Let's say I have a system which use something you know, like a password, and something you have, like a code sent to a cell phone, to authenticate.

Is there a preferred order to ask for the password and the code?

Should it be the password first then the code sent to the phone or the opposite?


The answer should be :

Password first but validate both at same time.

Explanation here

4 Answers 4


Don't know if there is some study about it, or if this question will be closed as opinion based, but:

In one online attack, you'll limit how much tries one can do for every x minutes, or even lock the account after x tries. So, a brute-force attack will have some limited impact. Anyway, a password probably will have more combinations than the code you'll send by SMS. In general, SMS sent codes have 4 characters, or 6 digits.

If someone is trying to brute-force and you send the SMS first:

  • if he has to guess the code, and the code is smaller than the password, it's easier to guess 6 digits than a good password.

  • if you send SMS for every attempt, the real user can get bored receiving so many codes that he didn't request, and there's little he can do about it (how to tell the site to stop accepting tries from the bad guy?)

If you ask for password first, you won't bother the real user until the account is locked by so many attempts. And after the account is locked, you can simple send the SMS stating "your account was locked due to x wrong attempts, to unlock it look at your email"

And perhaps sending SMS might cost you something, it can be less expensive sendig the SMS as a last step.

  • 3
    Do not give a pass/fail indication until both factors are checked. Otherwise, the attacker can divide and conquer. Also, this means the real account holder will get those SMS messages. Far from being annoying, that should generate a red alert condition. One isn't likely to get 10 such messages. The attacker who believes "Enter the SMS code" means a valid password will be disabused of that notion soon.
    – Bob Brown
    Commented Aug 29, 2014 at 22:54

In the ideal case, both can be entered at the same time, such as in the case of an an OTP generator. This way, you're testing the combination of the password and the OTP at the same time, without revealing which had the error, preventing an attacker from brute-force attacking either one in isolation.

But you have to take practical concerns into consideration in scenarios such as SMS-oritented verification. In such a case, an attacker can use the system itself to attack the user. If he can trigger an SMS message by attempting an authentication, even without knowing the password, then over time he may be able to annoy the user into disabling second-factor authentication just to make the SMS messages stop. Rate-limiting by the authentication service would likely not be enough to prevent this sort of attack.

So as a compromise, some minimal level of permission is required in order to trigger the out-of-band verification loop, be it SMS or email or phone call or other. This isn't ideal as it allows the password to be attacked in isolation, but the overall tradeoff is considered worth it.

Another consideration is information disclosure. How much information about a user's authentication setup do you want to disclose to an unauthenticated attacker? If second-factor is required, then requiring the second factor token up-front is sensible. Every user has it, so nothing personal is disclosed. But if the second factor field is only visible if you type in the username of a user who has it enabled, then an attacker can quickly tell if second factor is enabled without needing to know the password. Maybe that's a big deal, maybe it's not. But it's worth considering as that information could be used in picking a target for phishing campaigns.


I'd always go with the password first; this ensures that not just anyone can request that SMS or Email based authentication tokens be sent to users at random by simply clicking a button.

These services can in some cases be costly, and annoying.


Rethinking about it, the answer should be :

Password first but validate both at same time.


As @woliveirajr mentionned, you need to ask the password first or it will be very annoying to a user if an hacker try to connect to your account and you receive an SMS everytime he tries to log in. So, we need to only send an SMS if the password is valid.

On the other hand, as @tylerl mentionned, to get the best security you need to ask both at the same time. The trick you can use here is to only send the SMS code if the password was correct, BUT always ask for the SMS code during the log in, even if the password was wrong.

This way the attacker has no way to know if it was the password or the SMS code that was incorrect AND you don't annoy the real user with an SMS on every fail/hacking attempt.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .