September 25, 2026
2FA in 2026: how 3,364 websites handle two-factor authentication
How many websites let you protect your account with an authenticator app, and how many still rely on a text message? We counted, using the open 2fa.directory dataset as of 25 September 2026.
Key findings
- 73% of sites offer some form of 2FA. Of the 3,364 websites in the directory, 2,442 have at least one second factor; 922 (27%) have none.
- Authenticator apps are the most common method. Two in three sites with 2FA (1,641, or 67%) support time-based codes from an authenticator app (TOTP). Half (50%) offer SMS codes.
- One in five sites with 2FA offers only weaker methods. 497 sites (20%) support nothing but SMS, email or phone-call codes, which can be intercepted or redirected.
- Banks lag far behind. Only 10% of the 263 banks in the directory accept a standard authenticator app. Banks lean on SMS (51%) and their own banking apps (39%) instead. Crypto exchanges are the opposite: 95% support authenticator apps.
- Passkeys are still early. 400 sites accept passkeys, 222 of them for passwordless sign-in and 219 as a second factor. That is about 11% of the sites in the 2FA directory.
Which 2FA methods sites support
Share of the 2,442 sites that offer 2FA (a site can offer several methods):
| Method | Sites | Share |
|---|---|---|
| Authenticator app (TOTP) | 1,641 | 67% |
| SMS code | 1,223 | 50% |
| Email code | 524 | 21% |
| The service's own app | 444 | 18% |
| Phone call | 361 | 15% |
| Security key (U2F / WebAuthn) | 233 | 10% |
| Hardware token | 173 | 7% |
An authenticator app is the best balance for most people. Codes are made on your phone, work offline, and can't be intercepted through a SIM swap the way SMS codes can. Security keys are stronger still against phishing, but only one in ten sites supports them.
2FA support by sector
Sectors with at least 40 sites, ordered by authenticator-app support. "Only SMS, email or call" counts sites whose 2FA offers nothing stronger.
| Sector | Sites | Any 2FA | Authenticator app | Security key | Only SMS, email or call |
|---|---|---|---|---|---|
| Crypto | 129 | 98% | 95% | 5% | 2% |
| Cloud | 49 | 94% | 90% | 14% | 2% |
| Hosting | 90 | 93% | 89% | 2% | 4% |
| Domains | 80 | 89% | 80% | 12% | 4% |
| Backup | 50 | 94% | 80% | 22% | 8% |
| Security | 57 | 95% | 79% | 9% | 11% |
| Developer tools | 150 | 87% | 77% | 12% | 5% |
| Marketing | 79 | 94% | 77% | 0% | 13% |
| 45 | 87% | 76% | 31% | 2% | |
| Gaming | 88 | 83% | 68% | 7% | 8% |
| Communication | 71 | 85% | 66% | 11% | 15% |
| Finance | 101 | 78% | 57% | 2% | 19% |
| Social media | 70 | 69% | 54% | 6% | 10% |
| Government | 43 | 93% | 49% | 14% | 19% |
| Payments | 60 | 78% | 40% | 7% | 22% |
| Universities | 105 | 91% | 38% | 48% | 0% |
| Health | 51 | 59% | 37% | 8% | 18% |
| Investing | 72 | 76% | 36% | 4% | 26% |
| Entertainment | 63 | 32% | 27% | 5% | 5% |
| Education | 66 | 33% | 20% | 3% | 11% |
| Retail & shopping | 149 | 43% | 18% | 1% | 23% |
| Travel | 47 | 43% | 17% | 2% | 21% |
| Utilities & telecom | 111 | 54% | 14% | 2% | 29% |
| Banking | 263 | 72% | 10% | 2% | 22% |
Two patterns stand out. Services used by technical people, such as hosting, cloud, domains and developer tools, support authenticator apps almost everywhere. Services used by everyone, such as retail, travel, utilities and banking, mostly don't: fewer than one in five accept an authenticator app, and more than half of retail and travel sites offer no 2FA at all.
Universities are the exception in the other direction. Almost half support security keys, usually because they run a single sign-on system with a hardware-key option.
What this means for your accounts
- Turn on 2FA wherever it exists, even if the only option is SMS. It still stops most password-reuse attacks.
- Pick an authenticator app when you can. Two in three sites with 2FA support one; our setup guides show where to find the setting on each service.
- Save the recovery options the service gives you, such as backup codes or a recovery key, somewhere other than your phone.
- Add a passkey where it's offered, alongside your authenticator app.
Methodology
- Source: the 2fa.directory API (v4, 3,364 sites, and v3, 2,570 sites with categories) and the passkeys.directory API (1,077 sites), downloaded on 25 September 2026. Both are maintained by the 2factorauth community under the MIT license.
- What counts as a site: one directory entry, usually one domain. The directory is community-curated and leans towards well-known and technical services, so it's not a random sample of the web.
- Sectors: each site is counted once, under the first category it has in the directory. The sector table uses the v3 API, which carries categories, so its totals differ slightly from the v4 figures above.
- "Only SMS, email or call": sites with 2FA whose methods include none of authenticator app, security key, hardware token or the service's own app.
The sector figures are available as a CSV file. You're welcome to reuse them with a link to this page and to 2fa.directory.