OTP via email vs SMS vs TOTP — which one is actually most secure?

Three flavours of one-time password dominate consumer auth in 2026: email OTP (a 6-digit code sent to your inbox), SMS OTP (a 6-digit code sent by text), and TOTP (a 6-digit code generated client-side by Google Authenticator, Authy, or 1Password). They look identical from the user's perspective. They're wildly different in security.

The three threat models

Email OTP

Threat model: attacker who can read your email. That's it. If your email is compromised (phishing, password reuse, breach), email OTP is bypassed. If your email is on a temp provider, anyone with access to that provider can read your OTP.

Strengths: universal, no install, easy reset.

Weaknesses: account-recovery loop on the email itself; SMTP transit can be intercepted in nation-state attacks.

SMS OTP

Threat model: attacker with control of the phone number. SIM-swap is a $5 attack at most carriers — bribe a store employee, they swap the SIM, the attacker now receives every SMS. SS7 protocol attacks let nation-state actors intercept SMS transparently.

Strengths: works on any phone; no install.

Weaknesses: SIM-swap (huge); SMS carriers can be compromised; phone-number reuse (US carriers recycle numbers). NIST SP 800-63B-3 deprecated SMS as a sole 2FA factor in 2017 — most banks still ignored that.

TOTP (RFC 6238)

Threat model: attacker with the shared secret. The shared secret is generated once at enrolment, scanned via QR into your authenticator app, and never sent over the wire again. For an attacker to bypass TOTP, they need physical or remote access to your authenticator device (or the encrypted backup of it).

Strengths: client-generated, never transmitted, works offline, immune to SIM-swap, immune to email compromise.

Weaknesses: requires app + initial setup; phone loss is annoying without backups.

Which to use when

Where temp mail fits in

Temp mail is appropriate for the bottom rows of that table: the accounts where compromise has minimal cost. Use it for:

• Newsletter signups
• Forum accounts you'll abandon
• Free-trial signups for software
• Any verification flow on a service where losing the account costs you nothing

Don't use temp mail for:

• Banking, brokerage, crypto wallets — use a real address with TOTP enrolled
• Account-recovery destinations — your primary email should be on a real account with TOTP
• Anywhere a bad actor could profit from compromise (work accounts, payments, identity)

The TOTP setup that beats everything

For accounts that matter: enable TOTP, save the recovery codes in an offline password manager (1Password, Bitwarden), enable cloud-backup of your TOTP secrets so phone loss doesn't lock you out (Authy, 1Password, Google Authenticator's 2023 cloud-sync). Audit annually.

For accounts that don't matter: PocketInbox catches the OTP in 30 seconds and you never see that account again.

Related: Temp mail for 2FA — when it works and when it doesn't.