Should you use a temporary number for two-factor authentication?

Why a short-lived number is a poor second factor

Two-factor authentication works because the second step is something only you have. With a text code, that thing is the phone number. A temporary number fails that test in two ways.

• You lose it. When the number ends, the service still sends your code to it, and the code goes nowhere you can see. Sign in on a new device, or get logged out, and you are locked out unless the service has another way in.
• Someone else gets it. An ended number can be given to a new person, who then receives every code the service sends. If your password ever leaks, they hold both halves. What happens when a number ends covers the research on this.

A free public number is worse again: everyone can read its codes from the start. See whether free receive-SMS sites are safe.

What to use instead of a text

• An authenticator app. It makes the code on your own device. Nothing is sent, so there is no number to lose and no text for anyone else to receive.
• A passkey or a security key. You sign in with your device or a physical key instead of a code, and there is no code to read out or type in.

Look in the account’s security settings once you are signed in. A service that wanted a phone number at sign-up may still offer one of these as a second step, and once one is on, the number matters much less.

When a rented number is reasonable

All of these need to be true:

• The service offers text codes and nothing else as a second step.
• You can’t, or would rather not, use your own number for it: you live outside the US and the service wants a US number, or you keep a side project apart from your personal phone.
• You will keep the number for as long as you keep the account.

In practice that means a year at $34.99, about $0.10 a day, with auto-renew turned on so the number doesn’t lapse. Renewals keep the price you first paid, and we email you before a number ends. One number receives texts from any number of senders, so it can cover several accounts, but losing it would then lock you out of all of them.

Know the limits first. Our numbers only receive texts, so if the service falls back to reading a code out by voice call, that call won’t arrive. And some services refuse some numbers, so check that the first code arrives before you depend on it.

The backup to set up the day you add the number

1. Save the recovery codes

   If the service offers one-time backup codes, save them somewhere other than the account itself.

2. Check the recovery email

   Make sure it is an address you will still read in a year, and that its own sign-in doesn’t hang on the same number.

3. Turn on auto-renew

   On the number’s page. Keep the card on your account current, since a renewal can’t go through on an expired one.

4. Add a better second step when one appears

   If the service later offers an authenticator app or a passkey, switch to it and the number becomes a spare.

Accounts that should never depend on a rented number

• Your main email account. It is how you recover everything else, so its second step should be an authenticator app, a passkey or a number you own.
• Banks and payment accounts. They are the accounts most worth taking over. Use a number you own.
• Any account whose terms require your own number. Follow the terms.

Questions people ask

Is SMS two-factor authentication better than none?

Yes. A text code on a number you keep still stops someone who has only your password. It is the weakest of the second steps, and it only helps while the number stays yours.

What happens to my 2FA codes if my temporary number expires?

The service keeps sending them to the old number. Until the number is given to someone else they reach nobody; after that they reach the new holder. Either way you need a backup code or another sign-in method to get in.

Can I get 2FA codes by voice call on a rented number?

Not on ours. It only receives texts, so choose the text option. If the service only offers a call, use a different second step.

Can one rented number handle 2FA for several accounts?

Yes, it receives texts from any sender. But losing the number would then lock you out of every one of those accounts at once, so keep it for as long as the longest-lived of them.