Should I use SMS for password reset codes?

SMS can be used for password reset codes, but it’s not the best option if you have a better alternative.

Why SMS is risky

• SIM swap attacks: An attacker can hijack a phone number and receive the code.
• Carrier interception / forwarding issues: SMS isn’t end-to-end secure.
• Delivery delays / failures: Messages can arrive late or not at all.
• Number recycling: Old numbers can be reassigned to someone else.

Better options

If possible, use one of these instead:

• Email reset links or codes (still not perfect, but often better than SMS)
• Authenticator app / TOTP (for MFA, not usually for password reset alone)
• Hardware security keys for high-security accounts
• Recovery codes issued in advance

If you must use SMS

Use it as a fallback, not the primary method, and add safeguards:

• Rate limit reset attempts
• Notify users by email/push when a reset is requested
• Short code expiry (e.g. 5–10 minutes)
• Don’t reveal whether an account exists
• Require additional checks for high-risk accounts
• Monitor for suspicious reset activity

Practical recommendation

• Consumer apps: SMS is acceptable as a convenience fallback.
• Sensitive or high-value accounts: avoid SMS as the main recovery channel.

If you want, I can help you design a secure password reset flow for your app.