2FA Without a Smartphone: Keys, Tokens, and Text Codes

You can keep 2FA without a smartphone by moving each account to a security key, a code token, or text codes on a basic phone. A key costs about $29 and works with Apple, Google, and Microsoft accounts. But a bank that approves sign-ins only in its own app still needs a smartphone somewhere.

This suits you if you are leaving a smartphone, or if your new phone has no authenticator app. It moves one job off the phone, so it sits between a quieter smartphone and a full switch. If you have not planned the rest of the move, how to switch to a dumbphone covers it.

Six ways to get 2FA without a smartphone

Each method costs something different, and each one gives something up. Most people need two or three of them, matched to what each account accepts.

• A security key: about $23 to $58 per key, and you want two. It works for Apple, Google, and Microsoft, but each bank or site decides whether it accepts one.
• A code token: about $30 to $44. It shows codes for sites that offer an authenticator app, but you program it once per account.
• Text codes on a dumbphone: free on your own line. They rest on your phone number, and some shared-number setups drop them.
• Backup codes: free. Each code works once, so they are a fallback, not a daily method.
• An authenticator on a computer or a phone at home: free if you own one. You can sign in only where that device is.
• A dumbphone with a code tool: no extra cost if you were buying one anyway. Lose the phone, though, and the codes go with it.

We would start with two keys for the accounts that guard the rest, then fill the gaps with backup codes and a token.

Use a security key for Apple, Google, and Microsoft

A security key is a small USB or NFC device that you plug in or tap when an account asks for a second step. It works with services that support the FIDO2 or older U2F standards, and Yubico’s keys need no battery or software.

What two keys cost

Buy two keys, so one can stay home as a spare. The Yubico Security Key series costs $29 per key, with NFC and a USB-A or USB-C plug. It is FIDO only, so it cannot store authenticator codes.

The YubiKey 5C NFC costs $58 and adds room for 64 authenticator accounts, which you read in Yubico’s app on a computer. It also works with most Mac and iPhone models. Yubico takes consumer returns within 45 days, and US shipping is free on orders of $100 or more.

Google’s Titan Security Key costs $30 with USB-A and NFC, or $35 with USB-C and NFC. Token2’s PIN+ Mini-C key costs about $23, but Token2 ships to the US from Switzerland or the EU, and any import duties are yours. For an Apple Account, pick a key that is FIDO Certified.

Apple Account

Security Keys for Apple Account needs at least two FIDO Certified keys, and you can add up to six. Every device signed in to the account needs iOS 16.3, iPadOS 16.3, macOS Ventura 13.2, or later. Child accounts and Managed Apple Accounts cannot use keys.

You add keys only on an Apple device. On an iPhone or iPad, open Settings, tap your name, then Sign-in & Security, Two-Factor Authentication, Security Keys, and Add Security Keys. On a Mac, the same path runs through System Settings.

After that, a new device or the web asks for your password plus a key or a trusted Apple device nearby. Six-digit codes stop working as a second step, so a dumbphone on your trusted number no longer gets Apple codes. Lose every key and every trusted device, and you can be locked out for good.

NFC keys work only with an iPhone, so a Mac needs a key with a USB plug. If you are leaving Apple devices behind entirely, you have nowhere to add keys, and text codes to a trusted number are the route.

Google Account

A Google Account takes any FIDO1 or FIDO2 key as a second step. Add the key under 2-Step Verification in Chrome, Firefox, or Safari. A FIDO2 key can also hold a passkey, so you sign in with the key and skip the password.

A new computer asks for the key or another second step, and you can skip the key on computers you trust. If a key does not work on a device or browser, you may get the option of a code or a prompt instead. So keep backup codes as your other step.

The Advanced Protection Program goes further. It requires a passkey or a security key to sign in, limits which apps can reach your Google data, and tightens account recovery. It is built for journalists, activists, and others at risk of targeted attacks, and Titan keys work with it.

Microsoft account

A Microsoft account takes a FIDO2 key. On the Microsoft account page, choose Security, then More security options, Add a new way to sign in or verify, and Use a security key. You create a PIN during setup, so someone who finds the key cannot sign in without it.

Microsoft is phasing out text messages for sign-in, and adding a new phone number may not be offered. That leaves a key, a passkey, an authenticator app, or a recovery email. For a Microsoft account, we would treat the key as the main method, not a backup.

Use a code token where a site offers only app codes

Some sites offer codes from an authenticator app but accept no security key. A hardware code token covers them. It is a small device with a screen and a button, and it shows the same codes an app would, with no phone and no signal.

Two Token2 models suit one person. The Molto-1-i costs about $30 and holds up to 10 accounts. You program it over NFC with Token2’s app for iPhone, Android, or Windows, so do it before the smartphone leaves.

Its battery is rated for roughly 4 to 5 years of light use, and the codes die with it. A gauge on the screen gives a couple of months of warning, so you have time to move each account to a new token. An optional PIN keeps a finder from reading your codes.

The Molto-2-v2 costs about $44 and holds up to 100 accounts. You program it over USB-C from a computer with Token2’s config tool, so it needs no phone at all.

Its screen runs on a rechargeable battery that lasts 3 to 4 months, while its clock battery is rated for 8 years. The clock can drift, so plan to resync it from the computer every year or two.

A token makes codes and nothing more. It cannot approve a push prompt from a bank or work app. We would pick the Molto-2-v2 if you have more than a handful of accounts, because it never needs a phone, even for setup.

Get text codes on a dumbphone

Text codes need nothing new, because any phone on your number receives them. Google and Apple both send sign-in codes by text. Add the dumbphone’s number as a trusted phone number on your Apple Account before you switch.

The weak spots are setups that share one number across two phones. Check yours before you rely on it:

• Google Voice: you cannot send texts to five- or six-digit short codes, and some banks will not text a Google Voice number.
• T-Mobile paired DIGITS: most short codes, such as one-time PINs, reach only the primary SIM.
• Call forwarding: it moves calls, not texts, so codes stay on the smartphone.

A SIM swap is the exception, because the codes follow the SIM. Two phones, one number compares each setup and what it drops.

Text codes also follow your number, so anyone who takes over the line gets them too. They suit low-stakes accounts. We would not leave email or a bank on text codes alone if the account takes a key.

Print backup codes and store them apart

Backup codes are a set of one-time codes you can print and keep. Each code works once, so they cover a lost key or a dead token, not daily sign-ins.

Google generates them under 2-Step Verification. For other accounts, look for a similar set in the security settings.

Google also has a second fallback. On any device still signed in to your account, go to g.co/sc to make a security code for a new sign-in. That helps when the key is at home and you are not.

Store the printout away from the keys. Keep one key at home and one at work, and leave the spare at home when you travel. Label each sheet with the account and the date, so the right codes are easy to find on the day you need them.

A photo of the codes on the smartphone you are leaving defeats the point. If you keep them in a password manager instead, the codes and your passwords sit in one place.

Keep an authenticator on a computer or a phone at home

Codes do not have to live on the phone you carry. An authenticator on a computer, or an old phone that stays in a drawer, covers sites with app codes and costs nothing extra.

• On a Mac: the Passwords app in macOS Sequoia or later makes verification codes. Open the account, click Edit, then Set Up Code, and paste the setup key a site shows when you choose an authenticator app.
• On Windows or Linux: a YubiKey 5C NFC holds codes for up to 64 accounts, and Yubico Authenticator shows them on Windows, macOS, or Linux. The codes stay on the key, so they move with it between computers.
• On an old phone at home: keep the authenticator app on the smartphone and leave it in a drawer. App codes work even when that phone is offline.

The catch is place. You can sign in only where the computer or the home phone is, which suits a bank you check from a desk but not a sign-in at work. On a Mac, the password and the code also sit on the same computer.

Pick a dumbphone with its own code tool

Some dumbphones carry an authenticator, so the codes travel in your pocket with no smartphone:

• Light Phone III: its Authenticator tool arrived in July 2026, and the Light Phone III review covers the rest of Light OS. The phone in our Light Flip review has the same tool.
• Wisephone II: WiseOS includes a two-factor code tool, and the phone also runs maps and WhatsApp. The Wisephone II review covers its apps and its monthly plan.
• Sunbeam: models such as the Juniper and Redwood come with a code app, covered in the Sunbeam F1 Pro review.
• Dumber Mini: FreeOTP+ and Microsoft Authenticator both work on it, as the Dumber Mini review covers.

Moving codes into these tools has limits. Some authenticator apps cannot export codes, so those accounts need new codes set up on the phone. Which services Light’s tool supports is not published, so test yours first.

A code tool also puts your codes on the one device you carry everywhere. Lose the phone and the codes go with it, so keep a key or backup codes as well. Many keypad phones have no code tool at all, and the best dumbphones shows which current picks have one.

Set it up in this order

Add every new method while the smartphone still works, and remove the old one last. Done the other way round, one forgotten account can lock you out.

1. Check each account. On a computer, open each account’s security settings and note what it accepts: a key, app codes, text codes, or only its own app.
2. Buy two keys. An Apple Account requires two, and a second key covers a lost one everywhere else.
3. Add the keys. Register both keys on every account that takes them. A new key on a Google Account may wait up to 7 days before it works at sign-in.
4. Move app codes. Set up the token, the computer app, or the phone’s code tool for each site that offers only app codes.
5. Print backup codes for every account that offers them.
6. Test each sign-in. Sign out on a computer, then back in with the key or the token. On Apple, adding keys signs out devices you have not used in more than 90 days.
7. Remove the phone last. Take the old authenticator app and phone off each account only after every test passes.

Keep the old smartphone in a drawer for a few weeks after that. If a forgotten account asks for its app, you can still reach it.

When a security key is not enough

Some accounts accept no key, no token, and no text code. A bank may approve sign-ins only in its own app, and some work accounts use push approvals in apps such as Okta Verify or Duo Mobile. For a work account, ask your IT team before you switch.

For a bank app, keep a smartphone at home for that one job, and let the dumbphone carry your calls while the smartphone stays in a drawer.

If you would rather keep one phone, make it quieter instead. How to turn an iPhone into a dumbphone keeps the bank app and the authenticator in Always Allowed while everything else goes quiet.

Common questions

Can you use 2FA with no phone at all?

Yes, for accounts that accept a security key or app codes. Two keys, a code token, and printed backup codes cover them with no phone. Accounts that offer only text codes still need a phone on your number, and a bank app still needs a smartphone.

Does a YubiKey work with an Apple Account?

Yes. The YubiKey 5C NFC works with most Mac and iPhone models, and an Apple Account takes any FIDO Certified key. You need two keys and an Apple device to add them, and six-digit codes stop working once the keys are on.

What happens if you lose your security key?

Sign in with your second key or another second step, remove the lost key, and add a new one. On a Google Account, backup codes count as that second step. On an Apple Account, losing every key and every trusted device can lock you out for good.

Can a dumbphone get two-factor codes by text?

Yes, any phone on your number receives text codes. The problems come from setups that share a number. Paired DIGITS sends most short codes only to the primary SIM, and call forwarding moves no texts at all.

Final thoughts

Start with two security keys on the accounts that guard the rest: Apple, Google, or Microsoft, and your main email. Print backup codes for each one. Then use a code token or a computer authenticator for sites that offer only app codes, and leave text codes for the last few.

If one bank or work app still needs a smartphone, keep that phone at home for that job. The rest of your sign-ins no longer depend on it.