Stillcode › Two-factor authentication › PayPal
PayPal sends you nothing: no text, no call, no mailbox fallback. What that leaves you holding, where its own instructions are, and what happens when the device holding your codes is gone.
These are the second factors PayPal offers on paypal.com. Which ones you
see can depend on your plan and your country;
what each of the seven actually costs you is set out once.
| Method | What it is | |
|---|---|---|
| Authenticator app (TOTP) | Supported | Computed on your own device; nothing is sent to produce it. |
| Hardware security key | Supported | A physical key you tap; the one option phishing does not beat. |
| SMS text message | Not offered | Texted to your number, so your carrier is part of the lock. |
PayPal's own caveat, as recorded in the directory: 2FA can only be setup on the website. A backup 2FA method is needed to setup security key.
Data sourced from 2FA Directory by 2factorauth. Snapshot 2026-09-24.
PayPal offers no SMS or voice option at all. That is worth noticing rather than skipping past: it removes the SIM-swap route onto the account entirely, and it means an authenticator app is the baseline here, not an upgrade.
A hardware security key is also accepted. It is stronger than any code, because a code can be typed into a convincing fake page and a key cannot. The usual arrangement is a key as the primary factor and an authenticator app as the backup that fits in a pocket.
Of the fifty services on this site, twelve send you nothing at all — no text, no voice call, no email fallback,
and PayPal is one of them. Five of the fifty accept exactly this combination, so the same
decision comes up on four other
services here. Among the two services filed under payments, every
one accepts a hardware security key.
The directory files PayPal under payments, records two of the seven second
factors it tracks, and points at instructions published at
www.paypal.com/us/cshelp/article/help167.
PayPal is paypal.com, and the same account also signs you in at
paypal-search.com. Two-factor authentication
is a property of the account, not of the address you happened to type — switch it on once
and every one of those is covered. That also means losing the second factor loses all of them at
once.
PayPal's own instructions: PayPal — two-factor authentication — linked, never copied, because a stale menu path here locks people out.
PayPal publishes no dedicated page for losing your second factor, which in practice means the route back is ordinary account recovery: proving who you are to support, on their timetable.
Background: how the codes work · what still works when the phone is gone.
An iPhone, iPad and Mac authenticator for these codes that makes no network calls at all. What is free and what Pro adds. Get it on the App Store