SMS two-factor statistics
How many services still send sign-in codes by text
Last updated 30 October 2026 · Data: 2fa.directory
I counted how the 1,895 services in 2fa.directory with two-step sign-in send their codes. 46% still send them by text message, and in banking, insurance and government most of them do.
Key findings
- 46% of the 1,895 services in 2fa.directory that offer two-step sign-in send their codes by text message (869 services).
- 18% of those services (340) offer no authenticator app and no security key: their second step is a text, a phone call or an email.
- 8% (152 services) send the second step only by text message or phone call.
- 32% of the services that send codes by text offer no authenticator app or security key instead.
- 71% of banks with two-step sign-in send codes by text (139 of 196), and 30% offer no authenticator app or security key.
- 89% of insurers (25 of 28) and 85% of government services (34 of 40) send sign-in codes by text.
- Among services listed for the United States, 76% send sign-in codes by text (230 of 302), against 34% of services listed worldwide.
By category
Categories with at least 20 services, most text-reliant first.
| Category | Send codes by text | No app or key |
|---|---|---|
| Insurance28 services | 89% | 79% |
| Government40 services | 85% | 20% |
| Travel22 services | 82% | 55% |
| Utilities60 services | 73% | 53% |
| Banking196 services | 71% | 30% |
| Payments53 services | 68% | 26% |
| Investing64 services | 67% | 38% |
| Shopping70 services | 66% | 51% |
| Health31 services | 61% | 29% |
| Universities97 services | 59% | 1% |
| Finance82 services | 52% | 24% |
| Identity26 services | 50% | 8% |
| Smart home and devices26 services | 46% | 19% |
| Communication62 services | 45% | 19% |
| Social50 services | 42% | 14% |
| Backup and sync52 services | 39% | 8% |
| Crypto129 services | 37% | 2% |
| Marketing78 services | 37% | 13% |
| Email providers43 services | 37% | 2% |
| Cloud50 services | 32% | 2% |
| Creative tools22 services | 32% | 9% |
| Entertainment22 services | 32% | 14% |
| Task management23 services | 30% | 0% |
| Domains77 services | 27% | 4% |
| Education26 services | 27% | 27% |
| Developer tools141 services | 25% | 6% |
| Gaming77 services | 23% | 9% |
| Hosting101 services | 23% | 5% |
| Remote access23 services | 22% | 4% |
| Security62 services | 18% | 10% |
By country
Services listed for one country are mostly local banks, utilities, shops and public services, so they lean on texts far more than services listed worldwide (34% of 1,174).
| Country | Send codes by text | No app or key |
|---|---|---|
| United States302 services | 76% | 35% |
| Italy38 services | 71% | 32% |
| Australia104 services | 69% | 48% |
| Canada84 services | 67% | 36% |
| Spain35 services | 63% | 31% |
| United Kingdom105 services | 61% | 33% |
| France47 services | 57% | 36% |
| Netherlands41 services | 49% | 22% |
| Germany102 services | 47% | 24% |
| Sweden49 services | 39% | 16% |
How I counted
- The list is 2fa.directory’s public data (https://api.2fa.directory/v3/all.json), read on 30 October 2026. It names 2,575 services: 1,895 offer two-step sign-in and 680 don’t.
- A service counts as sending codes by text when SMS is one of its listed two-step methods.
- No authenticator app or security key means none of these is listed: an authenticator app (TOTP), a security key (U2F or FIDO2), or the service’s own app or hardware token.
- Categories and countries are 2fa.directory’s own tags, and a service can carry more than one. A country means the service is listed for that country; services listed for no country are counted as worldwide. Categories with fewer than 20 services and countries with fewer than 35 are left out, because one service would move them too much.
- 2fa.directory is built by volunteers from each service’s own help pages, so it isn’t a random sample of the web, and it counts what a service offers, not what people choose.
Data: 2fa.directory, MIT License, © 2factorauth and contributors (2014–2020 © Josh Davis).
Quoting these numbers
You’re welcome to quote any number here. Please link to this page, so readers can see the method and the date. I’ll update the counts as 2fa.directory changes, at the same address.
Fwrd, “SMS two-factor statistics: how many services still send sign-in codes by text”, 30 October 2026, https://www.fwrdsms.com/sms-2fa-statistics. Based on 2fa.directory data.
Why it matters
A code sent by text goes to one phone number. When a team shares an account, or the phone with that number is in another country, the code has to reach someone else in time. I make Fwrd, an iPhone app that sends those texts straight to a Slack, Microsoft Teams, Discord or Telegram chat, or a webhook, and hands them to your shortcut for email, another phone or WhatsApp.
- Share 2FA codes with your team in Slack
- One phone number for a team’s two-step codes
- Forward verification codes from your iPhone
- Not getting bank codes abroad
Fwrd on the App Store: free for 15 forwards a month.