August 5, 2026
Push notifications vs authenticator codes: which is safer?
Not all app-based 2FA looks the same. Some services text you a code, some show a rotating TOTP code to type, and some send a push notification you simply tap to approve. So which is best?
How each one works
- TOTP code: your authenticator generates a 6-digit code; you type it in. Nothing is sent over the network to reach you.
- Push approval: the service sends a prompt to its app on your phone; you tap "approve" or "deny."
Both are far stronger than SMS. The difference is in the details.
The trade-offs
- Convenience: push wins — one tap, no typing.
- Offline use: TOTP wins — it works with no signal, because the code is computed on-device. Push needs a data connection.
- Portability: TOTP is a universal standard that works in any authenticator app. Push is tied to one company's app.
The attack to know: MFA fatigue
Push has one weakness worth understanding. If an attacker already has your password, they can trigger approval prompt after approval prompt, hoping you'll tap "approve" out of annoyance or by accident. This is called MFA fatigue or prompt bombing.
The rule: never approve a login you didn't personally start. An unexpected prompt means someone has your password — deny it and change that password.
The takeaway
Both push and TOTP are great choices. TOTP is the most universal and works offline; push is the most convenient. Whichever a service offers, use it over a password alone — and save your backup codes.