of hardware keys with better usability.