The common second factors are not equivalent, and the differences are not marginal. An ordering by what each actually resists, why the weakest is still worth enabling, and the failure that defeats most of them regardless of which you chose.
What a second factor is for
So that a stolen password is not enough. Everything else follows from judging each method by what it resists rather than by how it feels.
Three different attacks, and they are usually discussed as though they were one.
Password reuse: your credential from somewhere else, tried here. Bulk credential stuffing: millions of pairs tried automatically against everything. Real-time deception: somebody convincing, on the phone or in a chat window, while you are logged in and trying to be helpful.
Every factor below defeats the first two. They differ almost entirely on the third.
The ranking
Hardware security key. Strongest, and the reason is mechanical rather than cryptographic: the key is bound to the site's domain, so the browser will not present it to a lookalike. You cannot be talked into misusing it, because misusing it is not an available action. Its failures are physical — theft combined with a weak fallback, or loss with no spare registered.
Passkey held in a device. The same domain binding and therefore the same resistance to deception. What differs is where the key lives and how it is recovered, and that difference is the entire security difference between this and the line above.
Authenticator app code. Defeats reuse and bulk attacks completely. Does not defeat deception: a code can be read aloud to somebody plausible, and it works for whoever enters it first. The app has no way to know who is asking.
SMS code. Defeats bulk attacks, and that is most of what happens. It does not defeat deception, and it carries an exposure no other factor has: the number itself can be moved to somebody else's control by a person who is good at sounding like you to a support agent. The factor is delivered to an address that can be reassigned.
Why the weakest is still worth enabling
Because the attack that actually happens to most people is a leaked password tried in bulk, and every item on this list stops it dead.
Advice that dismisses the weak option usually ends with somebody enabling nothing. Between SMS and nothing, SMS is a very large improvement. The ordering matters for accounts worth attacking specifically; for everything else, presence beats sophistication.
The failure that defeats most of them
Account recovery.
An attacker who cannot pass the second factor does not keep trying. They attack the reset path, which exists precisely to let somebody in who has lost their credentials.
If recovery falls back to an email address, then your email's protection is the real second factor on every account that resets through it, whatever each settings page claims. If it falls back to a support conversation, then the real factor is a person's judgement under time pressure.
This is why email deserves the strongest factor you own. It is not one account among many. It is the one that restores the others.
Recovery codes, and what people get wrong
They are equivalent in power to the password and the factor together. Anybody holding them does not need either.
Three common mistakes: storing them inside the account they protect, which defeats the separation entirely; photographing them, which places them in whatever syncs the photographs; and never generating them, which turns any lost device into a support ticket and a weaker recovery path.
Printed, kept physically, somewhere you would look for a passport.
What I would actually do
A hardware key or passkey on the accounts that can restore the others — email first, and almost everything else is downstream of it.
An authenticator app everywhere else, because the marginal gain over it is small and the friction of keys on fifty accounts is not.
SMS where nothing better is offered, without apology.
Recovery codes printed before they are needed. A second key or device registered before it is needed. Both of those are ten-minute jobs that only ever get done on a calm day, and are only ever wanted on a bad one.
Close
The second factor gets the attention and the recovery path decides the outcome. When you finish configuring one, read the other, because that is the door somebody will actually try.