In response to the vulnerabilities of SMS-based 2FA, the introduction of authenticator apps represented a significant leap forward in the security landscape. These apps generated time-based, one-time passcodes (TOTPs) that provided a more secure and reliable second factor for authentication. Unlike SMS codes, which could be intercepted or delayed, authenticator apps operated locally on the user’s device, reducing the attack surface.

Authenticator apps shifted the responsibility of self-custody further into the hands of the user, offering a more decentralized form of authentication. Users no longer relied on their mobile carrier or email provider to receive codes; instead, they could generate them independently. This transition not only enhanced security but also empowered users to take greater control over their online identities.

The adoption of authenticator apps also signaled a broader trend toward decentralization in digital security. As users began to embrace these tools, they became more conscious of the importance of maintaining control over their own authentication mechanisms. This shift in mindset laid the groundwork for the next major advancement in online self-custody: passkeys.